State of MaineState Government

(2025-010) Confidential finding, see below for more information Title: ________ Pursuant to paragraph 6.64 of the U.S. Government Accountability Office’s Government Auditing Standards (also known as the Yellow Book), we omitted details from this finding as they are confidential under the provisions of 5 MRSA 244-C (3). Though the content of this finding has been redacted, we provided the Department(s) with detailed information regarding the specific condition we identified, as well as the related criteria, context, causes, effects, and our specific recommendations for improvement. Prior Year Findings: See Schedule of Findings and Questioned Costs for chart/table Type of Finding: Significant deficiency Corrective Active Plan: See F-11 Contact: Shirley Browne, Deputy State Controller, Office of the State Controller, 207-626-8423 (State Number: 25-0900-01)

(2025-011) Title: Internal control over SNAP eligibility determinations and benefit calculations needs improvement Prior Year Findings: See Schedule of Findings and Questioned Costs for chart/table State Department: Health and Human Services State Bureau: Office for Family Independence Federal Agency: U.S. Department of Agriculture Assistance Listing Title: SNAP Cluster Assistance Listing Number: 10.551, 10.561 Federal Award Identification Number: See E-65 to E-66 Compliance Area: Allowable costs/cost principles Eligibility Special tests and provisions Type of Finding: Material weakness Material noncompliance Questioned costs Known Questioned Costs: ALN 10.551 $47,493 Likely Questioned Costs: Undeterminable; incorrectly calculated Supplemental Nutrition Assistance Program (SNAP) benefits may result in overpayments or underpayments to clients. Due to the unique circumstances of each case, a projection of questioned costs cannot be reasonably estimated. Criteria: 2 CFR 200.303; 2 CFR 200.403; 7 CFR 272.10; 7 CFR 273.2 and .12 The Department must establish, document, and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. To be allowable under Federal awards, costs must be necessary and reasonable for the performance of the Federal award and be adequately documented. All State agencies must sufficiently automate their SNAP operations and computerize their systems for obtaining, maintaining, utilizing and transmitting information concerning SNAP. State agencies shall verify information such as residency, identity, disability, and household composition. Changes reported during the certification period are subject to the same verification procedures as applied at initial certification, except that the State agency shall not verify changes in income less than $50 or actual medical or utility expenses less than $25, unless the information is incomplete, inaccurate, inconsistent, or outdated. The State agency shall take prompt action on all changes to determine if the change affects the household’s eligibility or allotment. Condition: SNAP is administered by the Office for Family Independence (OFI) and provides monthly benefits to eligible households to purchase nutritious foods. OFI is required by Federal program regulations to utilize an automated information system for SNAP. The information system must maintain all case file information necessary to properly process eligibility determinations and benefit calculations. The Automated Client Eligibility System (ACES) is the information system used by OFI to automate SNAP operations. ACES relies on the maintenance of a complex framework of system results to make eligibility determinations and related benefit calculations. The Office of the State Auditor (OSA) tested 40 household monthly benefit payments to verify the accuracy of SNAP operations utilizing ACES, and identified: • that OFI does not require verification or investigation of information that is unclear, incomplete, inaccurate, or outdated as required by Federal requirements. A total of 32 overpayments of monthly SNAP benefits were identified, including: o 29 benefit overpayments totaling $25,800 due to manual processing errors, including: • 9 benefit overpayments totaling $5,095 to clients whose household income or expenses were not verified. • 8 benefit overpayments totaling $6,084 to clients whose household income was incorrectly calculated. • 6 benefit overpayments totaling $6,209 to clients whose information was outdated but was not further investigated for verification. 1 of the 6 clients disclosed new living arrangements; however, documentation from 2014 was not updated. • 5 benefit overpayments totaling $6,656 to clients whose household composition was not verified. • 1 benefit overpayment of $1,756 to a client whose disability status, exempting the client from work requirements, was not verified. o 3 benefit overpayments due to automated processes errors in ACES, including: • 1 benefit overpayment of $442; income information was available in ACES, however, it was not utilized when the benefit amount was calculated. • 1 benefit overpayment of $292, resulting from an incorrect benefit suspension. OSA identified a material weakness/material noncompliance with questioned costs as issued in finding 25-1108-02, Internal control over automated SNAP eligibility certification periods needs improvement, for incorrect benefit suspensions. • 1 benefit overpayment of $266; the full standard utility allowance was utilized in the calculation of the monthly benefit, however, the only reported utility was a phone. ACES applied the full standard utility allowance based on a phone expense manually entered into ACES by an eligibility specialist. • 15 of the 40 clients tested whose ACES case file information did not include proper verification of identity or residency documentation, including: o 8 clients whose case file information did not include any verification of identity documentation. o 5 clients whose identification card was expired at the time it was presented and was accepted for verification by OFI. o 2 clients whose only identification was an out-of-state license or school identification card, which is not acceptable documentation to support residency. OSA utilized a risk-based approach to select 20 cases with the highest monthly benefits and selected a non-statistical random sample for the remaining 20 cases. OSA reviewed self-employment income information reported by SNAP clients in fiscal year 2025, identified 10 clients with reported losses greater than $10,000 for further review, and found the following: • 4 benefit overpayments totaling $19,462; self-employment income was incorrectly entered into ACES and did not match underlying documentation. Of the 4 clients, 1 client’s income information was from a 2021 tax return. • 1 benefit overpayment totaling $1,231; income information was calculated utilizing tax documentation that did not include all income sources. The Department does not have adequate policies and procedures in place to ensure that ACES case file modifications, whether manual or system interfaced, that result in adjustments to previously issued monthly SNAP benefits are appropriately processed. This includes a recalculation of previously issued benefits when case file modifications are processed, the establishment of corresponding overpayments or underpayments, and related follow-up actions by OFI. Context: In fiscal year 2025, the State provided approximately 169,000 SNAP clients with $355.9 million in Federal benefits. Cause: • Lack of adequate policies and procedures • Lack of supervisory oversight Effect: • Known questioned costs • Potential future questioned costs and disallowances • Benefits may be incorrectly calculated, resulting in households being underpaid or overpaid. • Noncompliance with Federal regulations Recommendation: We recommend that the Department implement additional policies and procedures to ensure that: • case information entered into ACES is accurate; • automated eligibility determinations and benefit calculations are processed in accordance with Federal regulations; • information that is unclear, incomplete, inaccurate, or outdated is investigated and verified with supporting documentation as required; and • recalculations of previously issued benefits and related follow-up actions occur when case file modifications are retroactive. Corrective Action Plan: See F-11 Management’s Response: The Department partially agrees with the finding. There are many instances of exceptions cited by the Office of State Auditor (OSA) in which there isn’t a specific requirement that exists or the requirement has been waived in unusual cases such as the 2 clients who could not provide proof of residency. The residency requirements state that they shall be verified “except in unusual cases like households newly arrived in a project area.” There is merit in each of the larger categories identified by OSA however, the extent of the issues is far less than those cited and many of the verification standards applied by OSA far exceed the requirements of Food and Nutrition Services (FNS). The Department agrees with the exception based on an expired certification period. Contact: Ian Yaffe, Director, OFI, DHHS, 207-592-1481 Auditor’s Concluding Remarks: The Department must comply with the following Federal requirements: • At initial certification and recertification, the State agency shall verify information that is incomplete, inaccurate, inconsistent, or outdated (7 CFR 273.2(e)(1), and 273.2(f)(8)(i)(A) and (D)), including: o residency (7 CFR 273.2(f)(1)(vi)); o identity (7 CFR 273.2(f)(1)(vii)); o disability (7 CFR 273.2(f)(1)(viii)); and o household composition (7 CFR 273.2(f)(1)(x)). • When a household reports a change in residence, the State agency must investigate and take action on potential changes in shelter costs arising from this reported change (7 CFR 273.12(c)(4)(i)). For the cases cited in the Condition, OFI could not provide documentation to support that information used to determine eligibility and benefits was verified or investigated. Therefore, OFI is not in compliance with Federal regulations. The finding remains as stated. (State Number: 25-1108-05)

(2025-012) Title: Internal control over automated SNAP eligibility certification periods needs improvement Prior Year Findings: See Schedule of Findings and Questioned Costs for chart/table State Department: Health and Human Services State Bureau: Office for Family Independence Federal Agency: U.S. Department of Agriculture Assistance Listing Title: SNAP Cluster Assistance Listing Number: 10.551, 10.561 Federal Award Identification Number: See E-65 to E-66 Compliance Area: Allowable costs/cost principles Special tests and provisions Type of Finding: Material weakness Material noncompliance Questioned costs Known Questioned Costs: ALN 10.551 $7,658 Likely Questioned Costs: Undeterminable; incorrectly suspending Supplemental Nutrition Assistance Program (SNAP) benefits may result in overpayments and underpayments to households. Since there are known overpayments and underpayments in our sample, a projection of questioned costs cannot be reasonably estimated. Criteria: 2 CFR 200.303; 2 CFR 200.403; 7 CFR 272.10; 7 CFR 273.10 and .12 The Department must establish, document, and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. To be allowable under Federal awards, costs must be necessary and reasonable for the performance of the Federal award and be adequately documented. All State agencies must sufficiently automate their SNAP operations and computerize their systems for obtaining, maintaining, utilizing and transmitting information concerning SNAP, which includes automatic cutoff of participation for households which have not been recertified at the end of their certification period. SNAP households must be assigned eligibility certification periods of at least 6 months, unless the household is classified as exempt based on program regulations. The State agency must have at least 1 contact with each SNAP household every 12 months. Submission of periodic eligibility reports is required by non-exempt households. Non-exempt households that are certified for longer than 6 months must file a periodic report between 4 months and 6 months, as required by the State agency. In addition, the State agency must not require the submission of periodic reports by households certified for 12 months or less in which all adult members are elderly or have a disability and no earned income. Condition: SNAP is administered by the Office for Family Independence (OFI) and provides monthly benefits to eligible households to purchase nutritious foods. OFI is required by Federal program regulations to utilize an automated information system for SNAP. The information system must maintain all case file information necessary to properly process eligibility determinations and benefit computations. The Automated Client Eligibility System (ACES) is the information system used by OFI to automate SNAP operations. ACES relies on the maintenance of a complex framework of system rules to make eligibility determinations, including notification letters to clients when 6-month reports and 12-month redeterminations of eligibility are required. All SNAP households, except for elderly and disabled cases with no earned income, are required to submit 6-month reports. In addition, all SNAP households must undergo an annual redetermination of eligibility. Each household’s recertification requirements are indicated by date fields in the ACES case file. If a required report or redetermination is not completed by the date indicated in the applicable field, the case’s monthly SNAP benefit is automatically suspended by the system. The Office of the State Auditor (OSA) tested a sample of 40 cases automatically suspended for failure to complete a required review in fiscal year 2025 to verify the accuracy of automated SNAP operations utilizing ACES. In 11 of the 40 cases tested, OSA identified that ACES incorrectly suspended benefits, as follows: • 8 cases were overpaid SNAP benefits totaling $7,543 because benefit suspensions occurred 1 to 4 months after the 6-month reporting requirement. • 2 cases were underpaid SNAP benefits totaling $873 because benefit suspensions occurred 1 to 2 months prior to the annual redetermination requirement. • 1 case was overpaid SNAP benefits totaling $115 because benefit suspension occurred 5 months after the annual redetermination requirement. OSA selected a non-statistical random sample. Context: In fiscal year 2025, the State provided approximately 169,000 SNAP clients with $355.9 million in Federal benefits. 279 clients were automatically suspended by ACES during fiscal year 2025 due to recertification or redetermination requirements. Cause: • Lack of adequate policies and procedures • Lack of supervisory oversight • Automated SNAP eligibility system recertification and suspension criteria were not configured in accordance with Federal regulations. Effect: • Known questioned costs • Potential future questioned costs and disallowances • Noncompliance with Federal regulations • Benefits may be incorrectly suspended, resulting in households being underpaid or overpaid. Recommendation: We recommend that the Department enhance policies and procedures to ensure that automated SNAP eligibility certification periods and related ACES case file fields are properly configured to process benefits in accordance with Federal regulations. In addition, we recommend that the Department identify underpayments and/or overpayments resulting from recertification period errors and take action as warranted. Corrective Action Plan: See F-11 Management’s Response: The Department agrees with this finding. OFI has had a number of technological challenges with the automatic setting of renewal and six-month report dates related to the suspension of Medicaid renewals during the pandemic, the extension of certification periods during the unwinding period, and the application of the new passive Medicaid renewal technology. Contact: Michael E. Downs, Public Service Coordinator II – SNAP, OFI, DHHS, 207-592-4850 (State Number: 25-1108-02)

(2025-013) Title: Internal control over EBT card security needs improvement Prior Year Findings: See Schedule of Findings and Questioned Costs for chart/table State Department: Health and Human Services State Bureau: Office for Family Independence Federal Agency: U.S. Department of Agriculture U.S. Department of Health and Human Services Assistance Listing Title: SNAP Cluster Summer Electronic Benefits Transfer Program for Children Temporary Assistance for Needy Families (TANF) Assistance Listing Number: 10.551, 10.561; 10.646; 93.558 Federal Award Identification Number: See E-65 to E-66 Compliance Area: Allowable costs/cost principles Special tests and provisions Type of Finding: Material weakness Material noncompliance Questioned Costs: None Criteria: 2 CFR 200.303; 7 CFR 274.5; 7 CFR 292.16(h)(3); National Institute of Standards and Technology (NIST) Special Publication 800 Series The Department must establish, document, and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. The State is required to provide the following minimum security and control procedures for electronic benefits transfer (EBT) cards: secure storage; access limited to authorized personnel; inventory control records; and a periodic review and validation of inventory controls and records by parties not otherwise involved in maintaining control records. Issuance, inventory, reconciliation, and other accountability records must be maintained for a period of 3 years. NIST Special Publication 800 Series states that organizations: • consider the inherited risk from the use of common controls. If common controls are provided to organizations by external entities, arrangements must be made with the external/shared service providers to obtain information on the effectiveness of the deployed controls. • are responsible and accountable for information security risk incurred through the use of system services provided by external vendors. The responsibility for mitigating risks arising from the use of external information system services remains with authorizing officials. Condition: The Temporary Assistance for Needy Families (TANF) program provides cash assistance to families while they work towards becoming self-sufficient. The Supplemental Nutrition Assistance Program (SNAP) and Summer Electronic Benefits Transfer Program for Children (Summer EBT) provide benefits to eligible households to purchase nutritious foods. The programs distribute benefits through EBT cards utilizing the Electronic Payment Processing and Information Control (EPPIC) system. Review of vendor, subservice provider, and subcontractor controls The Office for Family Independence (OFI) contracts with a vendor that engages a subservice provider and a subcontractor to support EBT card services. The contract with the vendor requires annual System and Organization Controls (SOC) 1 type 2 and SOC 2 type 2 assurance testing and reporting of results of the vendor and its subservice providers. Also, since the vendor relies on a subcontractor for printing and distributing the EBT cards, OFI relies on SOC-type testing results of the subcontractor’s controls for assurance over the security of the EBT cards. The Department’s policy is to perform an annual review and document a plan to remediate deviations identified in these reports. SOC-type testing results can measure the degree to which the Department is able to rely on the suitability of the design and operating effectiveness of specific controls provided by the vendor, subservice provider, and subcontractor. OFI did not receive the required 2025 SOC 1 type 2 or SOC 2 type 2 reports from the vendor, subservice provider, or subcontractor, as follows: • Vendor – The Department did not receive SOC 1 type 2 or SOC 2 type 2 reports for the period of October 1, 2024, through June 30, 2025. • Subservice provider – The Department did not receive SOC 1 type 2 or SOC 2 type 2 reports for fiscal year 2025. • Subcontractor – The Department did not receive SOC 1 type 2 or SOC 2 type 2 reports for the period of October 1, 2024, through June 30, 2025. Additionally, documentation could not be provided to support that OFI followed up on the deviations identified in the 2024 SOC report. As a result, OFI did not have assurance over the suitability of the design and operating effectiveness over EBT card security controls with the vendor, subservice provider, or subcontractor. Department controls EBT cards are processed and distributed through the EPPIC system and then mailed to the client. EBT cards that are undeliverable are returned to the regional Department of Health and Human Services (DHHS) office, where they are then sent to the central DHHS office for processing. Upon receipt of a returned EBT card, OFI staff use the Automated Client Eligibility System (ACES) to verify a client’s personal information, determine what action to take based on case file information, and to document the action through electronic case notes. The Department has assigned responsibility for processing returned EBT cards to 3 employees. This process includes receipt of returned cards, maintenance of inventory control records including supporting documentation in ACES and EPPIC, and destruction or retransmission of the card. The Office of the State Auditor (OSA) identified that once delivered to the central office, the returned cards are placed in an open mailbox. While the mailbox is in a secure area of the facility, any employee working within this area has access to this mailbox. Furthermore, while the returned cards are being processed, they are placed in a locked closet that was previously used for storage. OSA identified that the personal identification number lock was never changed after the closet was repurposed for EBT returned card storage. Therefore, access to the returned card mailbox and storage area is not limited to the 3 employees assigned responsibility for processing returned EBT cards. In addition, the State is required to maintain accurate and complete inventory records for returned EBT cards. Returned cards must be destroyed or retransmitted, and OFI documents actions taken on tracking spreadsheets and in ACES and the EPPIC system. Quarterly, management monitors the inventory tracking spreadsheets by selecting a sample of returned EBT cards for review; however, this oversight procedure does not include a reconciliation between the number of cards returned and the number of cards entered on the tracking spreadsheets. To further evaluate this oversight procedure, OSA obtained documentation of the total number of EBT cards returned in June 2025 and compared it to the number of cards entered on the tracking spreadsheets and found that only 113 of the 1,184 returned cards had been entered on the tracking spreadsheets. OSA also identified instances where information recorded on the tracking spreadsheets was incorrect or incomplete, including invalid client identification numbers, client names that did not match the correct client identification numbers, and the name of the person who processed the returned card was not entered as required. A total of 2,383 returned SNAP and Summer EBT cards were recorded on the fiscal year 2025 inventory tracking spreadsheets. OSA tested a sample of 60 returned SNAP cards and 7 returned Summer EBT cards to verify the accuracy and completeness of the activity recorded, and identified: • 10 returned SNAP EBT cards and 1 returned Summer EBT card were recorded on the tracking spreadsheet as retransmitted to an updated address, but no documentation was maintained in ACES to support that a new address was obtained. o 1 of the 10 EBT cards returned had online purchase activity during the period that the card was in the mail, and there was no documentation in ACES to support that the Department investigated the purchase activity. • 3 returned SNAP EBT cards where processing activity was not documented in a case note. • 2 returned SNAP EBT cards were retransmitted to another DHHS office for pickup, but no documentation was maintained in ACES to support the reason. • 1 returned Summer EBT card was retransmitted to an out-of-state address, but no documentation was maintained in ACES to support that client contact was made, or that the case was referred to an eligibility specialist in accordance with DHHS’ returned mail procedures. OSA selected a non-statistical random sample. Context: In fiscal year 2025, the State provided approximately 169,000 SNAP clients and 100,000 Summer EBT clients with $355.9 million and $14.5 million in Federal benefits, respectively. According to the inventory tracking spreadsheets, the Department processed 2,383 returned SNAP and Summer EBT cards; 802 were recorded as retransmitted and 1,581 were recorded as destroyed. The total number of EBT cards returned in the mail is unknown. Cause: • The Department did not enforce contractual obligations with the vendor as they anticipate utilizing a new EBT card vendor in fiscal year 2026. • Lack of adequate policies and procedures • Lack of supervisory oversight Effect: • Noncompliance with Federal regulations • Potential unauthorized use of EBT cards, which may lead to unallowable costs • Potential breach of confidential or sensitive information • Potential corrupted, lost, or inaccurate information • Potential downtime and/or extended shutdowns Recommendation: We recommend that the Department enhance and subsequently monitor policies and procedures to: • ensure the contractually required SOC-type assurance testing and reported results is obtained and reviewed timely, and document and implement effective corrective action plans, if necessary. This will provide assurance that any deviations identified in the annual SOC reports are being tracked and remediated in a timely manner. • require adequate security and oversight of returned EBT cards, including maintenance of accurate and complete inventory control records and increased physical security controls. Corrective Action Plan: See F-12 Management’s Response: The Department agrees with this finding. There were separate processes mentioned in the finding. Therefore, there will be two separate Corrective Action Plans (CAP), which will be tracked independently. The first CAP is to correct deficiencies associated to SOC reporting. The second CAP is to strengthen our internal processes regarding returned EBT cards. Contact: Ian Yaffe, Director, Office for Family Independence, DHHS, 207-592-1481 (State Number: 25-1108-01)

(2025-014) Title: Internal control over EBT reconciliation needs improvement Prior Year Findings: None State Department: Health and Human Services State Bureau: Office for Family Independence Federal Agency: U.S. Department of Agriculture Assistance Listing Title: SNAP Cluster Assistance Listing Number: 10.551, 10.561 Federal Award Identification Number: See E-65 to E-66 Compliance Area: Special tests and provisions Type of Finding: Material weakness Material noncompliance Questioned Costs: None Criteria: 2 CFR 200.303; 7 CFR 274.4; National Institute of Standards and Technology (NIST) Special Publication 800 Series The Department must establish, document, and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. State agencies shall account for the full cycle of electronic benefit transfer (EBT) issuance through a reconciliation process. The EBT system shall provide reports and documentation pertaining to, but not limited to: • reconciliation of individual household account balances against account activities on a daily basis; • reconciliation of each individual retail store’s Supplemental Nutrition Assistance Program (SNAP) transactions per point of sale (POS) terminal and in total to deposits on a daily basis; • verification of retailer’s credits against deposit information entered into the automated clearinghouse (ACH) network; and • maintenance of audit trails that document the full cycle of issuance from benefit allotment posting to the State issuance authorization file through posting to POS transactions at retailers through settlement of retailer credits. NIST Special Publication 800 Series states that organizations: • consider the inherited risk from the use of common controls. If common controls are provided to organizations by external entities, arrangements must be made with the external/shared service providers to obtain information on the effectiveness of the deployed controls. • are responsible and accountable for information security risk incurred through the use of system services provided by external vendors. The responsibility for mitigating risks arising from the use of external information system services remains with authorizing officials. Condition: SNAP provides monthly benefits to eligible households to purchase nutritious foods by distributing benefits through EBT cards utilizing the Electronic Payment Processing and Information Control (EPPIC) system. The Department must account for all issuances through a reconciliation process. The Office for Family Independence (OFI) contracts with the EBT card vendor to perform the following: • Reconciliation of individual household account balances against account activities on a daily basis • Reconciliation of each individual retail store’s SNAP transactions per POS terminal and in total to deposits on a daily basis • Verification of retailer’s credits against deposit information entered into the ACH network • Maintenance of audit trails that document the full cycle of issuance from benefit allotment posting to the State issuance authorization file through posting to POS transactions at retailers through settlement of retailer credits EBT card vendor reconciliations and maintenance of audit trails are reviewed by OFI through annual System and Organization Controls (SOC)-type assurance testing and reporting of results. However, the Office of the State Auditor identified a material weakness/material noncompliance as issued in finding 2025-013 for OFI’s lack of receipt and review of the required SOC 2 type 2 report from the vendor for the period of October 1, 2024, through June 30, 2025. OFI did not perform alternative procedures to ensure these reconciliations were performed by the vendor. As a result, OFI did not have assurance over the suitability of the design and operating effectiveness over EBT reconciliation controls with the vendor for the last nine months of fiscal year 2025. Context: In fiscal year 2025, the State provided approximately 169,000 SNAP clients with $355.9 million in Federal benefits. Cause: • Lack of adequate policies and procedures • Lack of supervisory oversight • The Department did not enforce contractual obligations with the vendor as they anticipate utilizing a new EBT card vendor in fiscal year 2026. Effect: • Noncompliance with Federal regulations • Potential inaccurate reconciliations performed by the EBT card vendor Recommendation: We recommend that the Department enhance and subsequently monitor policies and procedures to ensure adequate oversight of vendor-provided EBT reconciliations. Corrective Action Plan: See F-12 Management’s Response: The Department agrees with this finding. The Office for Family Independence has developed and will implement a corrective action plan to address the issue identified. Contact: Ian Yaffe, Director, OFI, DHHS, 207-592-1481 (State Number: 25-1108-07)

(2025-015) Title: Internal control over SNAP deceased client cases needs improvement Prior Year Findings: See Schedule of Findings and Questioned Costs for chart/table State Department: Health and Human Services State Bureau: Office for Family Independence Federal Agency: U.S. Department of Agriculture Assistance Listing Title: SNAP Cluster Assistance Listing Number: 10.551, 10.561 Federal Award Identification Number: See E-65 to E-66 Compliance Area: Allowable costs/cost principles Eligibility Type of Finding: Significant deficiency Questioned Costs: None Criteria: 2 CFR 200.303; 2 CFR 200.403; 7 CFR 272.8 and .14 The Department must establish, document, and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. To be allowable under Federal awards, costs must be necessary and reasonable for the performance of the Federal award and be adequately documented. State agency action on information items about recipient households shall include review of information and comparison of it to case record information. State agencies must initiate and pursue actions on recipient households within 45 days of the receipt of the information items. States shall establish a system to verify and ensure that benefits are not issued to individuals who are deceased. Condition: The Office for Family Independence (OFI) manages the Automated Client Eligibility System (ACES) used to determine eligibility for Federal assistance programs, including the Supplemental Nutrition Assistance Program (SNAP). Information maintained in ACES is relied upon by OFI for determining monthly SNAP benefits issued to client Electronic Benefit Transaction (EBT) cards. OFI relies on numerous data sources for identifying and providing client date of death (DOD) information for input into ACES, including monthly data exchanges with the Maine Center for Disease Control & Prevention’s (MeCDC) Vital Records, which includes Social Security Administration data. Federal program regulations require OFI to act on client cases within 45 days of receipt of DOD information. This includes review and comparison of DOD information to ACES case file information, and suspension of program participation and related benefits as warranted. OFI policies for SNAP require deactivation of the client’s EBT card as well as expungement of authorized benefits from the EBT card. If activity occurs on the client’s EBT card subsequent to the DOD, the case must be reported as potential fraud and referred for investigation. The Office of the State Auditor (OSA) obtained DOD information from MeCDC Vital Records and compared it to clients who received SNAP benefits during fiscal year 2025. OSA identified 29 cases where SNAP benefits were issued more than 75 days following the client’s DOD; this benchmark was applied to denote the 45-day Federal program regulation related to monthly receipt of DOD information. OSA tested all 29 cases and identified the following: • Single-member household clients should not have EBT card purchase activity after DOD; however, 7 single-member household clients had $4,335 in total EBT card purchase activity after DOD that occurred in fiscal year 2025: o 6 clients were identified as potential fraud in the ACES case file between 3 and 6 months after the DOD information was received by MeCDC Vital Records. o 1 client’s DOD was not properly recorded in ACES until 11 months after the DOD information was received by MeCDC Vital Records. OFI recorded an incorrect DOD in ACES and did not identify EBT purchase activity after the DOD as potential fraud until OSA notified OFI. • 1 client’s DOD was not recorded in ACES until the client’s family informed OFI of the client’s death 268 days after the DOD information was received by MeCDC Vital Records. As a result, SNAP benefits were calculated based on incorrect income and household composition information, resulting in an overpayment of $2,359. • 14 single-member household clients had benefits loaded to their cards more than 75 days after DOD information was received by MeCDC Vital Records. Of those 14 clients: o 11 clients’ cases remained open 77 to 305 days after DOD information was received by MeCDC Vital Records, resulting in 2 to 11 months of unauthorized SNAP benefit issuances. Of these 11 clients, 5 clients’ benefits were not expunged upon receipt of DOD information as required by OFI policies; benefits remained open and available for spending up to 274 days after the last issuance when they were expunged by the system-automated process based on inactivity. o 2 clients were not identified as deceased by OFI until OSA notified OFI. As of June 30, 2025, MeCDC Vital Records received DOD information 644 days and 587 days prior, respectively; benefits were expunged by the system-automated process based on inactivity after 274 days. o 1 client was not identified as deceased by OFI until July 2025. As of June 30, 2025, DOD information was on file for 196 days. Context: In fiscal year 2025, the State provided approximately 169,000 SNAP clients with $355.9 million in Federal benefits. Of the 169,000 SNAP clients, 1,970 had a DOD in fiscal year 2025. Cause: • Monthly data exchanges with MeCDC Vital Records did not alert OFI of DOD information in 27 of the 29 cases tested. • Lack of adequate policies and procedures • Lack of supervisory oversight Effect: • Benefits issued to deceased clients may result in unauthorized EBT card purchase activity. • Potential future questioned costs and disallowances • Noncompliance with Federal regulations Recommendation: We recommend that the Department enhance policies and procedures to ensure that DOD information is received, reviewed, and updated in ACES on a more frequent basis to prevent unauthorized SNAP benefit issuances and EBT card purchase activity. In addition, we recommend that the Department review all client cases noted in the Condition of this finding to ensure that: • ACES case file DOD information is accurate, including verifying that all DOD information is received timely from MeCDC Vital Records; • SNAP benefits are expunged and EBT cards are deactivated in accordance with existing policies; • cases are identified as potential fraud and referred for investigation as warranted; and • unallowable costs are identified and reported to Federal oversight agencies and required recoupment activities are pursued. Corrective Action Plan: See F-12 Management’s Response: The Department agrees with this finding. The data matching failed because there were inconsistencies in the data between the two systems, specifically in the spelling of names. The Department acted timely on all deaths that were reported correctly. Contact: Michael E. Downs, Public Service Coordinator II – SNAP, DHHS, 207-592-4850 (State Number: 25-1108-03)

(2025-016) Title: Internal control over SNAP procurement needs improvement Prior Year Findings: None State Department: Administrative and Financial Services Health and Human Services State Bureau: Office of State Procurement Services Division of Contract Management Office for Family Independence Federal Agency: U.S. Department of Agriculture Assistance Listing Title: SNAP Cluster Assistance Listing Number: 10.551, 10.561 Federal Award Identification Number: See E-65 to E-66 Compliance Area: Procurement and suspension and debarment Type of Finding: Significant deficiency Questioned Costs: None Criteria: 2 CFR 200.303; 2 CFR 200.317; 7 CFR 277.14; 5 MRSA 1825-B and D; Office of State Procurement Services (OSPS) policies The Department must establish, document, and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. The Department must follow the same policies and procedures it uses for procurements with non-Federal funds. 7 CFR 277.14 requires the Department to submit proposed contracts and related procurement documents to the U.S. Department of Agriculture’s Food and Nutrition Service (FNS) for preaward review and approval when the procurement is expected to exceed $10,000 and is to be awarded without competition, or only one bid or offer is received in response to solicitation. Awards shall be made to the best-value bidder, taking into consideration the best interest of the State. The requirement to competitively bid a contract may be waived if specific criteria is met, including the item or service can only be procured from one source or it is an emergency procurement. Each bid, with the name of the bidder, must be entered on record. Each record, with the successful bid indicated, must be open to public inspection after the letting of the contract. The Department must justify the selection of vendor, either through competitive or noncompetitive process, and provide a detailed explanation of cost, demonstrating how the best value for the State is ensured. The Chief Procurement Officer shall make the public aware of contracts and grants for which bids are being requested and communicate the procedure used in reviewing bids. Contracts must be submitted to OSPS at least 14 days prior to the contract start date. Condition: The Supplemental Nutrition Assistance Program (SNAP) provides monthly benefits to eligible households to purchase nutritious foods, along with funds for administration, nutrition education, and obesity prevention. SNAP is administered by the Office for Family Independence (OFI). OSPS is the central oversight agency for all State procurement. The Department of Health and Human Services (DHHS) Division of Contract Management (DCM) oversees the solicitation and contract implementation for all DHHS procurement. DCM coordinates with DHHS program personnel to evaluate and select vendors and subrecipients, determine contract terms, and provide required documentation to OSPS. OSPS is responsible for reviewing and approving Procurement Justification Forms (PJF) submitted by DCM on behalf of program personnel prior to the award of contracts. The PJF represents program personnel’s assertion that the selected procurement method is appropriate under applicable State and Federal requirements, and that required evaluation procedures have been performed. OSA tested 2 noncompetitive contracts that accounted for approximately $4.4 million of the $5.8 million in SNAP procurement-related transactions in fiscal year 2025 and found: • OFI could not provide documentation that FNS approved applicable procurement documents prior to contract award as required by 7 CFR 277.14. • PJFs were reviewed for reasonableness by DCM and OSPS, but DHHS could not provide documentation to support the assertions made by OFI were accurate. • For 1 contract, DCM provided the PJF to OSPS for their review and OSPS approved the PJF after the contract had commenced, 42 days and 66 days, respectively, after the contract start date. OSA selected a non-statistical random sample. Context: In fiscal year 2025, the Department expended $5.8 million in procurement-related transactions from SNAP administration funds of $19.5 million. Cause: • Lack of adequate policies and procedures • Lack of supervisory oversight Effect: • Potential questioned costs and future disallowances • Noncompliance with Federal and State procurement requirements could result in the need to void a contract or exposure to legal proceedings. Recommendation: We recommend that OSPS: • increase agency awareness of the procedures related to the timing of procurement contract documentation being submitted to OSPS for review prior to the contract start date; and • finalize and implement an updated procurement policy and procedure manual that identifies the parties responsible for key aspects of the procurement process. We also recommend that DCM and OFI develop policies and procedures and increase oversight to ensure all procurement transactions comply with Federal and State requirements, including: • Federal pre-procurement approvals are obtained before contracts are awarded, if required; • DCM obtaining and reviewing documentation to support the assertions made by OFI for accuracy and reasonableness; and • ensuring PJFs are completed, reviewed, and submitted to OSPS prior to the contract start date. Corrective Action Plan: See F-13 Management’s Response: DAFS Response: The Department agrees with this finding. OSPS does not authorize, encourage, or approve agencies allowing vendors to perform work at risk. However, OSPS also does not delay review and approval solely due to contract start-date issues, as doing so would increase the State’s risk exposure, potentially disrupt federally required programs, and hinder agencies’ compliance with federal period-of-performance requirements. To address these concerns, OSPS will formalize and issue policy guidance that clearly defines agency and OSPS roles and responsibilities in the contracting process. This guidance will expand the agency-focused section to emphasize timely submission and processing, along with the risks and implications associated with contracting delays. In advance of fiscal year-end, OSPS will issue a separate policy document and companion guidance as a spotlight topic in the monthly newsletter and posted to the intranet for agency reference. DAFS Contact: David Morris, Acting Chief Procurement Officer, OSPS, 207-624-7335 DHHS Response: The Department partially agrees with this finding. There is not a requirement to provide documentation that the Department personnel’s assertions are accurate regarding Department personnel’s review of PJFs. The Department agrees that it can improve the timing of procurement documents in relation to the start dates of the contracts. Extenuating circumstances exist periodically that prevent the timeliness of these documents. In some cases, there are delays in the grant approval at the Federal level. Delays in Legislative approval of budgets can also lead to procurement documentation delays. DHHS Contact: Jim Lopatosky, Director, Division of Contract Management, DHHS, 207-287-5075 Auditor’s Concluding Remarks: 2 CFR 200.303 requires the Department to establish, document, and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. Absent adequate documentation to support the veracity of the assertions made on the PJF by program personnel, the best value for the State cannot be ensured. The finding remains as stated. (State Number: 25-1108-06)

(2025-017) Title: Internal control over SNAP subrecipient monitoring procedures needs improvement Prior Year Findings: None State Department: Health and Human Services State Bureau: Office for Family Independence Federal Agency: U.S. Department of Agriculture Assistance Listing Title: SNAP Cluster Assistance Listing Number: 10.551, 10.561 Federal Award Identification Number: See E-65 to E-66 Compliance Area: Subrecipient monitoring Type of Finding: Significant deficiency Questioned Costs: None Criteria: 2 CFR 200.303; 2 CFR 200.332 The Department must establish, document, and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. The Department must: • ensure that every subaward is clearly identified to the subrecipient as a subaward and includes specific information. • evaluate each subrecipient’s risk of noncompliance with Federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate subrecipient monitoring procedures. Condition: The Supplemental Nutrition Assistance Program (SNAP) is administered by the Office for Family Independence (OFI). In addition to providing monthly benefits to eligible households to purchase nutritious foods, SNAP has administrative funding that may be used to educate the public on nutrition and to assist SNAP clients in gaining the skills, training, and work experience needed to build a career and achieve long-term stability. The Office of the State Auditor (OSA) tested all 7 contracts with 4 SNAP subrecipients for compliance with: • award identification requirements, and found: o 6 contracts did not include Federal award identification numbers; and o 1 contract did not include the Assistance Listing title and number. • subrecipient risk evaluation procedures. OFI provided evidence to support that subrecipient monitoring procedures were performed; however, documentation that risk evaluation procedures performed corresponded to the appropriate level of monitoring activities could not be provided. Context: In fiscal year 2025, OFI provided $5.1 million from a total of $19.7 million in SNAP administrative funds to SNAP subrecipients. Cause: • Lack of adequate policies and procedures • Lack of supervisory oversight Effect: • Noncompliance with Federal regulations • Subrecipients that are deemed higher risk may not be monitored on a more frequent basis. Conversely, subrecipients that are deemed lower risk may not be monitored on a less frequent basis, which would free resources and time to dedicate towards other higher risk subrecipients. Recommendation: We recommend that the Department implement policies and procedures to: • ensure that all required information is included in contracts and contract amendments. This will ensure compliance with Federal requirements. • require evaluation of each subrecipient’s risk of noncompliance specifically for the purpose of determining the appropriate subrecipient monitoring to be performed. This will ensure subrecipients are monitored appropriately based on risk designation. Corrective Action Plan: See F-13 Management’s Response: The Department partially agrees with the finding. We acknowledge six of the contracts did not include the Federal award identification number, and that one contract did not include the assistance listing title and number. The Department disagrees that we do not have adequate subrecipient risk evaluation procedures. The Department evaluates risk on its subrecipients for the purposes of determining the appropriate subrecipient monitoring in multiple ways. The first assessment of risk is when a subaward is competitively bid. The second assessment of risk is built into the Maine Uniform Accounting and Auditing Practices for Community Agencies (MAAP) in which higher risk subrecipients undergo a higher level of testing by Independent Public Accountants. Finally, the Social Service Unit of the Division of Audit performs a risk assessment and tests transactions for those subrecipients that have been determined to be higher risk. Contact: Patricia Dushuttle, Special Projects Manager- SNAP, DHHS, 207-215-0995 Auditor’s Concluding Remarks: 2 CFR 200.332(b) states that the Department must evaluate each subrecipient’s risk of noncompliance with Federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate subrecipient monitoring. The Department has indicated in Management’s Response that the criteria set forth in 2 CFR 200.332(b) have been met; however, the following rebuttals illustrate that the Department is not in compliance with Federal requirements: • The Department identifies the first assessment of risk: when a subaward is competitively bid. o While OSA acknowledges this does occur, 6 of the 7 subawards tested were not competitively bid. o The level of subrecipient monitoring that the Department performs is based on the services provided, not on specific subrecipients, as required. • The Department identifies the second assessment of risk: built into MAAP in which higher risk subrecipients undergo a higher level of testing by independent public accountants. o A subrecipient deemed higher risk as the result of a risk evaluation in accordance with 2 CFR 200.332 may not be deemed higher risk in accordance with MAAP standards. • The Department identifies the third assessment of risk: the Social Service Unit of the Division of Audit (DOA) performs a risk assessment and tests transactions for those subrecipients that have been determined to be higher risk. o The Department did not provide documentation to demonstrate that subrecipient monitoring procedures are performed by program personnel as a result of a risk evaluation conducted by DOA. The Department’s existing policies and procedures do not require nor provide support for the evaluation of each subrecipient’s risk of noncompliance specifically for the purpose of determining the appropriate subrecipient monitoring to be performed. The finding remains as stated. (State Number: 25-1108-04)

(2025-018) Title: Internal control over CNC eligibility needs improvement Prior Year Findings: See Schedule of findings and Questioned Costs for chart/table State Department: Education State Bureau: Child Nutrition Services Federal Agency: U.S. Department of Agriculture Assistance Listing Title: Child Nutrition Cluster Assistance Listing Number: 10.553, 10.555, 10.556, 10.559, 10.582 Federal Award Identification Number: See E-65 to E-66 Compliance Area: Allowable costs/cost principles Eligibility Type of Finding: Material weakness Material noncompliance Questioned costs Known Questioned Costs: ALN 10.555 $73,683 ALN 10.559 $226,773 Likely Questioned Costs: Undeterminable; erroneous eligibility determinations do not always result in overpayments of Federal program funds; therefore, an error rate cannot be applied to the population and a projection of questioned costs cannot be reasonably estimated. Criteria: 2 CFR 200.303; 7 CFR 210.7 and .9; 7 CFR 225.6, .14, and .16; 7 CFR 245.12 The Department must establish, document, and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. 7 CFR 210 outlines the application requirements for participation in the National School Lunch Program (NSLP) and specifies that applications shall provide the State agency with sufficient information to determine eligibility. 7 CFR 225 requirements for the Summer Food Service Program (SFSP) include: • the type of information that must be required in sponsor applications for participation; • sites that serve an area in which poor economic conditions exist or are approved for reimbursement only for free meals served to enrolled children who meet the program’s income standards; • the proposed site is not or will not be served in whole or in part by another site; • State agency requirements related to the approval of applications and determinations of eligibility; • the process and requirements for claims for reimbursement (CFRs); and • performance standards for financial viability, administrative capability, and program accountability. 7 CFR 245 describes the action taken by State agencies related to the eligibility determination of individuals and special eligibility determinations of schools including Provision II and Community Eligible Provision schools. These regulations outline how the School Food Authority (SFA) and State agency should collect and report eligibility information in the schools, and how that information should be used in establishing rates and percentages in CFRs. Condition: The Child Nutrition Cluster (CNC) includes the School Breakfast Program, NSLP, Special Milk Program for Children, SFSP, and the Fresh Fruit and Vegetable Program. The objectives of the programs are to provide nutritious meals to eligible children in schools and summer food programs; to foster healthy eating habits by providing fresh fruits and vegetables to children attending elementary schools; and to encourage the consumption of nutritious agriculture commodities. The Department of Education (DOE) is responsible for the administration of CNC programs for the State. DOE provides benefits to each SFA or sponsor on a reimbursement basis. SFAs and sponsors must submit electronic applications for participation in CNC programs and DOE is required to review every application and site information sheet to ensure that only eligible SFAs or sponsors participate in the programs. The Office of the State Auditor (OSA) tested 47 SFA and sponsor applications and found instances that did not align with program regulations, as follows: • 9 applications were approved with sites that did not meet the eligibility criteria, as follows: o 5 sponsors with sites classified as camps and also designated as open sites. This allowed the camp to use area eligibility determination, rather than individual child eligibility as required for camps, resulting in questioned costs totaling $180,788. o 1 sponsor of a camp used projected enrollment numbers on their application and did not provide the actual number of eligible children for each session at the site prior to submitting claims, resulting in questioned costs totaling $26,381. o 1 sponsor was erroneously approved as a non-congregate site without required supporting documentation. In addition, incorrect census data was used to demonstrate eligibility, resulting in questioned costs totaling $73,683. o 1 sponsor site was erroneously classified as a school; however, supporting documentation within the application indicated that the correct site classification was a non-residential day camp. o 1 sponsor without a designated site classification used special eligibility certification rather than area eligibility determination; OSA determined that the site was eligible based on other information in the application. • 1 application’s financial viability calculation did not meet program requirements, as reported expenses exceeded reported revenue and budget revisions were not made prior to approval of the program by DOE, resulting in questioned costs totaling $1,350. • 1 application was missing a required policy statement, resulting in questioned costs totaling $18,254. OSA selected a non-statistical random sample. Context: In fiscal year 2025, CNC program expenditures totaled $71.3 million, including $58.5 million for NLSP and $2.8 million for SFSP in SFA and sponsor reimbursements. Cause: • Lack of adequate policies and procedures • Lack of supervisory oversight Effect: • CNC program participation by ineligible SFAs or sponsors • Known questioned costs • Potential future questioned costs and disallowances • Noncompliance with Federal regulations Recommendation: We recommend that the Department enhance policies and procedures and increase oversight to ensure that: • all required documentation for applications is complete and in compliance with program requirements prior to participation in CNC programs; • eligibility determinations and resulting site classifications are properly supported; and • appropriate eligibility information is collected and reviewed prior to SFA and sponsor claim payments. Corrective Action Plan: See F-14 Management’s Response: The Department partially agrees with this finding. The exceptions referenced in this finding are from the program FY23 audit. All identified exceptions have been addressed in the 2025 program year and the upcoming 2026 program year. The SUN Meals (SFSP) application packet is updated continually to reflect evolving federal program requirements. In recent years, significant federal changes have required substantial updates to application processes, data collection, and training for program operators. Requests for system updates are submitted to the Child Nutrition software developer to ensure continued alignment with federal guidelines. Child Nutrition with the supporting documents provided by the Northeast Regional Office of the USDA, disagrees with the exception addressing the “camp” definition in this finding. The application review process is administered by 1.5 FTE State Agency staff, who review over 1,000 documents within a 6–8 week timeframe, while also providing training and technical assistance to sponsors. Despite these constraints and ongoing federal program changes, staff manage the application process with only limited and isolated incidents. Contact: Jane McLucas, Director of Child Nutrition, DOE, 207-624-6880 Auditor’s Concluding Remarks: Management’s Response stating “the exceptions referenced in this finding are from the program FY23 audit” is incorrect. All exceptions identified relate to SFA and sponsor applications active during fiscal year 2025. OSA is not defining site classification nor taking exception to DOE’s “camp” definition. The exceptions identified are approved camp site sponsors that do not conform to the required eligibility criteria for camps. The exceptions noted were not limited or isolated, as 11 out of 47 SFA and sponsor applications tested did not align with Federal program requirements for eligibility. This results in an error rate of 23.4 percent. The finding remains as stated. (State Number: 25-1203-01)

(2025-019) Title: Internal control over CNC claim reimbursements needs improvement Prior Year Findings: See Schedule of Findings and Questioned Costs for chart/table State Department: Education State Bureau: Child Nutrition Services Federal Agency: U.S. Department of Agriculture Assistance Listing Title: Child Nutrition Cluster Assistance Listing Number: 10.553, 10.555, 10.556, 10.559, 10.582 Federal Award Identification Number: See E-65 to E-66 Compliance Area: Allowable costs/cost principles Reporting Type of Finding: Material weakness Material noncompliance Questioned costs Known Questioned Costs: ALN 10.559 $61,336 ALN 10.582 $12,215 Likely Questioned Costs: Undeterminable; due to the variety of exceptions in the test population, an error rate cannot be applied to the population, and a projection of questioned costs cannot be reasonably estimated. Criteria: 2 CFR 200.303; 2 CFR 200.403; 7 CFR 210.7 and .8; 7 CFR 225.6, .9, and .16; Richard B. Russell National School Lunch Act (NSLA), Section 19 The Department must establish, document, and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. To be allowable under Federal awards, costs must be necessary and reasonable for the performance of the Federal award and be adequately documented. 7 CFR 210.7 and .8 for the National School Lunch Program (NSLP) require: • claims for reimbursement (CFRs) to be based on lunch counts taken daily at the point of service, which correctly identify the number of free, reduced price, and paid lunches served to eligible children. • the Department to compare, on a monthly basis, the number of free and reduced price lunches claimed to the number of children approved for free and reduced price lunches enrolled in the School Food Authority (SFA) for the month of October and multiply that number by the days of operation and the attendance factor employed by the SFA. At its discretion, the Department may conduct this comparison against data which reflects the number of children approved for free and reduced price lunches for a more current month(s). 7 CFR 225 for the Summer Food Service Program (SFSP) requires: • information that must be on a site information sheet provided by the sponsor for approval by the Department prior to participation in SFSP, including estimated meal counts, types of meals, meal service times, and procedures to ensure duplicate meals are not distributed at non-congregate sites. In order to approve a site, the area where the site proposes to serve is not or will not be served in whole or in part by another site. • payments to a sponsor must equal the amount derived by multiplying the number of eligible meals, by type, actually served under the sponsor’s program to eligible children by the current applicable reimbursement rate for each meal type. Sponsors must be eligible to receive additional reimbursement for each meal served to participating children at rural or self-preparation sites. Section 19 of the Richard B. Russell NSLA states that the per-pupil grant provided to a school under the Fresh Fruit and Vegetable Program (FFVP) shall be not less than $50, nor more than $75. Condition: The Child Nutrition Cluster (CNC) includes the School Breakfast Program, NSLP, Special Milk Program for Children, SFSP, and FFVP. The objectives of the programs are to provide nutritious meals to eligible children in schools and summer food programs; to foster healthy eating habits by providing fresh fruits and vegetables to children attending elementary schools; and to encourage the consumption of nutritious agriculture commodities. The Department of Education (DOE) is responsible for the administration of CNC programs for the State. DOE provides benefits to each SFA or sponsor on a reimbursement basis. SFAs and sponsors must submit CFRs based on actual meals served for the month utilizing the Child Nutrition Program (CNPWeb) system. Claims pass through a system of edit checks built into the CNPWeb system, are automatically approved after those edit checks, and are processed based on rates programmed in the system. DOE does not verify the allowability or accuracy of monthly CFRs prior to payment, and edit checks built into the CNPWeb system are not routinely monitored. There are no monthly procedures in place that operate as controls over the allowability of claims. As a result, DOE has no assurance that SFA and sponsor monthly claim submissions are accurate or complete, or that the resulting CFR is allowable prior to payment. For SFSP, DOE requires applications from sponsors that include individual site sheets. The information on the sheet must include the estimated number of meals, types of meals to be served, and meal service times. Non-congregate sites must provide enough detail to ensure the area where the site proposes to serve meets certain criteria, including verification that the site is rural; is not or will not be served in whole or in part by another site; serves an area in which poor economic conditions exist or is approved for reimbursement only for free meals served to enrolled children who meet income standards; and has procedures to ensure that duplicate meals are not served to any child. Residential and non-residential camps must include in their site sheets the number of children enrolled in each session who meet income standards prior to filing the camp’s CFR for each session. The Office of the State Auditor (OSA) tested 44 SFSP CFRs and found: • 4 residential or non-residential camp CFRs that did not include the number of children enrolled in each session who met income standards prior to filing their CFR, resulting in questioned costs totaling $31,647. Additionally, of these 4 CFRs: o 2 were missing non-congregate site plan attestations; and o 1 did not include a site classification type on its site sheet, which determines the appropriate reimbursement rate. • 1 CFR to a non-congregate site that did not have documented procedures to prevent duplicate meal service on the site sheet and had census data contained within the non-congregate plan that did not match U.S. Census Bureau data, resulting in questioned costs totaling $29,689. OSA selected a non-statistical random sample. Furthermore, for each month of operation, DOE must report the number of meals served by meal type and sponsor type to the United States Department of Agriculture’s Food Nutrition Services (FNS) on the FNS-418 report. DOE does not have assurance that the CNPWeb system’s default classification of urban sites as self-prep when the field is left blank results in accurate FNS-418 reporting. DOE initiated a request to the CNPWeb system vendor to correct this system error in April 2025; however, the issue persisted for the entirety of fiscal year 2025. For FFVP, allocations made by DOE must result in a per-pupil grant not less than $50 nor more than $75 to participating SFAs and sponsors. OSA tested 18 SFAs and sponsors that participated in FFVP in fiscal year 2025 and found that 11 SFAs and sponsors had per-pupil allocations that were not between $50 and $75 per pupil, ranging from $15 per pupil to $104 per pupil. The allocation of funds over $75 per pupil resulted in questioned costs of $12,215. OSA selected a non-statistical random sample. Context: In fiscal year 2025, DOE processed SFA and sponsor CFRs totaling: • $58.5 million under NSLP; • $2.8 million under SFSP; and • $2.7 million under FFVP. Cause: • Lack of adequate policies and procedures • Lack of supervisory oversight Effect: • Noncompliance with Federal regulations • Known questioned costs • Potential future questioned costs and disallowances • Potential incorrect rates of reimbursement paid to SFAs and sponsors • Inaccurate FNS-418 reports submitted to FNS Recommendation: We recommend that the Department enhance policies and procedures and increase oversight to: • review CFRs on a monthly basis to provide assurance that SFA and sponsor payments are accurate and complete; • ensure all required information is included in SFA and sponsor applications and CFR submissions prior to payment, including site classification types and non-congregate plan information on site information sheets; and • ensure FFVP per pupil allocation amounts comply with Federal regulations. Corrective Action Plan: See F-14 Management’s Response: The Department agrees with this finding. The exceptions referenced in this finding are from the program FY23 audit. All identified exceptions have been addressed in the 2025 program year and the upcoming 2026 program year with the strengthening of program software and provided training to the program sponsors. During program years 2020–2023, the Summer Food Service Program (SFSP) operated under emergency authorities in response to COVID-19, during which the USDA implemented numerous program flexibilities and temporarily waived certain regulatory requirements. In subsequent years, many of these flexibilities continued but were reintroduced with additional regulatory requirements, expanded data collection, and ongoing updates to program guidance. As a result, program regulations and administrative requirements have evolved rapidly, with federal guidance frequently being released throughout the program year. The Child Nutrition team has worked to remain current with these evolving requirements and implement updates as changes occur. In some instances, updated regulations or federal guidance are issued after the program year has begun, which can result in necessary system changes or corrections to the Child Nutrition software system being implemented after the operating period has already started. At the request of School Administrative Units, Child Nutrition re-allocated funds for the FFVP from schools with unexpended balances, to schools requesting additional funds. A procedure has been implemented for SFY 2026 to ensure school allocations remain within the $50-75/student allocation range. Contact: Jane McLucas, Director of Child Nutrition, DOE, 207-624-6880 Auditor’s Concluding Remarks: Management’s Response stating “the exceptions referenced in this finding are from the program FY23 audit” is incorrect. All exceptions identified relate to payments made to SFAs and sponsors and Federal reporting submissions during fiscal year 2025. The finding remains as stated. (State Number: 25-1203-02)

(2025-020) Title: Internal control over CNC subrecipient monitoring procedures needs improvement Prior Year Findings: See Schedule of Findings and Questioned Costs for chart/table State Department: Education State Bureau: Child Nutrition Services Federal Agency: U.S. Department of Agriculture Assistance Listing Title: Child Nutrition Cluster Assistance Listing Number: 10.553, 10.555, 10.556, 10.559, 10.582 Federal Award Identification Number: See E-65 to E-66 Compliance Area: Subrecipient monitoring Type of Finding: Material weakness Material noncompliance Questioned Costs: None Criteria: 2 CFR 200.303; 2 CFR 200.332; 7 CFR 210.18; 7 CFR 225.7; U.S. Department of Agriculture Policy Memo SP 46-2015 The Department must establish, document, and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. The Department must monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward, and that subaward performance goals are achieved. The Department must conduct administrative reviews of School Food Authorities (SFAs) participating in the National School Lunch Program (NSLP) and the School Breakfast Program (SBP). These procedures must also be followed, as applicable, to conduct administrative reviews of the Special Milk Program (SMP) and the Fresh Fruit and Vegetable Program (FFVP). Documented corrective action is required for any degree of violation of general or critical areas identified in an administrative review. Corrective action may be provided at the time of the review; however, it must be postmarked or submitted electronically to the State agency no later than 30 days from the deadline for completion of each required corrective action. The State agency must maintain any documented corrective action on file for review by the Food and Nutrition Service (FNS). The Department must withhold all program payments to an SFA if: • documented corrective action for critical area violations is not provided with deadlines specified; or • corrective action for critical area violations was not completed. FNS may suspend or withhold program payments, in whole or in part, to those states failing to withhold payments in accordance with regulations and may withhold administrative funds. The Department must review sponsors to ensure compliance with Summer Food Service Program (SFSP) regulations. The Department is required to conduct a review of base year certification and benefit issuance documentation for any SFA requesting approval to participate in NSLP or SBP using U.S. Department of Agriculture (USDA) Special Provision 2, which is a provision established to reduce application burdens and simplify claim procedures. The review must occur at some point during the base year. If errors are identified as a result of the review, the Department must adjust all of the SFA’s closed claims that occurred in the current school year. Condition: The Child Nutrition Cluster (CNC) includes the NSLP, SBP, SMP, SFSP, and FFVP. The objectives of the programs are to provide nutritious meals to eligible children in schools and summer food programs; to foster healthy eating habits by providing fresh fruits and vegetables to children attending elementary schools; and to encourage the consumption of nutritious agriculture commodities. The Department of Education (DOE) is responsible for the administration of CNC programs for the State. DOE partners with local SFAs and sponsors to provide benefits to school-aged children. DOE has assigned subrecipient monitoring responsibilities, which include administrative reviews and other reviews as needed, to the Child Nutrition Services (CNS) division. Administrative reviews of all SFAs and sponsors are required at least once every 5 years; however, regulations also specify that high-risk SFAs and sponsors must receive targeted follow-up within 2 years. CNS utilizes a spreadsheet to track and facilitate the reviews, and a USDA questionnaire and information within the Child Nutrition Program (CNPWeb) system to document the completion of the review and related corrective action. CNS does not have a mechanism to centrally track the high-risk SFAs and sponsors to ensure follow-up occurs. CNS is required to retain documentation to support all elements of the administrative reviews and to demonstrate SFA and sponsor compliance with the program, even if corrective action occurs onsite during the review. The Office of the State Auditor (OSA) tested 16 administrative reviews completed by CNS and found: • Performance Standard 1 findings, deemed critical findings by USDA, were identified in 1 NSLP review, but required follow up fiscal action was not properly tracked. • Performance Standard 2 findings, also deemed critical by USDA, were identified in 3 reviews, but follow up corrective actions were not properly tracked, received, and/or approved. In addition, corrective action was not provided within 30 days for 2 of the 3 reviews. • corrective action for 3 reviews required fiscal action; 2 reviews indicated a reduction of a future claim would be processed, and 1 review indicated a check for repayment to the State would be received. Documentation in the CNPWeb system: o was not available to support that 2 required fiscal actions were taken, and o conflicted with the tracking spreadsheet for 1 fiscal action. • corrective action responses were missing for 4 reviews, 1 of which was marked as approved by CNS. • corrective action responses submitted by 2 SFAs were missing CNS approval information, but the reviews were marked as closed. • corrective action responses submitted by 3 SFAs were missing SFA contact information and submission dates. • the date for required corrective action to be provided was omitted for 4 reviews. • corrective action for 1 review was received late. • USDA questionnaire sections related to SFSP procurement were erroneously excluded for 4 reviews. • USDA questionnaires were not fully completed for 2 reviews. • the review tracking spreadsheet was not fully completed or conflicted with information obtained from the administrative review for 10 reviews. • the SFSP administrative review tracking spreadsheet was not designed to properly track corrective action, related due dates, and CNS review and approval dates; this was noted in all 8 SFSP administrative reviews tested. CNS updated the design of the tracking spreadsheet in fiscal year 2025 to ensure this information is properly tracked. OSA selected a non-statistical random sample. In addition to administrative reviews, CNS must perform base year reviews for all SFAs and sponsors that have applied to participate in USDA Special Provision 2. These base year reviews provide the required information necessary to determine the level of claims the SFA or sponsor may submit in the subsequent 3 years. In fiscal year 2025, CNS identified 4 SFAs that required a base year review, 2 of which were completed alongside the SFA’s administrative review. OSA tested the remaining 2 base year reviews and identified that neither review was completed by CNS as required. OSA cannot determine if unallowable costs exist through the audit of subrecipient monitoring activities, as required information was not collected through OSA’s subrecipient monitoring testing procedures; however, OSA reported questioned costs in the audit of allowable costs/cost principles and eligibility. See findings 2025-019 Internal control over CNC claim reimbursements needs improvement and 2025-020 Internal control over CNC eligibility needs improvement, respectively. Context: In fiscal year 2025, the Department provided 241 subrecipients with $70.7 million in CNC program funds, which represents 99 percent of CNC programs’ $71.3 million total expenditures. Cause: • Lack of supervisory oversight • Lack of adequate policies and procedures Effect: • Noncompliance with Federal regulations • Subrecipients may not be complying with Federal statutes, regulations, or the terms and conditions of the subaward. • Base year reviews provide authorization for the level of allowable claims an SFA or sponsor can claim in subsequent periods; if a base year review is not completed and participation in USDA Special Provision 2 continues, SFAs and sponsors could be underclaiming or overclaiming costs. • Potential questioned costs and disallowances Recommendation: We recommend that the Department enhance policies and procedures and increase oversight to ensure that: • reviews are completed as required and supporting documentation is retained; • required corrective and fiscal actions are implemented, reviewed, and completed; and • high-risk SFAs and sponsors are tracked and considered in planning follow-up reviews. Corrective Action Plan: See F-15 Management’s Response: The Department partially agrees with this finding. Regulatory requirements for the administrative review process including corrective and fiscal action were met. Staff will receive training on tracking sheet completion and additional internal control measures that document requirements were met. The 2026 SFSP tracker has been updated to clarify the date of corrective action and now reads “Corrective Action Received Date”. Contact: Jane McLucas, Director of Child Nutrition, DOE, 207-624-6880 Auditor’s Concluding Remarks: The exceptions noted in the finding outline instances where documentation in support of the administrative review process, including required corrective action by subrecipients, could not be provided or was incomplete. The Department’s existing policies and procedures do not provide assurance that administrative reviews are monitored, completed, documented, and considered in subsequent reviews as required by Federal program regulations. The finding remains as stated.

(2025-021) Title: Internal control over CNC special reporting needs improvement Prior Year Findings: None State Department: Education State Bureau: Commissioner’s Office Child Nutrition Services Federal Agency: U.S. Department of Agriculture Assistance Listing Title: Child Nutrition Cluster Assistance Listing Number: 10.553, 10.555, 10.556, 10.559, 10.582 Federal Award Identification Number: See E-65 to E-66 Compliance Area: Reporting Type of Finding: Material weakness Material noncompliance Questioned Costs: None Criteria: 2 CFR 200.303; 2 CFR 170 The Department must establish, document, and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. Agencies must report each subaward that equals or exceeds the first-tier subaward threshold of $30,000 in Federal funds in the public-facing Federal Funding Accountability and Transparency Act (FFATA) System for Award Management (SAM). Condition: The Child Nutrition Cluster (CNC) includes the School Breakfast Program, National School Lunch Program, Special Milk Program for Children, Summer Food Service Program, and the Fresh Fruit and Vegetable Program. The objectives of the programs are to provide nutritious meals to eligible children in schools and summer food programs; to foster healthy eating habits by providing fresh fruits and vegetables to children attending elementary schools; and to encourage the consumption of nutritious agriculture commodities. The Department of Education (DOE) is responsible for the administration of CNC programs for the State and provides subawards to eligible School Food Authorities and sponsors. When an amount exceeding the first-tier subaward threshold is awarded to a CNC subrecipient, DOE must collect and enter data into SAM. Documentation could not be provided to demonstrate that subaward information or amounts were reviewed or approved prior to being reported to the Federal government. Additionally, the Office of the State Auditor (OSA) tested 23 CNC program subawards totaling $6,124,073 that exceeded the first-tier subaward threshold. Federal regulations require the following information for identified noncompliance to be included in FFATA findings: • 11 subawards totaling $1,039,361 were not reported; • 6 subawards totaling $1,147,396 were not reported timely; • 6 subaward amounts were reported incorrectly; and • 4 subawards reported incorrect key data elements. OSA selected a non-statistical random sample. Context: In fiscal year 2025, the Department was required to report 185 first-tier subawards totaling $60.9 million under CNC programs. First-tier subawards account for 85 percent of CNC programs’ fiscal year 2025 expenditures totaling $71.3 million. Cause: • Lack of adequate policies and procedures • Lack of supervisory oversight Effect: • Noncompliance with Federal regulations • Accurate first-tier subaward information for CNC programs was not reported to the Federal government timely and included inaccurate or incomplete information. This information may be used for programmatic, policy, or statistical purposes. Recommendation: We recommend that the Department enhance policies and procedures and increase oversight to ensure that first-tier subawards are reported accurately, timely, and in accordance with Federal regulations. Corrective Action Plan: See F-15 Management’s Response: The Department agrees with this finding. Regular monthly reporting was disrupted mid-year on March 8, 2025, due to a change in federal reporting systems. Due to the volume of monthly reportable items, the department was unable to manually input this data until a batch upload option was available. Reporting was brought up to date by August 2025. Contact: Nicole Denis, Director of Finance, DOE, 207-530-2161 (State Number: 25-1203-05)

(2025-022) Title: Internal control over CNC donated food inventory needs improvement Prior Year Findings: See Schedule of Findings and Questioned Costs for chart/table State Department: Education State Bureau: Child Nutrition Services Federal Agency: U.S. Department of Agriculture Assistance Listing Title: Child Nutrition Cluster Assistance Listing Number: 10.553, 10.555, 10.556, 10.559, 10.582 Federal Award Identification Number: See E-65 to E-66 Compliance Area: Special tests and provisions Type of Finding: Significant deficiency Questioned Costs: None Criteria: 2 CFR 200.303; 7 CFR 250.12 and .19 The Department must establish, document, and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. On an annual basis, the distributing agency must conduct a physical review of donated food inventories at all storage facilities used by the distributing agency and must reconcile physical and book inventories of donated foods. The distributing agency must ensure that a separate inventory record of donated foods is maintained. The distributing agency’s system of inventory management must ensure that donated foods are distributed in a timely manner and in optimal condition. Condition: The Child Nutrition Cluster includes the School Breakfast Program, National School Lunch Program (NSLP), Special Milk Program for Children, Summer Food Service Program (SFSP), and the Fresh Fruits and Vegetable Program. The objectives of the programs are to provide nutritious meals to eligible children in schools and summer food programs; to foster healthy eating habits by providing fresh fruits and vegetables to children attending elementary schools; and to encourage the consumption of nutritious agriculture commodities. The Department receives donated foods from the U.S. Department of Agriculture (USDA) for distribution to School Food Authorities (SFAs) and sponsors participating in the NSLP or the SFSP. The donated food inventory is managed by a vendor and tracked by the Department using the Child Nutrition Program (CNPWeb) system. In March 2024, the Department identified that the CNPWeb system was not functioning correctly and SFA and sponsor order quantities were duplicated, resulting in inaccurate inventory tracking. The Department remediated the system error in October 2024. The Office of the State Auditor (OSA) tested 9 donated food products to ensure proper tracking by the Department. OSA reviewed the USDA food requests, inventory receipts, and distributions made to SFAs and sponsors to verify that the documentation corresponded to information in the inventory system and physical inventory counts. OSA found 5 instances where records did not agree, including: • 4 food products where the physical inventory count indicated 2 cases fewer than OSA calculated and system inventory records, as follows: o The physical inventory totaled 887 cases; OSA calculated and system inventory records totaled 889 cases. o The physical inventory totaled 326 cases; OSA calculated and system inventory records totaled 328 cases. o The physical inventory totaled 489 cases; OSA calculated and system inventory records totaled 491 cases. o The physical inventory totaled 1380 cases; OSA calculated and system inventory records totaled 1382 cases. • 1 food product where the physical inventory totaled 232 cases; OSA calculated and system inventory records totaled 233 cases. Upon further review, the Department documented the discrepancies on monthly tracking sheets as damaged cases; however, a reconciliation of system records was not completed throughout the year to account for such activity. The Department does not have controls in place to ensure that CNPWeb system inventory tracking is accurate and complete. OSA selected a non-statistical random sample. Context: In fiscal year 2025, the Department distributed 45 USDA donated food products valued at $9.2 million to SFAs and sponsors. Cause: • Lack of adequate policies and procedures • Lack of supervisory oversight Effect: • Potential inaccurate reporting of noncash Federal awards on the Schedule of Expenditures of Federal Awards • Theft, loss, or damage of inventory may go undetected. Recommendation: We recommend that the Department enhance policies and procedures and increase oversight to ensure that: • system inventory records are regularly reconciled to physical inventory counts; • justification of inventory discrepancies is documented in the CNPWeb system timely; and • CNPWeb system inventory tracking is accurate and complete. Corrective Action Plan: See F-15 Management’s Response: The Department partially agrees with this finding. The Child Nutrition acknowledges the identified miscounts and has implemented an additional tracking system to monitor and reconcile inventory. However, the Department maintains that its existing internal control procedures provide reasonable assurance that CNPWeb inventory counts are not materially misstated. The errors found in case counts attribute to less than 1% of the total cases in the test group and may be due to pick errors from the vendor or warehouse, or the delivery of out-of-condition food. The vendor is responsible for the accuracy of counts, all loss or damage caused by the vendor including delivery of out-of-condition food. Monthly inventory tests have been established between the department and the distributor. A ticket has been placed for fixes to the computerized inventory system. Contact: Jane McLucas, Director of Child Nutrition, DOE, 207-624-6880 Auditor’s Concluding Remarks: OSA acknowledges planned corrective action outlined in Management’s Response; however, these additional measures, including monthly inventory tests and CNPWeb system enhancements, were not in place during the audit period. As a result, the Department did not have controls in place to ensure that CNPWeb system inventory tracking was accurate and complete for fiscal year 2025. The finding remains as stated. (State Number: 25-1203-03)

(2025-023) Title: Internal control over CNC subrecipient audit monitoring needs improvement Prior Year Findings: None State Department: Education State Bureau: Commissioner’s Office Child Nutrition Services Federal Agency: U.S. Department of Agriculture Assistance Listing Title: Child Nutrition Cluster Assistance Listing Number: 10.553, 10.555, 10.556, 10.559, 10.582 Federal Award Identification Number: See E-65 to E-66 Compliance Area: Subrecipient monitoring Type of Finding: Significant deficiency Questioned Costs: None Criteria: 2 CFR 200.303; 2 CFR 200.332 The Department must establish, document, and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. The Department must verify that subrecipients are audited as required. Condition: The Department of Education (DOE) is responsible for the administration of Child Nutrition Cluster (CNC) programs for the State. DOE partners with subrecipient School Food Authorities and sponsors to provide nutritious meals to eligible children in schools and summer food programs; to foster healthy eating habits by providing fresh fruits and vegetables to children attending elementary schools; and to encourage the consumption of nutritious agriculture commodities. DOE is required to verify that all subrecipients are audited as required when Federal award expenditures exceed the Single Audit threshold. DOE utilizes a spreadsheet to track and facilitate subrecipient audit monitoring. The spreadsheet tracks each DOE subrecipient, the subrecipient’s auditor, the date of receipt of the Single Audit report, the date the report was reviewed by DOE, any requests for an extension, any exceptions noted within the Single Audit report, and a corrective action plan due date, as applicable. The Office of the State Auditor (OSA) tested 22 CNC subrecipients required to receive a Single Audit and found: • 2 subrecipients were granted submission extensions; however, both audit reports were received after the approved extension date and documentation for an additional extension or late receipt could not be provided. • 1 subrecipient was documented on the tracking spreadsheet; however, the only information included was the subrecipient’s name. In addition, email communications indicated multiple expired extensions, but this information was not included or tracked by DOE. OSA selected a non-statistical random sample. Context: In fiscal year 2025, the Department provided 241 subrecipients with $70.7 million in CNC program funds, which represents 99 percent of CNC programs’ $71.3 million total expenditures. Cause: • Lack of supervisory oversight • Lack of adequate policies and procedures Effect: • Noncompliance with Federal regulations • Subrecipients may not be undergoing audits as required by Federal regulations. Recommendation: We recommend that the Department enhance policies and procedures and increase oversight to ensure that all CNC subrecipients are properly tracked and submit Single Audit reports as required. Corrective Action Plan: See F-16 Management’s Response: The Department agrees with this finding. Audit tracking was previously performed through a manual process. As the result of a RFP, an upgrade to the Maine Education Financial System will include an automated tracking system and dashboard to more effectively manage receipt of school administrative unit audits. In the interim, the Policy and Procedure Manual will be updated to include supervisory review of the tracking spreadsheet on a monthly basis. Contact: Nicole Denis, Director of Finance, DOE, 207-530-2161 (State Number: 25-1203-07)

(2025-024) Confidential finding, see below for more information Title: ________ Pursuant to paragraph 6.64 of the U.S. Government Accountability Office’s Government Auditing Standards (also known as the Yellow Book), we omitted details from this finding as they are confidential under the provisions of 5 MRSA 244-C (3). Though the content of this finding has been redacted, we provided the Department(s) with detailed information regarding the specific condition we identified, as well as the related criteria, context, causes, effects, and our specific recommendations for improvement. Prior Year Findings: None Type of Finding: Significant deficiency Corrective Active Plan: See F-16 Contact: Shirley Browne, Deputy State Controller, Office of the State Controller, 207-626-8423 (State Number: 25-1203-06)

(2025-025) Confidential finding, see below for more information Title: ________ Pursuant to paragraph 6.64 of the U.S. Government Accountability Office’s Government Auditing Standards (also known as the Yellow Book), we omitted details from this finding as they are confidential under the provisions of 5 MRSA 244-C (3). Though the content of this finding has been redacted, we provided the Department(s) with detailed information regarding the specific condition we identified, as well as the related criteria, context, causes, effects, and our specific recommendations for improvement. Prior Year Findings: See Schedule of Findings and Questioned Costs for chart/table Type of Finding: Significant deficiency Corrective Active Plan: See F-16 Contact: Shirley Browne, Deputy State Controller, Office of the State Controller, 207-626-8423 (State Number: 25-1203-08)

(2025-026) Title: Internal control over Summer EBT eligibility needs improvement Prior Year Findings: None State Department: Health and Human Services State Bureau: Office for Family Independence Federal Agency: U.S. Department of Agriculture U.S. Department of Health and Human Services Assistance Listing Title: Summer Electronic Benefits Transfer Program for Children Assistance Listing Number: 10.646 Federal Award Identification Number: See E-65 to E-66 Compliance Area: Allowable costs/cost principles Eligibility Type of Finding: Material weakness Material noncompliance Questioned costs Known Questioned Costs: ALN 10.646 $1,680 Likely Questioned Costs: Undeterminable; incorrect eligibility determinations for the Summer Electronic Benefits Transfer Program for Children (Summer EBT) are the result of conditions that do not uniformly apply to the entire population. Due to the unique circumstances of each case, a projection of questioned costs cannot be reasonably estimated. Criteria: 2 CFR 200.303; 7 CFR 292.6, .8, .12, .15 and .16 The Department must establish, document, and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. Children eligible for the Summer EBT program include those who, at any time during the period of eligibility, are: • school-aged and categorically eligible through their status as a foster child, migrant child, or through their participation in the Supplemental Nutrition Assistance Program (SNAP) or the Temporary Assistance to Needy Families (TANF) program; or • enrolled in a National School Lunch Program (NSLP)-participating school and meet the requirements to receive free or reduced price meals; or • enrolled in a special provision school, and otherwise meet the requirements to receive free or reduced price meals. Summer EBT agencies must submit a Plan for Operations and Management to the Federal government to ensure that Summer EBT benefits are issued to children based on their enrollment at the end of the instructional year immediately preceding each summer. In enrolling eligible children, Summer EBT agencies must establish procedures to allow households to provide updated contact information for the purpose of receiving Summer EBT benefits, and enable anyone who has been determined to be eligible for Summer EBT benefits to confirm their eligibility status and unenroll, or opt out, of the program, if they do not want to receive benefits. Summer EBT agencies must develop procedures to detect and prevent dual participation across multiple states. State Summer EBT agencies must establish issuance and accountability systems which ensure that only certified eligible households receive benefits; that program benefits are distributed timely in the correct amounts; and that benefit issuance and reconciliation activities are properly conducted and accurately reported to the Federal government. Condition: The Summer EBT program is administered by the Office for Family Independence (OFI) and provides a $120 annual benefit to eligible children to purchase nutritious foods during the summer; benefits are distributed through EBT cards. To establish a population of children eligible for the Summer EBT program, OFI utilized information in the Automated Client Eligibility System (ACES) and automatically deemed children who were SNAP or TANF clients as categorically eligible. Children who are Medicaid clients are not categorically eligible and must be filtered to only those clients whose income does not exceed the NSLP income limit of 185 percent of the Federal Poverty Level (FPL) during the eligibility period. To capture Summer EBT-eligible children who are not in ACES, OFI has data sharing agreements in place with the Department of Education (DOE) and the Office of Child and Family Services. OFI relied on automated batch processes to extract data from ACES and DOE information systems; the majority of eligible children were identified in both datasets. OFI removed duplicate children to ensure only 1 benefit was issued per child; however, no additional verification procedures were performed by OFI to ensure the resulting population of children deemed eligible met the required program eligibility criteria. The Office of the State Auditor (OSA) tested 55 benefit payments and found: • 10 benefit payments to children who were not eligible, as follows: o 8 benefit payments to children whose household income was not verified and may exceed the NSLP income limit of 185 percent of the FPL allowed. Therefore, OSA is questioning all 8 payments totaling $960. o 2 benefit payments to children whose household income exceeded the NSLP income limit of 185 percent of the FPL. Therefore, OSA is questioning both payments totaling $240. • 10 benefit payments to children that had an out-of-state address in ACES, as follows: o 6 children had not lived in Maine at any point during the eligibility period. According to ACES, 1 child had last lived in Maine in 2017. All 6 children are ineligible as OFI had confirmation they had unenrolled and left the state. o 3 children were verified as unenrolled from a Maine school in ACES but were eligible at a point in the eligibility period; however, OFI could not provide documentation to support dual participation in both Maine and the state the client moved to. o 1 child whose ACES case should have closed in June 2023; however, due to an incorrect suspension, the child was erroneously deemed eligible. OSA identified a material weakness/material noncompliance with questioned costs as issued in finding 2025-012, Internal control over automated SNAP eligibility certification periods needs improvement, for incorrect benefit suspensions. OSA is questioning costs totaling $240, as 8 of the 10 cards above were never used and benefits were expunged after 122 days. • one 20-year-old client was only recorded in the DOE information system to document that they were dropping out of school; therefore, OSA is questioning the $120 benefit payment. • one 2-year-old client was included in the DOE information; however, the child was too young for public school and was not enrolled. Therefore, OSA is questioning the $120 benefit payment. OSA utilized a risk-based approach to select 25 cases based on age and 10 cases based on address, and selected a non-statistical random sample for the remaining 20 cases. OSA also identified the following exceptions: • For all children issued Summer EBT benefits from July 2024 to November 2024, OFI did not retain documentation to support that families were provided the required notices to advise against duplicate participation, opt out of participation, verify household eligibility, and confirm their address. • In the 2025 Plan for Operations and Management submitted to the Federal government, OFI did not include procedures to ensure that Summer EBT benefits are only issued to children based on their enrollment at the end of the instructional year immediately preceding each summer. The Department does not have adequate policies and procedures in place to ensure that ACES case file modifications, whether manual or system-interfaced, that result in changes to eligibility determinations are appropriately considered at the time of issuance. OFI does not track changes to eligibility information in ACES that are applied retroactively. Context: In fiscal year 2025, the State issued benefits to approximately 121,000 Summer EBT clients; Summer EBT expenditures totaled $14.5 million. Cause: • Lack of adequate policies and procedures • Lack of supervisory oversight Effect: • Known questioned costs • Potential future questioned costs and disallowances • Eligibility determinations may be incorrect, resulting in households being underpaid or overpaid. • Noncompliance with Federal regulations Recommendation: We recommend that the Department implement additional policies and procedures and enhance oversight to ensure that benefits are only issued to eligible Summer EBT clients in accordance with Federal regulations. Corrective Action Plan: See F-16 Management’s Response: The Department partially agrees with this finding. The Department partially agrees with exceptions regarding the children with an out-of-state address. Six of these individuals, including one who used the benefits, were incorrectly identified as eligible based on ACES data. The other four, including one who used the benefits, were identified through National School Lunch Program (NSLP) Participation. SUN Bucks certifications for these four children were established correctly and cannot be retroactively altered. 7 C.F.R. § 292.5 states SUN Bucks eligibility is based on the eligibility standards for NSLP. 7 C.F.R. § 245.6(c)(1) requires that children found eligible for NSLP benefits by their Local Educational Agency (LEA) continue to receive those benefits regardless of subsequent changes. 7 C.F.R. §§292.6 and 292.12 require state agencies to enroll children in SUN Bucks if they meet certification standards at any point during the eligibility period. Household circumstances after the eligibility determination are made, including changes in enrollment, are irrelevant. The Department partially agrees with the exceptions related to documentation and records retention. However, the templates were provided demonstrating that required language concerning dual enrollment and opt out procedures was included. The Department disagrees with the exception related to potential income over 185% FPL. These individuals were found eligible based on Medicaid-based eligibility and income verification rules. 7 C.F.R. § 292.14(a)(iii) only requires income verification for a three percent sample of SUN Bucks manual applications. The SUN Bucks team is not authorized to conduct additional eligibility investigations or require additional documentation for individuals meeting eligibility through participation in another means tested program. All SUN Bucks certifications in the sample reviewed for children enrolled in Medicaid with income within 185% of the Federal Poverty Limit were correctly established using income values determined through Medicaid Passive Renewal and Reasonable Compatibility policies that are consistent with applicable federal rules governing Medicaid. The Department disagrees with exceptions regarding the 2 children with brief enrollment. These children were identified as SUN bucks eligible through NSLP Participation. As detailed above once that determination is made, the Department is not able to over-ride the determination of the LEA. Contact: Evan Denno, Program Manager – SNAP, OFI, DHHS, 207-446-3201 Auditor’s Concluding Remarks: OFI states that “household circumstances after the eligibility determination (is) made, including changes in enrollment, are irrelevant.” However, correspondence regarding the Plan for Operations and Management dated May 2, 2024 between OFI and the U.S. Department of Agriculture specifies “unless the State has specific information that the child has actively unenrolled and moved to another state, the Summer EBT agency should not remove children from the issuance list.” For the cases cited in the Condition, OFI had verification of unenrollment and relocation to another state as early as 2017 and as recent as March 2024, 3 months prior to benefit issuance, which indicates that the children should have been removed from the benefit issuance list. Regarding the Summer EBT children who are also enrolled in Medicaid with household income that exceeded the NSLP income limit of 185 percent of the FPL, OFI asserts that they do not “require additional documentation for individuals meeting eligibility through participation in another means tested program.” However, Medicaid was not approved as a means tested program until October 2024. As a result, OFI’s assertion does not apply to summer 2024 benefit issuances. For the “2 children with brief enrollment,” neither child was deemed eligible for free or reduced price lunch in DOE documentation, nor did they meet other Summer EBT eligibility requirements in 2 CFR 292.6. The finding remains as stated. (State Number: 25-1121-02)

(2025-027) Title: Internal control over Summer EBT procurement needs improvement Prior Year Findings: None State Department: Administrative and Financial Services Health and Human Services State Bureau: Office of State Procurement Services Division of Contract Management Office for Family Independence Federal Agency: U.S. Department of Agriculture Assistance Listing Title: Summer Electronic Benefits Transfer Program for Children Assistance Listing Number: 10.646 Federal Award Identification Number: See E-65 to E-66 Compliance Area: Procurement and suspension and debarment Type of Finding: Significant deficiency Questioned Costs: None Criteria: 2 CFR 200.303; 2 CFR 200.317; 7 CFR 277.14; 7 CFR 292.11; 5 MRSA 1825-B and D; Office of State Procurement Services (OSPS) policies The Department must establish, document, and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. The Department must follow the same policies and procedures it uses for procurements with non-Federal funds. 7 CFR 277.14 requires the Department to submit proposed contracts and related procurement documents to the U.S. Department of Agriculture’s Food and Nutrition Service (FNS) for preaward review and approval when the procurement is expected to exceed $10,000 and is to be awarded without competition, or only one bid or offer is received in response to solicitation. 7 CFR 292.11 states that the standards prescribed in 7 CFR 277.14, as well as the requirement for prior approval, apply to information system services and equipment acquired primarily to support Summer Electronic Benefits Transfer (Summer EBT). Awards shall be made to the best-value bidder, taking into consideration the best interest of the State. The requirement to competitively bid a contract may be waived if specific criteria is met, including the item or service can only be procured from one source or it is an emergency procurement. Each bid, with the name of the bidder, must be entered on record. Each record, with the successful bid indicated, must be open to public inspection after the letting of the contract. The Department must justify the selection of vendor, either through competitive or noncompetitive process, and provide a detailed explanation of cost, demonstrating how the best value for the State is ensured. The Chief Procurement Officer shall make the public aware of contracts and grants for which bids are being requested and communicate the procedure used in reviewing bids. Contracts must be submitted to OSPS at least 14 days prior to the contract start date. Condition: The Summer EBT program provides a $120 annual benefit to eligible children to purchase nutritious foods during the summer and is administered by the Office for Family Independence (OFI). OSPS is the central oversight agency for all State procurement. The Department of Health and Human Services (DHHS) Division of Contract Management (DCM) oversees the solicitation and contract implementation for all DHHS procurement. DCM coordinates with DHHS program personnel to evaluate and select vendors and subrecipients, determine contract terms, and provide required documentation to OSPS. OSPS is responsible for reviewing and approving Procurement Justification Forms (PJF) submitted by DCM on behalf of program personnel prior to the award of contracts. The PJF represents program personnel’s assertion that the selected procurement method is appropriate under applicable State and Federal requirements, and that required evaluation procedures have been performed. OSA tested 2 contracts, 1 procured competitively and 1 procured noncompetitively, that accounted for $408,351 of the $424,272 in Summer EBT program procurement-related transactions in fiscal year 2025 and found: • OFI could not provide documentation that FNS approved applicable procurement documents prior to contract award as required by 7 CFR 292.11. • PJFs were reviewed for reasonableness by DCM and OSPS, but DHHS could not provide documentation to support the assertions made by OFI were accurate. OSA utilized a risk-based approach to select 1 contract issued by OFI and a non-statistical random sample of all other contracts. Context: In fiscal year 2025, the Department expended $424,272 in procurement-related transactions from Summer EBT funds of $14.5 million. Cause: • Lack of adequate policies and procedures • Lack of supervisory oversight Effect: • Potential questioned costs and future disallowances. • Noncompliance with Federal and State procurement requirements could result in the need to void a contract or exposure to legal proceedings. Recommendation: We recommend that OSPS: • increase agency awareness of the procedures related to the timing of procurement contract documentation being submitted to OSPS for review prior to the contract start date; and • finalize and implement an updated procurement policy and procedure manual that identifies the parties responsible for key aspects of the procurement process. We also recommend that DCM and OFI develop policies and procedures and increase oversight to ensure all procurement transactions comply with Federal and State requirements, including: • Federal pre-procurement approvals are obtained before contracts are awarded, if required; • DCM obtaining and reviewing documentation to support the assertions made by OFI for accuracy and reasonableness; and • ensuring PJFs are completed, reviewed, and submitted to OSPS prior to the contract start date. Corrective Action Plan: See F-17 Management’s Response: DAFS Response: The Department agrees with this finding. OSPS will amend and formalize our draft policy guidance that clearly defines agency and OSPS roles and responsibilities in the contracting process. This will include the expansion of an agency-focused section to further emphasize contract submission and processing expectations, as well as the risks and implications associated with contracting delays. The amended and additional content will be integrated into the draft OSPS Policy Manual for release later this year. DAFS Contact: David Morris, Acting Chief Procurement Officer, OSPS, 207-624-7335 DHHS Response: The Department partially agrees with this finding. There is not a requirement to provide documentation that the Department personnel’s assertions are accurate regarding Department personnel’s review of PJFs. The Department agrees that it can improve the timing of procurement documents in relation to the start dates of the contracts. Extenuating circumstances exist periodically that prevent the timeliness of these documents. In some cases, there are delays in the grant approval at the Federal level. Delays in Legislative approval of budgets can also lead to procurement documentation delays. DHHS Contact: Jim Lopatosky, Director, Division of Contract Management, DHHS, 207-287-5075 Auditor’s Concluding Remarks: 2 CFR 200.303 requires the Department to establish, document, and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. Absent adequate documentation to support the veracity of the assertions made on the PJF by program personnel, the best value for the State cannot be ensured. The finding remains as stated. (State Number: 25-1121-03)

(2025-028) Title: Internal control over National Guard cash management and the related financial reporting needs improvement Prior Year Findings: None State Department: Defense, Veterans and Emergency Management State Bureau: Military Federal Agency: U.S. Department of Defense Assistance Listing Title: National Guard Military Operations and Maintenance (O&M) Projects Assistance Listing Number: 12.401 Federal Award Identification Number: See E-65 to E-66 Compliance Area: Cash management Reporting Type of Finding: Significant deficiency Questioned Costs: None Criteria: 2 CFR 200.303; 2 CFR 200.302; 32 CFR 33.20 The Department must establish, document, and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. Financial records must adequately identify the source and application of funds and provide accountability for all funds, property, and assets related to the Federally-funded activities. Fiscal control and accounting procedures of the State must be sufficient to permit the tracing of funds to a level of expenditures adequate to establish that such funds have not been used in violation of the restrictions and prohibitions of applicable statutes and must permit preparation of required reports. Condition: The National Guard Military Operations and Maintenance Projects (National Guard O&M Projects) program supports the Army and Air National Guard in minor construction, maintenance, repair, or operation of facilities, and provides mission operational support to be performed by the State. The Department submits a Request for Advance or Reimbursement Form (SF-270) to the Federal government to process the National Guard O&M Projects program’s reimbursement request. The program is funded utilizing estimated revenue; estimated revenue represents the estimated amount of funds needed to process expenditures, where the Department utilizes State funds prior to receiving Federal reimbursement, and is limited to the amount requested and approved by the Office of the State Controller. As a result, the program carries a negative cash balance while waiting for the reimbursement requests to be approved by the Federal National Guard Bureau. Delays in receiving Federal approval have led to larger negative cash balances for the program. The negative cash balances should be comprised of all submitted but unapproved SF-270 requests and total expenditures that have not been submitted for reimbursement. The Department tracks outstanding SF-270 requests utilizing a spreadsheet; however, the spreadsheet is not periodically reconciled to the State’s accounting system to ensure all expenditures are included. Additionally, the Department does not have documented policies and procedures to follow up on outstanding reimbursement requests to facilitate more timely reimbursements from the Federal government. Context: In fiscal year 2025, the National Guard O&M Projects program expenditures totaled approximately $30.1 million. The June 30th negative cash balances for the previous 4 fiscal years were as follows: • $(6.7) million for fiscal year 2022 • $(12.4) million for fiscal year 2023 • $(13.3) million for fiscal year 2024 • $(12.4) million for fiscal year 2025 Cause: • Lack of adequate policies and procedures, including reconciling reimbursement activity to the State’s accounting system • Lack of supervisory oversight Effect: • Due to a lack of monitoring cash balances, the Department cannot readily determine if specific Federal expenditures are reimbursed timely. • Sustained negative cash balances limit the program’s ability to continue operations without additional State funding. Recommendation: We recommend that the Department develop and implement policies and procedures and enhance oversight to adequately monitor the National Guard O&M Projects program’s cash balances, including requesting the status of delayed reimbursement requests with the Federal National Guard Bureau to ensure that Federal funds are received as timely as possible. Corrective Action Plan: See F-117 Management’s Response: The Department partially agrees with this finding and will implement the “Corrective Action Plan.” The Auditor states the cause of the findings is a ‘lack’ of adequate policies and procedures and a ‘lack’ of supervisory oversight. We agree that the procedures are not adequate but there are established procedures and oversight. Contact: Diane Dunn, Commissioner, DVEM, 207- 430-5158 Auditor’s Concluding Remarks: The Office of the State Auditor acknowledges that the Department has established procedures and oversight; however, they were not adequate to prevent, or detect and correct, on a timely basis the exception noted in the Condition. The finding remains as stated. (State Number: 25-1503-01)

(2025-029) Title: Internal control over National Guard payroll costs needs improvement Prior Year Findings: None State Department: Defense, Veterans and Emergency Management Administrative and Financial Services State Bureau: Military Security and Employment Service Center Federal Agency: U.S. Department of Defense Assistance Listing Title: National Guard Military Operations and Maintenance (O&M) Projects Assistance Listing Number: 12.401 Federal Award Identification Number: See E-65 to E-66 Compliance Area: Allowable costs/cost principles Type of Finding: Significant deficiency Questioned Costs: None Criteria: 2 CFR 200.303; 2 CFR 200.403, .430 and .431; 5 MRSA 7065 The Department must establish, document, and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. To be allowable under Federal awards, costs must be necessary and reasonable for the performance of the Federal award and be adequately documented. Compensation for personal services includes all renumeration, paid or accrued, for services of employees rendered during the period of performance under the Federal award, including but not necessarily limited to wages and salaries. Compensation for personal services may also include fringe benefits. Costs of compensation are allowable to the extent that they are reasonable for the services rendered and conform to the established written policy of the recipient. Salary increases are based on merit. Salary advancements within an established range shall not be automatic, but shall be dependent upon specific recommendation of the appointing officer and approval of the commissioner. The recommendation shall be based upon standards of performance as indicated by merit ratings or other pertinent data. No advancements in salary may be made until the employee has completed the probationary period. Condition: The National Guard Military Operations and Maintenance Projects (National Guard O&M Projects) program supports the Army and Air National Guard in minor construction, maintenance, repair, or operation of facilities, and provides mission operational support to be performed by the State. Performance Management Forms (PMFs) document an employee’s overall performance rating; identify the pay grade and step for the employee, including whether a merit increase should be applied based on performance; and document management approval, which includes the supervisor and the agency head. The Department of Defense, Veterans and Emergency Management is responsible for completing PMFs and submitting them to the Security and Employment Service Center for processing. The Office of the State Auditor (OSA) tested payroll costs for 24 employees charged to the National Guard O&M Projects program during fiscal year 2025 and found that 8 PMFs did not have evidence of the agency head approval; 7 of the 8 PMFs resulted in merit increases in fiscal year 2025. OSA selected a non-statistical random sample. Context: In fiscal year 2025, the National Guard O&M Projects program expenditures totaled $30.1 million, of which $11.1 million was expended for payroll. Cause: • Lack of adequate policies and procedures • Lack of supervisory oversight Effect: • Potential unauthorized salary adjustments could result in future questioned costs • Noncompliance with State regulations Recommendation: We recommend that the Department enhance policies and procedures and increase oversight to ensure that PMFs properly support the National Guard O&M Projects program’s payroll costs in accordance with Federal and State regulations. Corrective Action Plan: See F-18 Management’s Response: DVEM Response: The Department partially agrees with this finding. The Department agrees that eight positions lacked an agency head signature. As a result, we have taken steps to ensure appropriate agency heads are identified for each of those positions and the agency heads are aware of the need to sign off on the relevant forms. However, we disagree that there is lack of adequate policies and procedures that could result in future questioned costs. All of the PMFs were completed and signed by a supervisor and employee indicating that performance was properly assessed to support the employee’s pay grade, step and merit increase. DVEM Contact: Michelle Lenihan, Deputy Commissioner, DVEM, 207- 430-5997 DAFS Response: The Bureau of Human Resources partially agrees with this finding. The Bureau of Human Resources agrees that the positions identified lacked agency head signatures. BHR disagrees with OSA as to the effect of those missing signatures. As OSA indicates “Performance Management Forms (PMFs) document an employee’s overall performance rating, identify the pay grade and step for the employee, including whether a merit increase should be applied based on performance.” The performance management forms are developed and updated centrally by BHR and all Departments are required to use the same forms. The Agency Head will often not have any direct knowledge of a specific employee’s actual performance. The purpose of the Agency Head signature is not as a control to whether an employee is meeting performance expectations, rather it is because the Agency Head is responsible for the budget of their respective agency, including personnel services. Due to other controls at the Finance Service Center and Controller’s Office, all positions were appropriately budgeted for, and employees received their appropriate pay. DAFS Contact: Michael J. Dunn, Esq., Acting State Human Resources Officer, BHR, 207-215-2951 Auditor’s Concluding Remarks: 2 CFR 200.303 requires the Department to establish, document, and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. State internal control procedures require review and approval of the PMF by both the supervisor and agency head, as evidenced by their signatures, to ensure an employee’s pay grade and step are appropriate based on performance. Both signatures on the PMF support that payroll costs of the National Guard O&M Projects program have been adequately reviewed for allowability purposes in accordance with Federal and State regulations. The finding remains as stated. Contact: (State Number: 25-1503-02)

(2025-030) Title: Internal control over Health Disparities program SEFA reporting needs improvement Prior Year Findings: None State Department: Administrative and Financial Services State Bureau: Health and Human Services Service Center Federal Agency: U.S. Department of Health and Human Services Assistance Listing Title: Activities to Support State, Tribal, Local and Territorial (STLT) Health Department Response to Public Health or Healthcare Crises Assistance Listing Number: 93.391 Federal Award Identification Number: See E-65 to E-66 Compliance Area: Reporting Type of Finding: Material weakness Material noncompliance Questioned Costs: None Criteria: 2 CFR 200.303; 2 CFR 200.510 The Department must establish, document, and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. The Department must prepare a Schedule of Expenditures of Federal Awards (SEFA) for the period covered by the State’s financial statements which must include the total Federal awards expended. At a minimum, the SEFA must provide total Federal awards expended for each individual Federal program and the Assistance Listing Number and include the total amount provided to subrecipients from each Federal program. Condition: The Department of Health and Human Services’ Service Center must complete and submit exhibits and related schedules to the Office of the State Controller (OSC) at the close of each fiscal year to report Federal award information for inclusion on the State’s SEFA. OSC is responsible for compiling this information on behalf of the State. The Office of the State Auditor reviewed amounts reported on the SEFA for the Activities to Support State, Tribal, Local and Territorial (STLT) Health Department Response to Public Health or Healthcare Crises (Health Disparities) program and identified a $1.2 million revenue transfer incorrectly reported as a reduction to expenditures. As a result, the initial amount reported on the SEFA was understated by $1.2 million. Context: In fiscal year 2025, Health Disparities program expenditures totaled $6.7 million. Cause: • Lack of adequate policies and procedures • Lack of supervisory oversight Effect: • Inaccurate reporting of expenditure amounts on the SEFA, which is submitted to the Federal government, may result in inaccurate information used for programmatic, policy, or statistical purposes. • Noncompliance with Federal regulations Recommendation: We recommend that the Department implement policies and procedures to ensure expenditures are appropriately reported on the SEFA. Corrective Action Plan: See F-19 Management’s Response: The DHHS and the DHHS Financial Service Center agree with this finding. The Service Center will update policies and procedures to ensure expenditures are appropriately reported on the SEFA by August 2026. Contact: Sarah Gove, Director, DHHS Service Center, DAFS, 207-458-6626 (State Number: 25-1123-01)

(2025-031) Title: Internal control over Health Disparities program cash management needs improvement Prior Year Findings: None State Department: Administrative and Financial Services Health and Human Services Public Safety State Bureau: Health and Human Services Service Center Maine Center for Disease Control & Prevention Emergency Medical Services Federal Agency: U.S. Department of Health and Human Services Assistance Listing Title: Activities to Support State, Tribal, Local and Territorial (STLT) Health Department Response to Public Health or Healthcare Crises Assistance Listing Number: 93.391 Federal Award Identification Number: See E-65 to E-66 Compliance Area: Cash management Subrecipient monitoring Type of Finding: Material weakness Material noncompliance Questioned Costs: None Criteria: 2 CFR 200.303; 31 CFR 205.33; State Administrative and Accounting Manual (SAAM) Chapter 50 The Department must establish, document, and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. The Department must minimize the time between the drawdown of Federal funds and the disbursement of these funds for Federal program purposes. The timing and amount of funds transfers must be as close as is administratively feasible to the Department’s actual cash outlay for program costs. Section 50.40.80 of the SAAM has defined administratively feasible as no more than 7 business days. Condition: The Activities to Support State, Tribal, Local and Territorial (STLT) Health Department Response to Public Health or Healthcare Crises (Health Disparities) program was implemented to address disparities in access to healthcare in populations that are at high-risk and underserved, including racial and ethnic minority groups and people living in rural communities. The Health Disparities program is administered by the Maine Center for Disease Control & Prevention’s (MeCDC) Division of Population Health Equity. MeCDC has a memorandum of understanding in place with the Department of Public Safety’s Emergency Medical Services (EMS) Bureau to assist in administering the Health Disparities program. The Department of Health and Human Services’ Service Center is responsible for drawing down Federal funds for disbursement for program purposes. The Office of the State Auditor (OSA) identified that MeCDC began fiscal year 2025 with a $1.7 million surplus of program funds and ended the fiscal year with a $1.2 million surplus of funds. The surplus was the result of a MeCDC drawdown of $3.0 million during fiscal year 2022 which was provided to EMS for use in support of the Health Disparities program. EMS returned $1.2 million of unused funds to MeCDC in fiscal year 2025. Therefore, EMS had excess cash on hand from July 1, 2024, through April 15, 2025, and MeCDC had excess cash on hand from April 15, 2025, through June 30, 2025, which is not in compliance with Federal cash management requirements. MeCDC fully returned the surplus funds to the Federal government in July 2025. In addition, OSA tested 3 payments made to subrecipients by EMS and found a significant delay between receipt of invoice from the EMS subrecipient and issuance of payment. The delay in payment issuance ranged between 62 to 80 days. Context: In fiscal year 2025, MeCDC expended $6.7 million in Health Disparities program funds. Cause: • Lack of adequate policies and procedures • Lack of supervisory oversight • Staff turnover which delayed the processing of invoices Effect: • Noncompliance with Federal regulations • The Federal government may impose more stringent program-specific cash management requirements based on noncompliance. • The State could incur an interest liability on excess Federal cash balances. • Delays in issuing payments to subrecipients. Recommendation: We recommend that the Departments develop policies and procedures to: • govern inter-departmental transfers of funds to ensure cash management requirements are adhered to; and • ensure the timely processing of invoices. Corrective Action Plan: See F-18 Management’s Response: DHHS Response: The Department agrees with this finding. At the onset of the Health Disparities grant period, the Maine CDC and the Department of Public Safety (DPS) established an MOU to approve the single transfer of all Health Disparity grant funds allocated to DPS prior to DPS expenditure of funds. In March 2025, the Health Disparities grant was prematurely terminated and unspent funds in the amount of $1.2 million were returned to U.S. CDC. In May 2025, Maine CDC was among other Health Disparities grant recipients eligible to again utilize Health Disparities grant funds following the reinstatement of the grant as a result of successful challenging litigation. In June 2025, Maine CDC was granted internal approval to proceed with utilization of grant funds. During the process of grant termination and reinstatement and prior to undergoing the SFY25 audit, it was recognized that the MOU should include terms for reimbursement of funds based on service provision rather than authorizing the single transfer of funds prior to expenditure. Following the reinstatement of the Health Disparities grant, Maine CDC and DPS worked collaboratively to revise the original MOU to include terms for distribution of funds, including monthly submission or financial reporting to receive funds based on services provided. The revised MOU was signed by DPS and DHHS Commissioners in June and August 2025, respectively. DHHS Contact: Eden Hale, Associate Director, Division of Population Health Equity, MeCDC, 207-441-1090 DPS Response: The Department agrees with this finding. The Department of Public Safety acknowledges that there was a delay in the processing of the three invoices made to subrecipients by EMS which were all identified during the Audit. This was a result of turnover in multiple positions within the bureau including the Director and the Office Specialist II who both play an important role in the processing of invoices. Contact: Derek Gorneau, Assistant to the Commissioner, DPS, 207-530-3531 (State Number: 25-1123-02)

(2025-032) Title: Internal control over Health Disparities program subrecipient monitoring procedures needs improvement Prior Year Findings: None State Department: Health and Human Services Public Safety State Bureau: Maine Center for Disease Control & Prevention Emergency Medical Services Federal Agency: U.S. Department of Health and Human Services Assistance Listing Title: Activities to Support State, Tribal, Local and Territorial (STLT) Health Department Response to Public Health or Healthcare Crises Assistance Listing Number: 93.391 Federal Award Identification Number: See E-65 to E-66 Compliance Area: Subrecipient monitoring Type of Finding: Material weakness Material noncompliance Questioned Costs: None Criteria: 2 CFR 200.303; 2 CFR 200.332 The Department must establish, document, and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. The Department must: • ensure that every subaward is clearly identified to the subrecipient as a subaward and includes specific information. • evaluate each subrecipient’s risk of noncompliance with Federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate subrecipient monitoring procedures. • monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. Condition: The Activities to Support State, Tribal, Local and Territorial (STLT) Health Department Response to Public Health or Healthcare Crises (Health Disparities) program was implemented to address disparities in access to healthcare in populations that are at high-risk and underserved, including racial and ethnic minority groups and people living in rural communities. The Health Disparities program is administered by the Maine Center for Disease Control & Prevention’s (MeCDC) Division of Population Health Equity. MeCDC has a memorandum of understanding in place with the Department of Public Safety’s Emergency Medical Services (EMS) Bureau to assist in administering the Health Disparities program. The Office of the State Auditor (OSA) tested 11 contracts or contract amendments issued by MeCDC and 3 contracts issued by EMS for compliance with: • award identification requirements and found: o 9 contract amendments issued by MeCDC did not include the name of the Federal agency issuing the award, the Federal award identification number, or the Federal award date; and o all 3 contracts issued by EMS did not include the Federal award identification number, the Federal award date, the assistance listing title and number, or the indirect cost rate for the Federal award. • subrecipient risk evaluation procedures and found through inquiry of program personnel at MeCDC and EMS that policies and procedures were not in place to ensure risk assessments were performed or used to determine subrecipient monitoring activities. As a result, subrecipient monitoring activities were the same for all subrecipients/contracts, regardless of risk. • subrecipient monitoring requirements and found that documentation could not be provided to support that: o follow-up occurred regarding late receipt of an incomplete financial report for 1 contract overseen by MeCDC; o an appropriate response was completed to previously identified inaccurate expense reporting for 1 contract overseen by MeCDC; o a required report was reviewed for 1 contract overseen by EMS; and o required reports were received or that appropriate action was taken in response for 2 contracts overseen by EMS. OSA determined that payments made to subrecipients for the aforementioned reporting deficiencies were allowable based upon subsequent reports and other monitoring procedures performed. OSA utilized a risk-based approach to select 2 contracts issued by MeCDC and selected a non-statistical random sample of all other contracts. Context: In fiscal year 2025, MeCDC provided $3.2 million from a total of $6.2 million and EMS provided $301,000 from a total of $449,000 to Health Disparities program subrecipients. Cause: • Lack of adequate policies and procedures • Lack of supervisory oversight Effect: • Noncompliance with Federal regulations • Subrecipients that are deemed higher risk may not be monitored on a more frequent basis. Conversely, subrecipients that are deemed lower risk may not be monitored on a less frequent basis, which would free resources and time to dedicate towards other higher risk subrecipients. • Noncompliance with the Federal statutes, regulations, and the terms and conditions of the subaward by subrecipients may go undetected. • Potential future questioned costs and disallowances Recommendation: We recommend that the Department implement policies and procedures: • to ensure that all required information is included in contracts and contract amendments; • that require evaluation of each subrecipient’s risk of noncompliance specifically for the purpose of determining the appropriate subrecipient monitoring to be performed; and • implement policies and procedures to ensure all required subrecipient monitoring activities are performed. Corrective Action Plan: See F-19 Management’s Response: DHHS Response: The Department partially agrees with this finding. We agree with the recommendations that the Department implement policies and procedures to ensure all required information is included in contracts and that all required subrecipient monitoring is completed. The Department disagrees that we do not have subrecipient risk evaluation procedures. The Department evaluates risk on its subrecipients for the purposes of determining the appropriate subrecipient monitoring in multiple ways. The first assessment of risk is when a subaward is competitively bid. The second assessment of risk is built into the Maine Uniform Accounting and Auditing Practices for Community Agencies (MAAP) in which higher risk subrecipients undergo a higher level of testing by Independent Public Accountants. Finally, the Social Service Unit of the Division of Audit performs a risk assessment and tests transactions for those subrecipients that have been determined to be higher risk. DHHS Contact: Eden Hale, Associate Director, Division of Population Health Equity, Maine CDC, 207-441-1090 DPS Response: The Department partially agrees with this finding. The Department of Public Safety acknowledges that EMS was missing policies and procedures around specific subrecipient monitoring activities and required contract language identifying the Federal Grant. However, the Department has these policies and procedures in place for the Contract/Grant Team which oversees the majority of the Federal Funding for the Department. The Department will ensure all Bureaus receive guidance, training, and policies and procedures. DPS Contact: Derek Gorneau, Assistant to the Commissioner, DPS, 207-530-3531 Auditor’s Concluding Remarks: DHHS: 2 CFR 200.332(b) states that the Department must evaluate each subrecipient’s risk of noncompliance with Federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate subrecipient monitoring. The Department has indicated in Management’s Response that the criteria set forth in 2 CFR 200.332(b) have been met; however, the following rebuttals illustrate that the Department is not in compliance with Federal requirements: • The Department identifies the first assessment of risk: when a subaward is competitively bid. o While OSA acknowledges this does occur, not all subawards are competitively bid. o The level of subrecipient monitoring that the Department performs is based on the services provided, not on specific subrecipients, as required. • The Department identifies the second assessment of risk: built into MAAP in which higher risk subrecipients undergo a higher level of testing by independent public accountants. o A subrecipient deemed higher risk as the result of a risk evaluation in accordance with 2 CFR 200.332 may not be deemed higher risk in accordance with MAAP standards. • The Department identifies the third assessment of risk: the Social Service Unit of the Division of Audit performs a risk assessment and tests transactions for those subrecipients that have been determined to be higher risk. o The Department did not provide documentation to demonstrate that these procedures are performed as a result of a risk evaluation. The Department’s existing policies and procedures do not require nor provide support for the evaluation of each subrecipient’s risk of noncompliance specifically for the purpose of determining the appropriate subrecipient monitoring to be performed. DPS: The Department asserts that policies and procedures are in place for the Contract/Grant Team, but did not demonstrate that these policies and procedures were adhered to in relation to contracts for the Health Disparities program. The finding remains as stated. (State Number: 25-1123-03)

(2025-033) Title: Internal control over Health Disparities program payments to subrecipients needs improvement Prior Year Findings: None State Department: Health and Human Services State Bureau: Maine Center for Disease Control & Prevention Federal Agency: U.S. Department of Health and Human Services Assistance Listing Title: Activities to Support State, Tribal, Local and Territorial (STLT) Health Department Response to Public Health or Healthcare Crises Assistance Listing Number: 93.391 Federal Award Identification Number: See E-65 to E-66 Compliance Area: Allowable costs/cost principles Type of Finding: Significant deficiency Questioned Costs: None Criteria: 2 CFR 200.303; 2 CFR 200.403 The Department must establish, document, and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of the award. To be allowable under Federal awards, costs must be necessary and reasonable for the performance of the Federal award and be adequately documented. Condition: The Activities to Support State, Tribal, Local and Territorial (STLT) Health Department Response to Public Health or Healthcare Crises (Health Disparities) program was implemented to address disparities in access to healthcare in populations that are at high-risk and underserved, including racial and ethnic minority groups and people living in rural communities. The Health Disparities program is administered by the Maine Center for Disease Control & Prevention’s (MeCDC) Division of Population Health Equity. MeCDC has a memorandum of understanding in place with the Department of Public Safety’s Emergency Medical Services (EMS) Bureau to assist in administering the Health Disparities program. The Office of the State Auditor (OSA) tested 27 payments issued by MeCDC to subrecipients and found: • 2 payments totaling $69,535 to 1 subrecipient against a contract for which a cash surplus existed at the time of payment. • 1 payment of $40,621 based on a quarterly financial report that contained detailed expense information that did not match approved contract expenditures. • 2 payments totaling $252,824 to 1 subrecipient to close out a contract were issued prior to receipt by the Department of the required final progress reports. Therefore, MeCDC does not have policies and procedures in place to prevent payments to subrecipients that do not meet the criteria set forth in 2 CFR 200.303 at the time of payment. Subsequently, MeCDC was able to provide reports to demonstrate that the funds had been used in accordance with the terms and conditions of the award. OSA utilized a risk-based approach to select 9 payments issued by MeCDC and selected a non-statistical random sample of subrecipient contracts to test all payments made in fiscal year 2025 that were related to those contracts. Context: MeCDC provided $3.2 million from a total of $6.2 million to Health Disparities program subrecipients during fiscal year 2025. Cause: • Lack of adequate policies and procedures • Lack of supervisory oversight Effect: • Potential future questioned costs and disallowances • Noncompliance with Federal regulations Recommendation: We recommend that MeCDC implement procedures and enhance oversight to ensure payments made to subrecipients are accurate, allowable, and adequately supported at the time of payment. Corrective Action Plan: See F-20 Management’s Response: The Department disagrees with this finding. The conditions noted do not support that costs were unallowable. Furthermore, the Department demonstrated that the funds had been used in accordance with the terms and conditions of the award. The Department’s processes provide reasonable assurance that payments are appropriate. Contact: Eden Hale, Associate Director, Division of Population Health Equity, Maine CDC, 207-441-1090 Auditor’s Concluding Remarks: OSA acknowledges that subsequent information demonstrated that the funds were used for allowable purposes; however, this does not absolve the Department of responsibility to ensure accuracy and appropriateness at the time of payment. The Department did not demonstrate that controls are in place to ensure that all payments to subrecipients are allowable at the time of payment. The finding remains as stated. (State Number: 25-1123-04)

(2025-034) Title: Internal control over Health Disparities program subrecipient cash management needs improvement Prior Year Findings: None State Department: Health and Human Services State Bureau: Maine Center for Disease Control & Prevention Federal Agency: U.S. Department of Health and Human Services Assistance Listing Title: Activities to Support State, Tribal, Local and Territorial (STLT) Health Department Response to Public Health or Healthcare Crises Assistance Listing Number: 93.391 Federal Award Identification Number: See E-65 to E-66 Compliance Area: Cash management Subrecipient monitoring Type of Finding: Significant deficiency Questioned Costs: None Criteria: 2 CFR 200.303; 2 CFR 200.305 The Department must establish, document, and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. The Department is required to monitor cash drawdowns by their subrecipients to ensure that the time elapsing between the payment of Federal funds to the subrecipient and the subrecipient’s actual disbursement for program purposes is minimized. Condition: The Activities to Support State, Tribal, Local and Territorial (STLT) Health Department Response to Public Health or Healthcare Crises (Health Disparities) program was implemented to address disparities in access to healthcare in populations that are at high-risk and underserved, including racial and ethnic minority groups and people living in rural communities. The Health Disparities program is administered by the Maine Center for Disease Control & Prevention’s (MeCDC) Division of Population Health Equity. The Department makes equal advance monthly payments to subrecipients and then reconciles those amounts to quarterly financial reports submitted by the subrecipient. This procedure does not take into consideration the time elapsing between the payment of Federal funds to the subrecipient and the subrecipient’s actual disbursement for program purposes, and MeCDC’s subrecipient monitoring procedures do not include review of subrecipient compliance with cash management requirements. As a result, MeCDC procedures do not support that subrecipient cash management is properly monitored as required by Federal regulations. Context: MeCDC provided $3.2 million from a total of $6.2 million to Health Disparities program subrecipients during fiscal year 2025. Cause: • Lack of adequate subrecipient monitoring procedures • Lack of centralized oversight of subrecipient monitoring Effect: • Noncompliance with Federal regulations • Federal programs may not be effectively and efficiently administered. • The Federal government may require the implementation of more stringent subrecipient cash management procedures. Recommendation: We recommend that MeCDC implement monitoring procedures over subrecipient cash management requirements to ensure that the time elapsing between the payment of Federal funds to the subrecipient and the subrecipient’s actual disbursement for program purposes is minimized for the Health Disparities program. Corrective Action Plan: See F-20 Management’s Response: The Department disagrees with this finding. The Department is in compliance with the requirement for minimizing the time between payments to our subrecipients and the disbursement of the funds. Payments are made as close as is administratively feasible. The Compliance Supplement suggested audit procedures for Cash Management for pass-through entities refers to 200.305(b)(1) ... that same paragraph states that the timing and amount of advance payments must be as close as is administratively feasible. Contact: Eden Hale, Associate Director, Division of Population Health Equity, MeCDC, 207-441-1090 Auditor’s Concluding Remarks: The Department’s interpretation of the applicable Federal regulation emphasizes a single sentence from the broader paragraph, omitting context that informs the regulation’s full intent. According to the 2025 Compliance Supplement, pass-through entities must monitor cash drawdowns by their subrecipients to ensure that the time elapsing between the transfer of Federal funds to the subrecipient and their disbursement for program purposes is minimized as required by the applicable cash management requirements in the Federal award to the recipient (2 CFR 200.305(b)(1)). 2 CFR 200.305(b)(1) states that the recipient or subrecipient must be paid in advance, provided it maintains or demonstrates the willingness to maintain both written procedures that minimize the time elapsing between the transfer of funds and disbursement by the recipient or subrecipient, and financial management systems that meet the standards for fund control and accountability as established in this part. Advance payments to a recipient or subrecipient must be limited to the minimum amounts needed and be timed with actual, immediate cash requirements of the recipient or subrecipient in carrying out the purpose of the approved program or project. The timing and amount of advance payments must be as close as is administratively feasible to the actual disbursements by the recipient or subrecipient for direct program or project costs and the proportionate share of any allowable indirect costs. The recipient or subrecipient must make timely payments to contractors in accordance with the contract provisions. The Department references the phrase “as close as is administratively feasible” to justify their current process; however, this phrase is part of a broader requirement that establishes specific conditions for advance payments. The regulation requires that the timing between when the subrecipient receives Federal funds from the State and when the subrecipient disburses those funds is closely monitored to ensure that disbursements align with actual, immediate cash needs. The Department could not provide evidence to demonstrate that they adequately monitored subrecipient cash drawdowns to ensure alignment with actual, immediate cash needs. The finding remains as stated. (State Number: 25-1123-05)

(2025-035) Title: Internal control over Health Disparities program procurement needs improvement Prior Year Findings: None State Department: Administrative and Financial Services Health and Human Services State Bureau: Office of State Procurement Services Division of Contract Management Maine Center for Disease Control & Prevention Federal Agency: U.S. Department of Health and Human Services Assistance Listing Title: Activities to Support State, Tribal, Local and Territorial (STLT) Health Department Response to Public Health or Healthcare Crises Assistance Listing Number: 93.391 Federal Award Identification Number: See E-65 to E-66 Compliance Area: Procurement and suspension and debarment Type of Finding: Significant deficiency Questioned Costs: None Criteria: 2 CFR 200.303; 2 CFR 200.317; 5 MRSA 1825-B and D; Office of State Procurement Services (OSPS) policies The Department must establish, document, and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. The Department must follow the same policies and procedures it uses for procurements with non-Federal funds. Awards shall be made to the best-value bidder, taking into consideration the best interest of the State. The requirement to competitively bid a contract may be waived if specific criteria is met, including the item or service can only be procured from one source or it is an emergency procurement. Each bid, with the name of the bidder, must be entered on record. Each record, with the successful bid indicated, must be open to public inspection after the letting of the contract. The Department must justify the selection of vendor, either through competitive or non-competitive process, and provide a detailed explanation of cost, demonstrating how the best value for the State is ensured. The Chief Procurement Officer shall make the public aware of contracts and grants for which bids are being requested and communicate the procedure used in reviewing bids. Contracts must be submitted to OSPS at least 14 days prior to the contract start date. A Notice of Intent to Waive the Competitive Bidding Process (NOI) must be posted to the OSPS website for 7 calendar days prior to the start of a noncompetitively bid contract. Condition: The Activities to Support State, Tribal, Local and Territorial (STLT) Health Department Response to Public Health or Healthcare Crises (Health Disparities) program was implemented to address disparities in access to healthcare in populations that are at high-risk and underserved, including racial and ethnic minority groups and people living in rural communities. The Health Disparities program is administered by the Maine Center for Disease Control & Prevention’s (MeCDC) Division of Population Health Equity. OSPS is the central oversight agency for all State procurement. The Department of Health and Human Services (DHHS) Division of Contract Management (DCM) oversees the solicitation and contract implementation for all DHHS procurement. DCM coordinates with DHHS program personnel to evaluate and select vendors and subrecipients, determine contract terms, and provide required documentation to OSPS. OSPS is responsible for reviewing and approving Procurement Justification Forms (PJFs) submitted by DCM on behalf of program personnel prior to the award of contracts. The PJF represents program personnel’s assertion that the selected procurement method is appropriate under applicable State and Federal requirements, and that required evaluation procedures have been performed. OSPS must publicly post a NOI for all procurements over $10,000 entered into without a competitive process for a minimum of 7 days prior to the start of the contract. The NOI includes the signed PJF provided to OSPS by DCM. OSA tested 30 contracts, 21 procured competitively and 9 procured noncompetitively, that accounted for approximately $4.5 million of the $6.2 million in Health Disparities program procurement-related transactions in fiscal year 2025 and found: • PJFs were reviewed for reasonableness by DCM and OSPS, but DHHS could not provide documentation to support the assertions made by MeCDC were accurate. • For 27 contracts, DCM provided the PJF to OSPS for their review after the contract had commenced, between 1 and 131 days after the contract start date. For all 30 contracts, OSPS approved the PJF after the contract commenced, between 5 and 169 days after the contract start date. • For all 9 noncompetitive contracts, OSPS posted the NOI after contract performance had commenced, between 24 and 171 days after the contract start date. For 7 of these contracts, services had been initiated and financial obligations incurred prior to the NOI. OSA utilized a risk-based approach to select 21 contracts issued by MeCDC and a non-statistical random sample of all other contracts. Context: In fiscal year 2025, the Department expended $6.2 million in procurement-related transactions from Health Disparities program funds of $6.7 million. Cause: • Lack of adequate policies and procedures • Lack of supervisory oversight Effect: • Potential questioned costs and future disallowances • Noncompliance with Federal and State procurement requirements, including NOI posting requirements, could result in the need to void a contract or exposure to legal proceedings. Recommendation: We recommend that OSPS: • increase agency awareness of the procedures related to the timing of procurement contract documentation being submitted to OSPS for review prior to the contract start date; and • finalize and implement an updated procurement policy and procedure manual that identifies the parties responsible for key aspects of the procurement process. We also recommend that DCM and MeCDC develop policies and procedures and increase oversight to ensure all procurement transactions comply with Federal and State requirements, including: • DCM obtaining and reviewing documentation to support the assertions made by MeCDC for accuracy and reasonableness; and • ensuring PJFs are completed, reviewed, and submitted to OSPS prior to the contract start date. Corrective Action Plan: See F-20 Management’s Response: DAFS Response: The Department agrees with this finding. OSPS does not authorize, encourage, or approve agencies allowing vendors to perform work at risk. However, OSPS also does not delay review and approval solely due to contract start-date issues, as doing so would increase the State’s risk exposure, potentially disrupt federally required programs, and hinder agencies’ compliance with federal period-of-performance requirements. To address these concerns, OSPS will formalize and issue policy guidance that clearly defines agency and OSPS roles and responsibilities in the contracting process. This guidance will expand the agency-focused section to emphasize timely submission and processing, along with the risks and implications associated with contracting delays. In advance of fiscal year-end, OSPS will issue a separate policy document and companion guidance as a spotlight topic in the monthly newsletter and posted to the intranet for agency reference. DAFS Contact: David Morris, Acting Chief Procurement Officer, OSPS, 207-624-7335 DHHS Response: The Department partially agrees with this finding. There is not a requirement to provide documentation that the Department personnel’s assertions are accurate regarding Department personnel’s review of PJFs. The Department agrees that it can improve the timing of procurement documents in relation to the start dates of the contracts. Extenuating circumstances exist periodically that prevent the timeliness of these documents. In some cases, there are delays in the grant approval at the Federal level. Delays in Legislative approval of budgets can also lead to procurement documentation delays. DHHS Contact: Jim Lopatosky, Director, Division of Contract Management, DHHS, 207-287-5075 Auditor’s Concluding Remarks: 2 CFR 200.303 requires the Department to establish, document, and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. Absent adequate documentation to support the veracity of the assertions made on the PJF by program personnel, the best value for the State cannot be ensured. The finding remains as stated. (State Number: 25-1123-06)

(2025-036) Title: Internal control over PDG subrecipient monitoring procedures needs improvement Prior Year Findings: None State Department: Health and Human Services Education State Bureau: Office of Child and Family Services Office of Teaching and Learning Federal Agency: U.S. Department of Health and Human Services Assistance Listing Title: Every Student Succeeds Act/Preschool Development Grants Assistance Listing Number: 93.434 Federal Award Identification Number: See E-65 to E-66 Compliance Area: Allowable costs/cost principles Subrecipient monitoring Type of Finding: Material weakness Material noncompliance Questioned costs Known Questioned Costs: $128,333 Likely Questioned Costs: Undeterminable; the Office of the State Auditor (OSA) selected a sample of subrecipients who received program funds during fiscal year 2025 and identified known questioned costs associated with 1 of those subrecipients based on various compliance attributes. Since circumstances are unique to each subrecipient, a projection of questioned costs cannot be reasonably estimated. Criteria: 2 CFR 200.303; 2 CFR 200.332 The Department must establish, document, and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. The Department must: • ensure that every subaward is clearly identified to the subrecipient as a subaward and includes specific information. • evaluate each subrecipient’s risk of noncompliance with Federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate subrecipient monitoring procedures. • monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. • ensure that the subrecipient takes corrective action on all Single Audit findings related to the subaward, other audit findings, site visits, and written notifications of adverse conditions which will impact the ability to meet milestones or the objectives of a subaward. Condition: The Every Student Succeeds Act/Preschool Development Grants (PDG) program assists states in helping low-income and disadvantaged children enter kindergarten prepared and ready to succeed in school and helps improve the transitions from the early care and education setting to elementary school. PDG is administered by the Department of Health and Human Services’ (DHHS) Office of Child and Family Services (OCFS). DHHS has a memorandum of understanding in place with the Department of Education (DOE) to assist in administering PDG. OSA tested 2 contracts issued by OCFS and 2 contracts issued by DOE for compliance with: • award identification requirements, and found: o 2 contracts issued by OCFS did not include the Federal award identification number or the grant award number; and o 2 contracts issued by DOE did not include the Federal award identification number, the Federal award date, the assistance listing title and number, the name of Federal agency, the assistance listing title and number, identification of whether the Federal award is for research and development, or the indirect cost rate for the Federal award. • subrecipient risk evaluation procedures, and found through inquiry of program personnel at OCFS and DOE that policies and procedures were not in place to ensure risk assessments were performed or used to determine subrecipient monitoring activities. As a result, subrecipient monitoring activities were the same for all subrecipients/contracts regardless of risk. • subrecipient monitoring requirements, and found that OCFS did not identify an appropriate level of monitoring for 1 contract. Evidence of significant developments, including inability to meet performance goals, that impacted the subrecipient’s ability to meet the objectives of the subaward were present prior to quarterly reporting. OSA determined that payments made to this subrecipient for the aforementioned monitoring deficiencies were not allowable based upon subsequent financial reports and the results of other monitoring procedures performed during the fiscal year. Payments to the subrecipient were withheld after April 2025. OSA has questioned the full amount of program expenditures paid to this subrecipient during the fiscal year, totaling $128,333. OSA selected a non-statistical random sample of all PDG subrecipient contracts. Context: In fiscal year 2025, PDG expenditures totaled $11.5 million, of which approximately $910,000 was paid to OCFS subrecipients and $709,000 was paid to DOE subrecipients. Cause: • Lack of adequate policies and procedures • Lack of supervisory oversight Effect: • Noncompliance with Federal regulations • Subrecipients that are deemed higher risk may not be monitored on a more frequent basis. Conversely, subrecipients that are deemed lower risk may not be monitored on a less frequent basis, which would free resources and time to dedicate towards other higher risk subrecipients. • Noncompliance with the Federal statutes, regulations, and the terms and conditions of the subaward by subrecipients may go undetected. • Payments may be issued in error to subrecipients not in compliance with Federal statutes, regulations, and the terms and conditions of the subaward. • Known questioned costs • Potential future questioned costs and disallowances Recommendation: We recommend that the Department enhance oversight and implement policies and procedures to ensure that: • all required information is included in contracts and contract amendments; • an evaluation of each subrecipient’s risk of noncompliance specifically for the purpose of determining the appropriate subrecipient monitoring is performed; and • all required subrecipient monitoring activities are performed. Corrective Action Plan: See F-21 Management’s Response: The Departments partially agree with this finding. DHHS agrees that two contracts did not include the Federal award identification number or the grant award number. DOE agrees that two contracts did not include the Federal award identification number, the Federal award date, the assistance listing title and number, the indirect cost rate for the Federal award, name of Federal agency, assistance listing title and number, identification of whether the Federal award is for research and development, and the indirect cost rate for the federal award. The Departments disagree that subrecipient risk evaluation policies and procedures were not in place to ensure risk assessments were performed or used to determine subrecipient monitoring activities. DOE utilizes a risk assessment tool when developing monitoring of invoices associated with subrecipients. Contact: Tara Williams, Associate Director of Early Care & Education, OCFS, DHHS, 207-557-2342 Auditor’s Concluding Remarks: 2 CFR 200.332(b) states that the Department must evaluate each subrecipient’s risk of noncompliance with Federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate subrecipient monitoring. DHHS’ existing policies and procedures do not require nor provide support for the evaluation of each subrecipient’s risk of noncompliance specifically for the purpose of determining the appropriate subrecipient monitoring to be performed. Furthermore, as noted in the Condition, OSA found that DHHS did not identify an appropriate level of monitoring for 1 contract. If DHHS had adequate controls in place over subrecipient risk evaluation requirements, appropriate subrecipient monitoring procedures would have been developed and performed in response to the subrecipient’s inability to meet the objectives of the subaward, including withholding payments to the subrecipient sooner. Additionally, the risk assessment tool that DOE refers to in Management’s Response only determines the frequency of invoicing (monthly or quarterly) and does not determine the level of subrecipient monitoring needed based on the subrecipient’s risk. The finding remains as stated. (State Number: 25-1122-04)

(2025-037) Title: Internal control over PDG SEFA reporting needs improvement Prior Year Findings: None State Department: Health and Human Services Education Administrative and Financial Services State Bureau: Office of Child and Family Services Office of Teaching and Learning Health and Human Services Service Center Federal Agency: U.S. Department of Health and Human Services Assistance Listing Title: Every Student Succeeds Act/Preschool Development Grants Assistance Listing Number: 93.434 Federal Award Identification Number: See E-65 to E-66 Compliance Area: Reporting Type of Finding: Material weakness Material noncompliance Questioned Costs: None Criteria: 2 CFR.303; 2 CFR 200.510 The Department must establish, document, and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. The Department must prepare a Schedule of Expenditures of Federal Awards (SEFA) for the period covered by the State’s financial statements which must include the total Federal awards expended. At a minimum, the SEFA must provide total Federal awards expended for each individual Federal program and the Assistance Listing Number and include the total amount provided to subrecipients from each Federal program. Condition: The Every Student Succeeds Act/Preschool Development Grants (PDG) program assists states in helping low-income and disadvantaged children enter kindergarten prepared and ready to succeed in school, and helps improve the transitions from the early care and education setting to elementary school. PDG is administered by the Department of Health and Human Services’ (DHHS) Office of Child and Family Services. DHHS has a memorandum of understanding in place with the Department of Education (DOE) to assist in administering PDG. The DHHS Service Center (SC) and DOE must complete and submit exhibits and related schedules to the Office of the State Controller (OSC) at the close of each fiscal year to report Federal award information for inclusion on the State’s SEFA. OSC is responsible for compiling this information on behalf of the State. The Office of the State Auditor (OSA) reviewed amounts reported on the SEFA for PDG and identified both DHHS SC and DOE incorrectly reported direct expenditures and amounts provided to subrecipients. As a result, the initial amount reported on the SEFA was overstated by $2.6 million. In addition, OSA identified $436,074 incorrectly reported as amounts provided to subrecipients that should have been reported as direct expenditures for the program. OSC subsequently corrected the SEFA for all errors identified by OSA. Context: In fiscal year 2025, PDG expenditures totaled $11.5 million. Cause: • Lack of supervisory oversight • Lack of adequate policies and procedures Effect: • Inaccurate reporting of expenditure amounts on the SEFA, which are submitted to the Federal government, may result in incorrect information used for programmatic, policy, or statistical purposes. • Noncompliance with Federal regulations Recommendation: We recommend that the Departments increase oversight and implement policies and procedures to ensure expenditures are appropriately classified and reported on the SEFA. Corrective Action Plan: See F-21 Management’s Response: The DHHS, the DOE and the DHHS Financial Service Center agree with this finding. The Departments will update policies and procedures to ensure expenditures are appropriately reported on the SEFA. Contact: Sarah Gove, Director, DHHS Service Center, DAFS, 207-458-6626 (State Number: 25-1122-01)

(2025-038) Title: Internal control over PDG special reporting needs improvement Prior Year Findings: None State Department: Education State Bureau: Office of Teaching and Learning Federal Agency: U.S. Department of Health and Human Services Assistance Listing Title: Every Student Succeeds Act/Preschool Development Grants Assistance Listing Number: 93.434 Federal Award Identification Number: See E-65 to E-66 Compliance Area: Reporting Type of Finding: Material weakness Material noncompliance Questioned Costs: None Criteria: 2 CFR.303; 2 CFR 170 The Department must establish, document, and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. Agencies must report each subaward that equals or exceeds the first-tier subaward threshold of $30,000 in Federal funds in the public-facing Federal Funding Accountability and Transparency Act (FFATA) System for Award Management (SAM). Condition: The Every Student Succeeds Act/Preschool Development Grants’ (PDG) program assists states in helping low-income and disadvantaged children enter kindergarten prepared and ready to succeed in school and helps improve the transitions from the early care and education setting to elementary school. PDG is administered by the Department of Health and Human Services’ (DHHS) Office of Child and Family Services. DHHS has a memorandum of understanding in place with the Department of Education (DOE) to assist in administering PDG. When an amount exceeding the first-tier subaward threshold is awarded to a DOE subrecipient, DOE must collect and enter data into SAM. DOE inaccurately identified subrecipients as vendors within the State’s accounting system; as a result, they were excluded from FFATA reporting. In fiscal year 2025, DOE did not report any of its first-tier subawards for PDG. Federal regulations require the following information for identified noncompliance to be included in FFATA findings. 10 subawards totaling $1,419,855: • were not reported; • were not reported timely; • had no reported subaward amount; and • had no key data elements reported. Context: In fiscal year 2025, DOE was required to report 10 first-tier subawards totaling $1,419,855 under PDG. DOE provided approximately $709,000 from a total of $11.5 million to PDG program subrecipients during fiscal year 2025. Cause: • Lack of supervisory oversight • Lack of adequate policies and procedures Effect: • Noncompliance with Federal regulations • DOE first-tier subaward information for PDG was not reported to the Federal government. This information may be used for programmatic, policy, or statistical purposes. Recommendation: We recommend that DOE: • implement policies and continue to ensure that subrecipients are appropriately classified and reported; and • increase oversight to ensure that first-tier subawards are reported accurately, timely, and in accordance with Federal regulations. Corrective Action Plan: See F-22 Management’s Response: The Department agrees with this finding. The passthrough subawards, previously omitted from monthly FFATA reporting, have now been reported in SAM.gov. The department's FFATA review procedure has been updated to include supervisory review to confirm that passthrough subawards are included in monthly reporting moving forward. Contact: Nicole Denis, Director of Finance, DOE, 207-530-2161 (State Number: 25-1122-02)

(2025-039) Title: Internal control over PDG procurement needs improvement Prior Year Findings: None State Department: Administrative and Financial Services Health and Human Services State Bureau: Office of State Procurement Services Division of Contract Management Office of Child and Family Services Federal Agency: U.S. Department of Health and Human Services Assistance Listing Title: Every Student Succeeds Act/Preschool Development Grants Assistance Listing Number: 93.434 Federal Award Identification Number: See E-65 to E-66 Compliance Area: Procurement and suspension and debarment Type of Finding: Significant deficiency Questioned Costs: None Criteria: 2 CFR 200.303; 2 CFR 200.317; 5 MRSA 1825-B and D; Office of State Procurement Services (OSPS) policies The Department must establish, document, and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. The Department must follow the same policies and procedures it uses for procurements with non-Federal funds. Awards shall be made to the best-value bidder, taking into consideration the best interest of the State. The requirement to competitively bid a contract may be waived if specific criteria is met, including the item or service can only be procured from one source or it is an emergency procurement. Each bid, with the name of the bidder, must be entered on record. Each record, with the successful bid indicated, must be open to public inspection after the letting of the contract. The Department must justify the selection of vendor, either through competitive or noncompetitive process, and provide a detailed explanation of cost, demonstrating how the best value for the State is ensured. The Chief Procurement Officer shall make the public aware of contracts and grants for which bids are being requested and communicate the procedure used in reviewing bids. Contracts must be submitted to OSPS at least 14 days prior to the contract start date. A Notice of Intent to Waive the Competitive Bidding Process (NOI) must be posted to the OSPS website for 7 calendar days prior to the start of a non-competitively bid contract. Condition: The Every Student Succeeds Act/Preschool Development Grants (PDG) program assists states in helping low-income and disadvantaged children enter kindergarten prepared and ready to succeed in school and helps improve the transitions from the early care and education setting to elementary school. PDG is administered by the Office of Child and Family Services (OCFS). OSPS is the central oversight agency for all State procurement. The Department of Health and Human Services (DHHS) Division of Contract Management (DCM) oversees the solicitation and contract implementation for all DHHS procurement. DCM coordinates with DHHS program personnel to evaluate and select vendors and subrecipients, determine contract terms, and provide required documentation to OSPS. OSPS is responsible for reviewing and approving Procurement Justification Forms (PJFs) submitted by DCM on behalf of program personnel prior to the award of contracts. The PJF represents program personnel’s assertion that the selected procurement method is appropriate under applicable State and Federal requirements, and that required evaluation procedures have been performed. OSPS must publicly post a NOI for all procurements over $10,000 entered into without a competitive process for a minimum of 7 calendar days prior to the start of the contract. The NOI includes the signed PJF provided to OSPS by DCM. The Office of the State Auditor (OSA) tested 10 OCFS contracts, 4 procured competitively and 6 procured noncompetitively, that accounted for $5.6 million of the $6.5 million in OCFS PDG procurement-related transactions in fiscal year 2025 and found: • PJFs were reviewed for reasonableness by DCM and OSPS, but DHHS could not provide documentation to support the assertions made by OCFS were accurate. • For 6 contracts, DCM provided the PJF to OSPS for their review after the contract had commenced, between 16 and 192 days after the contract start date. For 8 contracts, OSPS approved the PJF after the contract commenced, between 18 and 214 days after the contract start date. For 1 contract, documentary evidence of PJF approval by OSPS could not be provided. • For 4 noncompetitive contracts, OSPS posted the NOI after contract performance had commenced, between 38 and 214 days after the contract start date. Additionally, for 1 noncompetitive contract, services had been initiated and financial obligations incurred and a NOI was not posted to the OSPS webstie. OSA utilized a risk-based approach to select 5 contracts issued by OCFS and a non-statistical random sample of all other contracts. Context: In fiscal year 2025, the Department expended $6.5 million in OCFS procurement-related transactions from PDG funds of $11.5 million. Cause: • Lack of adequate policies and procedures • Lack of supervisory oversight Effect: • Potential questioned costs and future disallowances • Noncompliance with Federal and State procurement requirements, including NOI posting requirements, could result in the need to void a contract or exposure to legal proceedings. Recommendation: We recommend that OSPS: • increase agency awareness of the procedures related to the timing of procurement contract documentation being submitted to OSPS for review prior to the contract start date; and • finalize and implement an updated procurement policy and procedure manual that identifies the parties responsible for key aspects of the procurement process. We also recommend that DCM and OCFS develop policies and procedures and increase oversight to ensure all procurement transactions comply with Federal and State requirements, including: • DCM obtaining and reviewing documentation to support the assertions made by OCFS for accuracy and reasonableness; and • ensuring PJFs are completed, reviewed, and submitted to OSPS prior to the contract start date. Corrective Action Plan: See F-22 Management’s Response: DAFS Response: The Department agrees with this finding. OSPS does not authorize, encourage, or approve agencies allowing vendors to perform work at risk. However, OSPS also does not delay review and approval solely due to contract start-date issues, as doing so would increase the State’s risk exposure, potentially disrupt federally required programs, and hinder agencies’ compliance with federal period-of-performance requirements. To address these concerns, OSPS will formalize and issue policy guidance that clearly defines agency and OSPS roles and responsibilities in the contracting process. This guidance will expand the agency-focused section to emphasize timely submission and processing, along with the risks and implications associated with contracting delays. In advance of fiscal year-end, OSPS will issue a separate policy document and companion guidance as a spotlight topic in the monthly newsletter and posted to the intranet for agency reference. DAFS Contact: David Morris, Acting Chief Procurement Officer, OSPS, 207-624-7335 DHHS Response: The Department partially agrees with this finding. There is not a requirement to provide documentation that the Department personnel’s assertions are accurate regarding Department personnel’s review of PJFs. The Department agrees that it can improve the timing of procurement documents in relation to the start dates of the contracts. Extenuating circumstances exist periodically that prevent the timeliness of these documents. In some cases, there are delays in the grant approval at the Federal level. Delays in Legislative approval of budgets can also lead to procurement documentation delays. DHHS Contact: Jim Lopatosky, Director, Division of Contract Management, DHHS, 207-287-5075 Auditor’s Concluding Remarks: 2 CFR 200.303 requires the Department to establish, document, and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. Absent adequate documentation to support the veracity of the assertions made on the PJF by program personnel, the best value for the State cannot be ensured. The finding remains as stated. (State Number: 25-1122-05)

(2025-040) Title: Internal control over PDG subrecipient cash management needs improvement Prior Year Findings: None State Department: Health and Human Services State Bureau: Office of Child and Family Services Federal Agency: U.S. Department of Health and Human Services Assistance Listing Title: Every Student Succeeds Act/Preschool Development Grants Assistance Listing Number: 93.434 Federal Award Identification Number: See E-65 to E-66 Compliance Area: Cash management Subrecipient monitoring Type of Finding: Significant deficiency Questioned Costs: None Criteria: 2 CFR 200.303; 2 CFR 200.305 The Department must establish, document, and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. The Department is required to monitor cash drawdowns by their subrecipients to ensure that the time elapsing between the payment of Federal funds to the subrecipient and the subrecipient’s actual disbursement for program purposes is minimized. Condition: The Every Student Succeeds Act/Preschool Development Grants (PDG) program assists states in helping low-income and disadvantaged children enter kindergarten prepared and ready to succeed in school and helps improve the transitions from the early care and education setting to elementary school. PDG is administered by the Department of Health and Human Services’ Office of Child and Family Services (OCFS). The Department makes equal advance monthly payments to subrecipients and then reconciles those amounts to quarterly financial reports submitted by the subrecipient. This procedure does not take into consideration the time elapsing between the payment of Federal funds to the subrecipient and the subrecipient’s actual disbursement for program purposes, and OCFS’ subrecipient monitoring procedures do not include review of subrecipient compliance with cash management requirements. As a result, OCFS procedures do not support that subrecipient cash management is properly monitored as required by Federal regulations. Context: OCFS provided approximately $910,000 from a total of $11.5 million to PDG program subrecipients during fiscal year 2025. Cause: • Lack of adequate subrecipient monitoring procedures • Lack of centralized oversight of subrecipient monitoring Effect: • Noncompliance with Federal regulations • Federal programs may not be effectively and efficiently administered. • The Federal government may require the implementation of more stringent subrecipient cash management procedures. Recommendation: We recommend that OCFS implement monitoring procedures over subrecipient cash management requirements to ensure that the time elapsing between the payment of Federal funds to the subrecipient and the subrecipient’s actual disbursement for program purposes is minimized for the PDG program. Corrective Action Plan: See F-22 Management’s Response: The Department disagrees with this finding. The Department is in compliance with the requirement for minimizing the time between payments to our subrecipients and the disbursement of the funds. Payments are made as close as is administratively feasible. The Compliance Supplement suggested audit procedures for Cash Management for pass-through entities refers to 200.305(b)(1) ...that same paragraph states that the timing and amount of advance payments must be as close as is administratively feasible. Contact: Tara Williams, Associate Director of Early Care & Education, OCFS, DHHS, 207-557-2342 Auditor’s Concluding Remarks: The Department’s interpretation of the applicable Federal regulation emphasizes a single sentence from the broader paragraph, omitting context that informs the regulation’s full intent. According to the 2025 Compliance Supplement, pass-through entities must monitor cash drawdowns by their subrecipients to ensure that the time elapsing between the transfer of Federal funds to the subrecipient and their disbursement for program purposes is minimized as required by the applicable cash management requirements in the Federal award to the recipient (2 CFR 200.305(b)(1)). 2 CFR 200.305(b)(1) states that the recipient or subrecipient must be paid in advance, provided it maintains or demonstrates the willingness to maintain both written procedures that minimize the time elapsing between the transfer of funds and disbursement by the recipient or subrecipient, and financial management systems that meet the standards for fund control and accountability as established in this part. Advance payments to a recipient or subrecipient must be limited to the minimum amounts needed and be timed with actual, immediate cash requirements of the recipient or subrecipient in carrying out the purpose of the approved program or project. The timing and amount of advance payments must be as close as is administratively feasible to the actual disbursements by the recipient or subrecipient for direct program or project costs and the proportionate share of any allowable indirect costs. The recipient or subrecipient must make timely payments to contractors in accordance with the contract provisions. The Department references the phrase “as close as is administratively feasible” to justify their current process; however, this phrase is part of a broader requirement that establishes specific conditions for advance payments. The regulation requires that the timing between when the subrecipient receives Federal funds from the State and when the subrecipient disburses those funds is closely monitored to ensure that disbursements align with actual, immediate cash needs. The Department could not provide evidence to demonstrate that they adequately monitored subrecipient cash drawdowns to ensure alignment with actual, immediate cash needs. Furthermore, in finding 2025-036, Internal control over PDG subrecipient monitoring procedures needs improvement, the Office of the State Auditor identified that 1 PDG subrecipient received equal advance monthly payments that significantly outpaced the subrecipient’s spending of PDG funds throughout fiscal year 2025. Payments to the subrecipient were withheld after April 2025 for the subrecipient’s inability to meet performance goals, not due to the Department’s monitoring of subrecipient cash management, and OCFS allowed the subrecipient to retain the excess PDG funds. This exception corroborates that controls are not in place over subrecipient cash management. The finding remains as stated. (State Number: 25-1122-03)

(2025-041) Title: Internal control over TANF client payments needs improvement Prior Year Findings: See Schedule of Findings and Questioned Costs for chart/table State Department: Health and Human Services State Bureau: Office for Family Independence Federal Agency: U.S. Department of Health and Human Services Assistance Listing Title: Temporary Assistance for Needy Families (TANF) Assistance Listing Number: 93.558 Federal Award Identification Number: See E-65 to E-66 Compliance Area: Activities allowed or unallowed Allowable costs/cost principles Type of Finding: Significant deficiency Questioned Costs: None Criteria: 2 CFR 200.303; 2 CFR 200.403; 45 CFR 263.11 The Department must establish, document, and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. To be allowable under Federal awards, costs must be necessary and reasonable for the performance of the Federal award and be adequately documented. The Department must use Federal Temporary Assistance for Needy Families (TANF) funds for expenditures that are reasonably calculated to accomplish the purposes of TANF. Use of funds in violation of this is considered misuse of funds. Condition: The TANF program provides time-limited assistance to needy families with children so that the children can be cared for in their own homes or in the homes of relatives; to end dependence of needy parents on government benefits by promoting job preparation, work, and marriage; to prevent out-of-wedlock pregnancies, including establishing prevention and reduction goals; and to encourage the formation and maintenance of two-parent families. The Department issues monthly cash benefits to TANF clients while they work towards self-sufficiency. The Department also issues TANF support service payments directly to TANF clients for various items and services, and to providers on behalf of TANF clients for services rendered such as childcare and transportation. The Office of the State Auditor (OSA) tested 60 cash benefits and 60 support service payments and found: • 1 cash benefit issued in March 2025 did not include all members of the household, resulting in an underpayment of $395. Upon further review, OSA found an additional $3,843 underpaid to the client during fiscal year 2025. • 2 support service payments issued for transportation were calculated by the Department using a distance other than the most direct route as required. The payments included: o one payment issued in November 2024 that overpaid a TANF client $3. Upon further review, OSA found an additional $15 overpaid to the client during fiscal year 2025. o one payment issued in September 2024 that underpaid a TANF client $3. Upon further review, OSA found an additional $11 underpaid to the client during fiscal year 2025. • 1 support service payment overpaid a childcare provider by $2. Upon further review, OSA found an additional $8 that was overpaid to the provider during fiscal year 2025. OSA selected non-statistical random samples. Context: In fiscal year 2025, $51.7 million from a total of $104.9 million was paid to TANF clients for services and direct cash benefits. Cause: • Lack of adequate procedures • Lack of supervisory oversight Effect: • Potential future questioned costs and disallowances • Noncompliance with Federal regulations Recommendation: We recommend that the Department: • implement additional procedures to ensure that payments made to TANF clients are accurate, allowable, and adequately documented; • increase monitoring procedures over these payments; • establish recoupments for the identified overpayments; and • issue benefits/payments to clients or providers for identified underpayments. Corrective Action Plan: See F-23 Management’s Response: The Department agrees with this finding. Actions have been taken to issue corrective payments for benefits that were underpaid and benefits that were overpaid have been referred for recoupment. The Corrective Action Plan will mitigate the agreed upon errors from reoccurring. Contact: Ian Yaffe, Director, Office for Family Independence, DHHS, 207-592-1481 (State Number: 25-1111-06)

(2025-042) Title: Internal control over Income Eligibility and Verification System procedures needs improvement Prior Year Findings: See Schedule of Findings and Questioned Costs for chart/table State Department: Health and Human Services State Bureau: Office for Family Independence Federal Agency: U.S. Department of Health and Human Services Assistance Listing Title: Temporary Assistance for Needy Families (TANF) Assistance Listing Number: 93.558 Federal Award Identification Number: See E-65 to E-66 Compliance Area: Special tests and provisions Type of Finding: Significant deficiency Questioned Costs: None Criteria: 2 CFR 200.303; 45 CFR 205.55 and .56 The Department must establish, document, and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. The Department is required to comply with Federal Income Eligibility and Verification System (IEVS) exchange rules and regulations in accordance with program agreements. The Department is required to request through IEVS: • wage information from the State Wage Information Collection Agency for all applicants at the first opportunity following receipt of the application and for all recipients on a quarterly basis; • unemployment compensation information from the agency administering the State’s unemployment compensation program; • all available information maintained by the Social Security Administration; • unearned income information from the Internal Revenue Service; and • any income or other information affecting eligibility available from agencies in the State or other states. The Department is required to resolve all discrepancies identified through IEVS reports within 45 days of receipt. Condition: IEVS is used to exchange information among State and Federal agencies to verify various information needed to determine eligibility for Federal financial assistance. This information is updated in the Automated Client Eligibility System (ACES) to ensure eligibility determinations are made based on current information. IEVS generates various discrepancy reports on a weekly, monthly, and quarterly basis. The Department is required to review reports and resolve all discrepancies identified through IEVS within 45 days of report receipt and document the resolution in ACES. The Department determined that the value of Quarterly Income Discrepancy Reports is limited because discrepancy information is available through other sources on a more frequent basis. As a result, the Department did not allocate resources to completing reviews of these quarterly reports during fiscal year 2025. Context: A total of 224 IEVS reports are required to be generated annually. Of the 224 reports generated, reviews for 4 quarterly reports were not completed during fiscal year 2025. The number of Temporary Assistance for Needy Families (TANF) discrepancies on each report can vary. Cause: Lack of resources Effect: • IEVS information may not be updated timely in ACES, which could affect program eligibility. • Failure to maintain documentation to support compliance with required TANF exchange rules may result in the U.S. Department of Health and Human Services penalizing the State up to 2 percent of the grant award. Recommendation: We recommend that the Department allocate resources to ensure that all reviews are completed and discrepancies identified through IEVS are resolved timely and documented in ACES. Corrective Action Plan: See F-23 Management’s Response: The Department agrees with this finding. The Corrective Action Plan from SFY 2024 included the dedication of staff resources to complete the review of the quarterly income discrepancy report effective for SFY 2026. Contact: Ian Yaffe, Director, Office for Family Independence, DHHS, 207-592-1481 (State Number: 25-1111-03)

(2025-043) Title: Internal control over TANF subrecipient risk evaluation procedures needs improvement Prior Year Findings: See Schedule of Findings and Questioned Costs for chart/table State Department: Health and Human Services State Bureau: Office for Family Independence Federal Agency: U.S. Department of Health and Human Services Assistance Listing Title: Temporary Assistance for Needy Families (TANF) Assistance Listing Number: 93.558 Federal Award Identification Number: See E-65 to E-66 Compliance Area: Subrecipient monitoring Type of Finding: Significant deficiency Questioned Costs: None Criteria: 2 CFR 200.303; 2 CFR 200.332 The Department must establish, document, and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. The Department is required to evaluate each subrecipient’s risk of noncompliance with Federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate subrecipient monitoring described in 2 CFR 200.332. Condition: The Department is required to evaluate each subrecipient’s risk of noncompliance with Federal regulations for the purpose of determining the appropriate level of subrecipient monitoring to be performed. Subrecipient monitoring activities include, but are not limited to, review of financial and performance reports submitted by the subrecipient, periodic site visits, ensuring required audits of the subrecipient are completed, and ensuring that corrective action is taken for any deficiencies identified through the aforementioned procedures. These procedures are necessary to ensure the subrecipient is in compliance with Federal statutes, regulations, and the terms and conditions of the subaward. The Department provided evidence to support that subrecipient monitoring procedures were performed; however, documentation that risk evaluation procedures performed corresponded to the appropriate level of monitoring activities could not be provided. Context: The Department provided $35.0 million from a total of $104.9 million to TANF subrecipients during fiscal year 2025. Cause: • Lack of policies and procedures • Lack of supervisory oversight Effect: • Noncompliance with Federal regulations • Subrecipients that are deemed higher risk may not be monitored on a more frequent basis. Conversely, subrecipients that are deemed lower risk may not be monitored on a less frequent basis, which would free resources and time to dedicate towards other higher risk subrecipients. Recommendation: We recommend that the Department implement policies and procedures that require evaluation of each subrecipient’s risk of noncompliance specifically for the purposes of determining the appropriate subrecipient monitoring to be performed. This will ensure subrecipients are monitored appropriately based on risk designation. Corrective Action Plan: See F-23 Management’s Response: The Department disagrees with this finding. The Department evaluates risk on its subrecipients for the purposes of determining the appropriate subrecipient monitoring in multiple ways. The first assessment of risk is when a subaward is competitively bid. The second assessment of risk is built into the Maine Uniform Accounting and Auditing Practices for Community Agencies (MAAP) in which higher risk subrecipients undergo a higher level of testing by Independent Public Accountants. Finally, the Social Service Unit of the Division of Audit performs a risk assessment and tests transactions for those subrecipients that have been determined to be higher risk. Contact: Ian Yaffe, Director, Office for Family Independence, DHHS, 207-592-1481 Auditor’s Concluding Remarks: 2 CFR 200.332(b) states that the Department must evaluate each subrecipient’s risk of noncompliance with Federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate subrecipient monitoring. The Department has indicated in Management’s Response that the criteria set forth in 2 CFR 200.332(b) have been met; however, the following rebuttals illustrate that the Department is not in compliance with Federal requirements: • The Department identifies the first assessment of risk: when a subaward is competitively bid. o While OSA acknowledges this does occur, not all subawards are competitively bid. o The level of subrecipient monitoring that the Department performs is based on the services provided, not on specific subrecipients, as required. • The Department identifies the second assessment of risk: built into MAAP in which higher risk subrecipients undergo a higher level of testing by independent public accountants. o A subrecipient deemed higher risk as the result of a risk evaluation in accordance with 2 CFR 200.332 may not be deemed higher risk in accordance with MAAP standards. • The Department identifies the third assessment of risk: the Social Service Unit of the Division of Audit performs a risk assessment and tests transactions for those subrecipients that have been determined to be higher risk. o The Department did not provide documentation to demonstrate that these procedures are performed as a result of a risk evaluation. The Department’s existing policies and procedures do not require nor provide support for the evaluation of each subrecipient’s risk of noncompliance specifically for the purpose of determining the appropriate subrecipient monitoring to be performed. The finding remains as stated. (State Number: 25-1111-02)

(2025-044) Title: Internal control over TANF performance reporting procedures needs improvement Prior Year Findings: See Schedule of Findings and Questioned Costs for chart/table State Department: Health and Human Services State Bureau: Office for Family Independence Federal Agency: U.S. Department of Health and Human Services Assistance Listing Title: Temporary Assistance for Needy Families (TANF) Assistance Listing Number: 93.558 Federal Award Identification Number: See E-65 to E-66 Compliance Area: Reporting Type of Finding: Significant deficiency Questioned Costs: None Criteria: 2 CFR 200.303; 45 CFR 261.60 through .62; 45 CFR 265.7 and .8 The Department must establish, document, and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. The Department must maintain adequate documentation, perform adequate verification, and implement other control procedures for Temporary Assistance for Needy Families (TANF) client work participation. Work participation activities include unsubsidized employment, job search and job readiness, job skills training directly related to employment, vocational education, and other work-related programs. The Department must report the actual hours that a work-eligible TANF client participates in these work-related activities, on the ACF-199 TANF Data Report on a quarterly basis. These reports are required by the Federal government. Condition: The Department must maintain adequate documentation, verification, and internal control procedures to ensure the accuracy of information reported to the Federal government and used to calculate work participation rates. The Department utilizes a vendor for case management services and development of individualized training and employment plans for Additional Support for People in Retraining and Employment (ASPIRE) clients. These services directly impact and enforce client work participation requirements. Vendor data is exchanged with the Department on a monthly basis and is utilized in conjunction with client data in the Automated Client Eligibility System to comprise client work participation data that is reported on the ACF-199 report to the Federal government. The Department reported incorrect work participation information on the ACF-199 report. Of the 30 clients tested by the Office of the State Auditor (OSA), 23 inaccurate work participation data elements were reported for 19 clients, including inaccurate: • parent with minor child status for 13 cases; • unsubsidized employment hours for 4 cases; • countable months towards the Federal time limit of 60 months for 3 cases; • relationship to head of household status for 1 case; • community service program hours for 1 case; and • education related to employment with no high school diploma indicator for 1 case. OSA selected a non-statistical random sample. Context: In fiscal year 2025, the number of families reported on the ACF-199 report ranged from 11,000 to 12,000 per quarter. Cause: • Lack of adequate procedures to ensure accurate reporting • Lack of supervisory oversight Effect: Inaccurate work participation data reported to the Federal government may affect the Federal requirement for TANF’s State Maintenance of Effort. Recommendation: We recommend that the Department enhance existing procedures to ensure that the information reported on the ACF-199 report is accurate and complete prior to submission to the Federal government. Corrective Action Plan: See F-24 Management’s Response: The Department agrees with this finding. The Corrective Action Plan will mitigate the agreed upon errors from reoccurring. Contact: Ian Yaffe, Director, Office for Family Independence, DHHS, 207-592-1481 (State Number: 25-1111-04)

(2025-045) Title: Internal control over TANF work verification plan procedures needs improvement Prior Year Findings: See Schedule of Findings and Questioned Costs for chart/table State Department: Health and Human Services State Bureau: Office for Family Independence Federal Agency: U.S. Department of Health and Human Services Assistance Listing Title: Temporary Assistance for Needy Families (TANF) Assistance Listing Number: 93.558 Federal Award Identification Number: See E-65 to E-66 Compliance Area: Special tests and provisions Type of Finding: Significant deficiency Questioned Costs: None Criteria: 2 CFR 200.303; 45 CFR 261.60 through .65; Work Verification Plan for the State of Maine The Department must establish, document, and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. The Department must maintain adequate documentation, perform adequate verification, and implement other control procedures for Temporary Assistance for Needy Families (TANF) client work participation. Work participation activities include unsubsidized employment, job search and job readiness, job skills training directly related to employment, vocational education, and other work-related programs. The Work Verification Plan for the State of Maine requires Additional Support for People in Retraining and Employment (ASPIRE) supervisors to review a minimum of 5 random cases per regional office per month. ASPIRE Case Review Tool (ACRT) reviews are intended to validate all case data to include (but not limited to) work assessment, appropriateness of the individual work plan, work verification data consistency, documentation, and work plan outcomes. Accuracy of all aspects of the individual cases is assessed as part of these reviews, including participation activity/hours documentation. Condition: The ASPIRE program helps TANF recipients move towards financial independence through case management, job training, education, support, and employment services. The Department contracts with a subrecipient service provider to perform outreach and case management services for the ASPIRE program. ASPIRE supervisors perform ACRT reviews of client case activity recorded by its subrecipient service provider to ensure that all case data including, but not limited to, work participation rate data is documented, verified, and reported in accordance with work verification plan requirements. The Office of the State Auditor (OSA) tested 40 ACRT reviews performed during fiscal year 2025 and found: • 2 reviews did not indicate the date the review was performed. As a result, OSA could not determine whether follow up was timely. • 2 reviews did not document activities and verification of activities to support compliance with work verification activities. • 3 reviews did not follow up with the subrecipient service provider timely. Follow-up meetings took place between 3 and 8 months after the initial review. • one review did not ensure the subrecipient service provider addressed all actionable items. OSA selected a non-statistical random sample. Additionally, the Department did not adhere to the Work Verification Plan’s requirement to review a minimum of 5 random cases per regional office per month; instead, ACRT reviews were performed based on each regional office’s caseload. Furthermore, ACRT reviews were not performed for the months of December 2024 and January 2025, and only 33 of the 65 required monthly ACRT reviews were performed for February 2025. Finally, a component of work verification plan requirements states that work participation data is required to be accurately reported on the ACF-199 TANF Data Report to the Federal government. OSA identified a significant deficiency as issued in finding 2025-044 for inaccurate work participation data reported on the ACF-199 report. Therefore, since work participation rate data was not documented, verified, or reported in accordance with the State’s work verification plan, the Department is not in compliance with Federal work verification plan requirements. Context: The Department must maintain adequate documentation, verification, and internal control procedures to ensure the accuracy of information reported to the Federal government and used to calculate work participation rates. Cause: • Lack of adequate oversight procedures to ensure that ACRT reviews are accurate and complete and work verification plan requirements are met • Revisions to the method of selecting cases for review from 5 random cases per regional office per month to an allocation based on each regional office’s caseload were not incorporated into the Work Verification Plan. • The subrecipient service provider contract was renegotiated during fiscal year 2025, which resulted in revisions to the ACRT and a pause on ACRT reviews. Effect: The Federal government may penalize the State by an amount not less than 1 percent and not more than 5 percent of the grant award for violation of work verification plan requirements. Recommendation: We recommend that the Department enhance existing procedures and oversight to ensure that work verification plan requirements are met. This should include: • confirming that ACRT reviews are performed accurately and completely, which will ensure the reliability of client data used to calculate work participation rates reported to the Federal government; and • updating the Work Verification Plan to accurately reflect the ACRT case review selection criteria as deemed necessary. Corrective Action Plan: See F-24 Management’s Response: The Department agrees with this finding. The Department agrees with the exceptions identified as a result of a non-statistical random sample. The Corrective Action Plan will mitigate the agreed upon errors from reoccurring. Contact: Ian Yaffe, Director, Office for Family Independence, DHHS, 207-592-1481 (State Number: 25-1111-01)

(2025-046) Title: Internal control over TANF procurement needs improvement Prior Year Findings: None State Department: Administrative and Financial Services Health and Human Services State Bureau: Office of State Procurement Services Division of Contract Management Office for Family Independence Federal Agency: U.S. Department of Health and Human Services Assistance Listing Title: Temporary Assistance for Needy Families (TANF) Assistance Listing Number: 93.558 Federal Award Identification Number: See E-65 to E-66 Compliance Area: Procurement and suspension and debarment Type of Finding: Significant deficiency Questioned Costs: None Criteria: 2 CFR 200.303; 2 CFR 200.317; 5 MRSA 1825-B and D; Office of State Procurement Services (OSPS) policies The Department must establish, document, and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. The Department must follow the same policies and procedures it uses for procurements with non-Federal funds. Awards shall be made to the best-value bidder, taking into consideration the best interest of the State. The requirement to competitively bid a contract may be waived if specific criteria is met, including the item or service can only be procured from one source or it is an emergency procurement. Each bid, with the name of the bidder, must be entered on record. Each record, with the successful bid indicated, must be open to public inspection after the letting of the contract. The Department must justify the selection of vendor, either through competitive or noncompetitive process, and provide a detailed explanation of cost, demonstrating how the best value for the State is ensured. The Chief Procurement Officer shall make the public aware of contracts and grants for which bids are being requested and communicate the procedure used in reviewing bids. Contracts must be submitted to OSPS at least 14 days prior to the contract start date. A Notice of Intent to Waive the Competitive Bidding Process (NOI) must be posted to the OSPS website for 7 calendar days prior to the start of a noncompetitively bid contract. Condition: The Temporary Assistance for Needy Families (TANF) program was implemented to provide temporary cash assistance, job training, and support services to low-income families with children. The TANF program is administered by the Office for Family Independence (OFI). OSPS is the central oversight agency for all State procurement. The Department of Health and Human Services (DHHS) Division of Contract Management (DCM) oversees the solicitation and contract implementation for all DHHS procurement. DCM coordinates with DHHS program personnel to evaluate and select vendors and subrecipients, determine contract terms, and provide required documentation to OSPS. OSPS is responsible for reviewing and approving Procurement Justification Forms (PJFs) submitted by DCM on behalf of program personnel prior to the award of contracts. The PJF represents program personnel’s assertion that the selected procurement method is appropriate under applicable State and Federal requirements, and that required evaluation procedures have been performed. OSPS must publicly post a NOI for all procurements over $10,000 entered into without a competitive process for a minimum of 7 calendar days prior to the start of the contract. The NOI includes the signed PJF provided to OSPS by DCM. The Office of the State Auditor (OSA) tested 14 contracts, 6 procured competitively and 8 procured noncompetitively, that accounted for $21.6 million of the $35.0 million in TANF procurement-related transactions in fiscal year 2025 and found: • PJFs were reviewed for reasonableness by DCM and OSPS, but DHHS could not provide documentation to support the assertions made by OFI were accurate. • For 7 contracts, DCM provided the PJF to OSPS for their review after the contract had commenced, between 5 and 109 days after the contract start date. For 12 contracts, OSPS approved the PJF after the contract commenced, between 11 and 159 days after the contract start date. For 1 contract, the PJF was not provided. • For 2 noncompetitive contracts, OSPS posted the NOI after contract performance had already commenced, between 44 and 59 days after the contract start date. For both of these contracts, services had been initiated and financial obligations incurred prior to the NOI. OSA selected a non-statistical random sample. Context: In fiscal year 2025, the Department expended $35.0 million in procurement-related transactions from TANF funds of $100.2 million. Cause: • Lack of adequate policies and procedures • Lack of supervisory oversight Effect: • Potential questioned costs and future disallowances • Noncompliance with Federal and State procurement requirements, including NOI posting requirements, could result in the need to void a contract or exposure to legal proceedings. Recommendation: We recommend that OSPS: • increase agency awareness of the procedures related to the timing of procurement contract documentation being submitted to OSPS for review prior to the contract start date; and • finalize and implement an updated procurement policy and procedure manual that identifies the parties responsible for key aspects of the procurement process. We also recommend that DCM and OFI develop policies and procedures and increase oversight to ensure all procurement transactions comply with Federal and State requirements, including: • DCM obtaining and reviewing documentation to support the assertions made by OFI for accuracy and reasonableness; and • ensuring PJFs are completed, reviewed, and submitted to OSPS prior to the contract start date. Corrective Action Plan: See F-24 Management’s Response: DAFS Response: The Department agrees with this finding. OSPS does not authorize, encourage, or approve agencies allowing vendors to perform work at risk. However, OSPS also does not delay review and approval solely due to contract start-date issues, as doing so would increase the State’s risk exposure, potentially disrupt federally required programs, and hinder agencies’ compliance with federal period-of-performance requirements. To address these concerns, OSPS will formalize and issue policy guidance that clearly defines agency and OSPS roles and responsibilities in the contracting process. This guidance will expand the agency-focused section to emphasize timely submission and processing, along with the risks and implications associated with contracting delays. In advance of fiscal year-end, OSPS will issue a separate policy document and companion guidance as a spotlight topic in the monthly newsletter and posted to the intranet for agency reference. DAFS Contact: David Morris, Acting Chief Procurement Officer, OSPS, 207-624-7335 DHHS Response: The Department partially agrees with this finding. There is not a requirement to provide documentation that the Department personnel’s assertions are accurate regarding Department personnel’s review of PJFs. The Department agrees that it can improve the timing of procurement documents in relation to the start dates of the contracts. Extenuating circumstances exist periodically that prevent the timeliness of these documents. In some cases, there are delays in the grant approval at the Federal level. Delays in Legislative approval of budgets can also lead to procurement documentation delays. DHHS Contact: Jim Lopatosky, Director, Division of Contract Management, DHHS, 207-287-5075 Auditor’s Concluding Remarks: 2 CFR 200.303 requires the Department to establish, document, and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. Absent adequate documentation to support the veracity of the assertions made on the PJF by program personnel, the best value for the State cannot be ensured. The finding remains as stated. (State Number: 25-1111-10)

(2025-047) Title: Internal control over TANF subrecipient monitoring procedures needs improvement Prior Year Findings: None State Department: Health and Human Services State Bureau: Office for Family Independence Federal Agency: U.S. Department of Health and Human Services Assistance Listing Title: Temporary Assistance for Needy Families (TANF) Assistance Listing Number: 93.558 Federal Award Identification Number: See E-65 to E-66 Compliance Area: Subrecipient monitoring Type of Finding: Significant deficiency Questioned Costs: None Criteria: 2 CFR 200.303; 2 CFR 200.332 The Department must establish, document, and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. The Department must monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. Condition: The Department is required to monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes. Subrecipient monitoring activities include, but are not limited to, review of financial and performance reports submitted by the subrecipient, periodic site visits, ensuring required audits of the subrecipient are completed, and ensuring that corrective action is taken for any deficiencies identified through the aforementioned procedures. These procedures are necessary to ensure the subrecipient is in compliance with Federal statutes, regulations, and the terms and conditions of the subaward. The Office of the State Auditor (OSA) tested 9 contracts issued to Temporary Assistance for Needy Families (TANF) subrecipients and found that documentation could not be provided to support that: • required performance reports were received and that appropriate action was taken in response for 4 contracts; and • required reports were reviewed for 6 contracts. OSA determined that payments made to subrecipients for the aforementioned reporting deficiencies were allowable based upon subsequent reports and other monitoring procedures performed. OSA selected a non-statistical random sample. Context: The Department provided $35.0 million from a total of $104.9 million to TANF subrecipients during fiscal year 2025. Cause: • Lack of adequate policies and procedures • Lack of supervisory oversight Effect: • Noncompliance with Federal regulations • Noncompliance with the Federal statutes, regulations, and the terms and conditions of the subaward by subrecipients may go undetected. • Potential future questioned costs and disallowances Recommendation: We recommend that the Department implement policies and procedures to ensure that all required reports are received from subrecipients and reviewed by program personnel, and that appropriate action is taken to address any deficiencies identified through subrecipient monitoring. Corrective Action Plan: See F-25 Management’s Response: The Department agrees with this finding. The Department will create a process to ensure the documentation of the review of sub-recipient performance reports. Contact: Ian Yaffe, Director, Office for Family Independence, DHHS, 207-592-1481 (State Number: 25-1111-08)

(2025-048) Title: Internal control over Child Support Services expenditures needs improvement Prior Year Findings: None State Department: Health and Human Services Administrative and Financial Services Judicial Branch State Bureau: Office for Family Independence Health and Human Services Service Center Administrative Office of the Courts Federal Agency: U.S. Department of Health and Human Services Assistance Listing Title: Child Support Services Assistance Listing Number: 93.563 Federal Award Identification Number: See E-65 to E-66 Compliance Area: Allowable costs/cost principles Type of Finding: Significant deficiency Questioned Costs: None Criteria: 2 CFR 200.303; 2 CFR 200.302 and .403; Cooperative Agreement between the State of Maine Department of Health and Human Services (DHHS) and Maine State Judicial Branch for State Fiscal Years 2024 and 2025, Article V, Section B.3 The Department must establish, document, and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. Costs must be adequately documented. The State’s financial management systems, including records documenting compliance with Federal statutes, regulations, and the terms and conditions of the Federal award, must be sufficient to determine that such funds have been used in accordance with Federal statutes, regulations, and the terms and conditions of the Federal award. The Administrative Office of the Courts (AOC) must provide a report to the DHHS Division of Support Enforcement and Recovery (DSER) for all Judicial Branch estimated expenditures. This report must detail costs that are eligible for Federal financial participation and must be provided within 60 calendar days after the close of the quarters ending in March, June, September, and December. These estimated expenditures are calculated using the per minute rate that was in effect for the prior fiscal year. By November 30th, the Judicial Branch will update the per minute rate and provide DSER a report with actual expenditures for the State fiscal year. Condition: The Child Support Services (CSS) program is administered by DSER. DHHS has a cooperative agreement with AOC that defines roles, relationships, and responsibilities of the parties, and sets forth a basis for financial reimbursement for court services provided to DHHS by AOC. These services include conducting paternity hearings; hearings to establish, modify, or enforce support orders; civil and criminal complaint hearings related to CSS; providing mediation services; and conducting proceedings related to income withholding responsibilities. AOC sends monthly invoices to the DHHS Service Center (DHHS SC) with estimated costs for work performed for the CSS program. DHHS SC is responsible for transferring funds from the CSS program to AOC on the following schedule: • On a quarterly basis, AOC provides DHHS SC with a reconciliation of estimated costs based on assigned caseload. This quarterly reconciliation utilizes the per minute rate that was in effect for the prior fiscal year and is due 60 days after the close of the quarter. • Annually, the per minute rate is updated and AOC provides DHHS SC with a final report of actual costs with the updated per minute rate. This final report is due by November 30th each year. Upon receipt of the final report, a final payment/reimbursement will be issued to reconcile to actual costs. The Office of the State Auditor (OSA) tested 7 transfers from DHHS SC to AOC and found that costs incurred for court services were not adequately supported, as follows: • DHHS SC did not receive 1 quarterly report from AOC; therefore, court expenditures were based on estimated costs rather than actual costs. • The annual report and reconciliation of estimated costs to actual costs was not complete; AOC updated minutes charged but the actual cost per minute rate was not updated. Therefore, expenditure amounts reported by the CSS program are not based on actual costs and the submitted final report used the estimated cost per minute rate. OSA selected a non-statistical random sample. Context: The CSS program expended $17.7 million in Federal funds during fiscal year 2025, of which $2.7 million was used for court services. Cause: • Lack of supervisory oversight • Lack of adequate policies and procedures Effect: Since DSER is utilizing the estimated cost per minute instead of the actual cost per minute: • CSS program expenditures could be misstated; and • the State may not be in compliance with State matching requirements of 34 percent of actual costs. Recommendation: We recommend that the Departments strengthen policies and procedures and increase oversight to ensure that the CSS program is in compliance with Federal regulations. Corrective Action Plan: See F-26 Management’s Response: The Departments agree with this finding. The Office of the Courts will strengthen policies, procedures, and oversight to ensure that the Child Support Servies program remains in full compliance with Federal regulations by March 31, 2026. Contact: Jerry Joy, Director, Division of Support Enforcement and Recovery, DHHS, 207-624-6985 (State Number: 25-1128-01)

(2025-049) Title: Internal control over CCDF financial reporting needs improvement Prior Year Findings: See Schedule of findings and Questioned Costs for chart/table State Department: Health and Human Services Administrative and Financial Services State Bureau: Office of Child and Family Services Health and Human Services Service Center Federal Agency: U.S. Department of Health and Human Services Assistance Listing Title: CCDF Cluster Assistance Listing Number: 93.489, 93.575, 93.596 Federal Award Identification Number: See E-65 to E-66 Compliance Area: Reporting Type of Finding: Significant deficiency Questioned Costs: None Criteria: 2 CFR 200.303; 45 CFR 98.50 and .65 The Department must establish, document, and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. The Department shall submit financial reports to the Administration for Children & Families (ACF) quarterly for each fiscal year until funds are expended. At a minimum, a state’s quarterly report shall include the following information on expenditures under Child Care and Development Fund (CCDF) grant funds: • Childcare administration • Quality activities, including any sub-categories of quality activities as required by ACF • Direct services for both grant or contracted slots and certificates • Non-direct services, including establishment and maintenance of computerized childcare information systems, certificate program cost/eligibility determination, and all other non-direct services • Such other information as specified Pursuant to CCDF regulations at 45 CFR 98.65(g), and as part of the terms and conditions of the grant award, states and territories are required to complete and submit a quarterly financial status report (ACF-696). The direct services category consists solely of expenditures for childcare subsidies to eligible children. The costs of eligibility determination and re-determination are considered a non-direct service activity and should be reported separately. Non-direct services are the costs of providing childcare subsidies or other activities not considered administrative costs. Condition: The CCDF program is administered by the Office of Child and Family Services (OCFS) and provides funding to increase the availability, affordability, and quality of childcare services in the State. The program had 3 ongoing Federal grant award years during fiscal year 2025, for grant years 2023, 2024, and 2025. For each grant award, quarterly CCDF ACF-696 financial status reports are required. The Department of Health and Human Services’ Service Center (DHHS SC) prepares and submits quarterly ACF-696 reports on behalf of OCFS. DHHS SC utilizes a spreadsheet designed by OCFS to track and summarize expenditure information and related earmarking requirements, and to prepare the ACF-696 reports. The Office of the State Auditor (OSA) reviewed all quarterly ACF-696 reports required to be filed during fiscal year 2025 and found that in all the required reports filed, the amount reported as direct expenditures included amounts that were not for childcare subsidies. Reported direct expenditures erroneously included non-direct costs related to the establishment of a new computerized childcare information system, costs of eligibility determinations, and costs associated with error rate reporting requirements. In addition, OSA reviewed 1 revised report filed during fiscal year 2025, in response to prior year finding 2024-059, that properly reported direct and indirect amounts on the correct reporting lines. Context: CCDF expenditures totaled $45.1 million for fiscal year 2025. Cause: • Lack of adequate procedures • Lack of supervisory oversight Effect: Noncompliance with Federal reporting requirements Recommendation: We recommend that the Departments enhance existing procedures and increase oversight to ensure that all information reported on quarterly ACF-696 reports is accurate and complete prior to submission to the Federal government. Corrective Action Plan: See F-25 Management’s Response: The Departments agree with this finding. The DHHS Financial Service Center updated existing procedures and increased oversight to ensure that all information reported on quarterly ACF-696 reports is accurate and complete prior to submission to the Federal government. Contact: Sarah Gove, Director, DHHS Service Center, DAFS, 207-458-6626 (State Number: 25-1114-03)

(2025-050) Title: Internal control over CCDF provider health and safety requirements needs improvement Prior Year Findings: See Schedule of Findings and Questioned Costs for chart/table State Department: Health and Human Services State Bureau: Office of Child and Family Services Federal Agency: U.S. Department of Health and Human Services Assistance Listing Title: CCDF Cluster Assistance Listing Number: 93.489, 93.575, 93.596 Federal Award Identification Number: See E-65 to E-66 Compliance Area: Special tests and provisions Type of Finding: Significant deficiency Questioned Costs: None Criteria: 2 CFR 200.303; 45 CFR 98.33, .41, .42, and .68 The Department must establish, document, and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. The Department is required to disseminate to the general public, through a consumer-friendly and easily accessible website, results of monitoring and inspection reports for all eligible and licensed childcare providers. Full monitoring and inspection reports must be posted timely. The Department is required to design, implement, and enforce health and safety requirements for the protection of children. Unannounced inspections of childcare providers and facilities, performed by licensing inspectors, are required not less than annually to ensure compliance with all childcare licensing and health and safety standards. In the Child Care and Development Fund (CCDF) State Plan, the Department is required to describe effective internal controls that are in place to ensure program integrity and accountability while maintaining continuity of services. Condition: The CCDF program is administered by the Office of Child and Family Services (OCFS) and provides funding to increase the availability, affordability, and quality of childcare services in the State. OCFS completes annual childcare provider site visits or licensing inspections for providers receiving subsidies from the CCDF program. During site visits and licensing inspections, OCFS personnel review Federal program health and safety requirements using a provider compliance checklist. Any deficiencies are noted, corrective action by the provider is required, and the frequency of site visits or licensing inspections is increased until remediation of noted deficiencies is complete. The Office of the State Auditor (OSA) tested 60 providers subject to health and safety site visits or licensing inspections and identified: • 1 provider facility inspection was noted in the provider file as complete; however, the completed inspection report was not posted publicly as required. • 2 provider facilities’ annual unannounced site visits did not occur within the required timeframe. OSA selected a non-statistical random sample. Context: The Department provided approximately $26 million to CCDF program childcare providers in fiscal year 2025. Cause: • Lack of resources • Lack of supervisory oversight Effect: • Noncompliance with Federal regulations • Providers not meeting CCDF program regulations for health and safety may go undetected. Recommendation: We recommend that OCFS enhance oversight to ensure that: • annual childcare provider site visits and licensing inspections are performed timely; and • all inspection reports, including corrective action, are posted publicly. Corrective Action Plan: See F-26 Management’s Response: The Department agrees with this finding. The Department acknowledges that two facilities annual unannounced inspections did not occur within 12 months, being 3 days and 10 days past due. The Department also agrees with the finding that one facility inspection was not posted publicly. Contact: Janet Whitten, CLIS Program Manager, OCFS, DHHS, 207-441-2259 (State Number: 25-1114-02)

(2025-051) Title: Internal control over CCDF procurement needs improvement Prior Year Findings: None State Department: Administrative and Financial Services Health and Human Services State Bureau: Office of State Procurement Services Division of Contract Management Office of Child and Family Services Federal Agency: U.S. Department of Health and Human Services Assistance Listing Title: CCDF Cluster Assistance Listing Number: 93.489, 93.575, 93.596 Federal Award Identification Number: See E-65 to E-66 Compliance Area: Procurement and suspension and debarment Type of Finding: Significant deficiency Questioned Costs: None Criteria: 2 CFR 200.303; 2 CFR 200.317; 5 MRSA 1825-B and D; Office of State Procurement Services (OSPS) policies The Department must establish, document, and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. The Department must follow the same policies and procedures it uses for procurements with non-Federal funds. Awards shall be made to the best-value bidder, taking into consideration the best interest of the State. The requirement to competitively bid a contract may be waived if specific criteria is met, including the item or service can only be procured from one source or it is an emergency procurement. Each bid, with the name of the bidder, must be entered on record. Each record, with the successful bid indicated, must be open to public inspection after the letting of the contract. The Department must justify the selection of vendor, either through competitive or noncompetitive process, and provide a detailed explanation of cost, demonstrating how the best value for the State is ensured. The Chief Procurement Officer shall make the public aware of contracts and grants for which bids are being requested and communicate the procedure used in reviewing bids. Contracts must be submitted to OSPS at least 14 days prior to the contract start date. A Notice of Intent to Waive the Competitive Bidding Process (NOI) must be posted to the OSPS website for 7 calendar days prior to the start of a noncompetitively bid contract. Condition: The Child Care and Development Fund (CCDF) Cluster is administered by the Office of Child and Family Services (OCFS) and provides funding to increase the availability, affordability, and quality of childcare services in the State. OSPS is the central oversight agency for all State procurement. The Department of Health and Human Services (DHHS) Division of Contract Management (DCM) oversees the solicitation and contract implementation for all DHHS procurement. DCM coordinates with DHHS program personnel to evaluate and select vendors and subrecipients, determine contract terms, and provide required documentation to OSPS. OSPS is responsible for reviewing and approving Procurement Justification Forms (PJFs) submitted by DCM on behalf of program personnel prior to the award of contracts. The PJF represents program personnel’s assertion that the selected procurement method is appropriate under applicable State and Federal requirements, and that required evaluation procedures have been performed. OSPS must publicly post a NOI for all procurements over $10,000 entered into without a competitive process for a minimum of 7 calendar days prior to the start of the contract. The NOI includes the signed PJF provided to OSPS by DCM. The Office of the State Auditor (OSA) tested 13 contracts, 3 procured competitively and 10 procured noncompetitively, that accounted for $10.1 million of the $14.4 million in CCDF program procurement- related transactions in fiscal year 2025 and found: • PJFs were reviewed for reasonableness by DCM and OSPS, but DHHS could not provide documentation to support the assertions made by OCFS were accurate. • For 11 contracts, DCM provided the PJF to OSPS for their review after the contract had commenced, between 7 and 198 days after the contract start date. For 12 contracts, OSPS approved the PJF after the contract commenced, between 12 and 200 days after the contract start date. • For 3 of the noncompetitive contracts, OSPS posted the NOI after contract performance had commenced, between 12 and 208 days after the contract start date. For all 3 contracts, services had been initiated and financial obligations incurred prior to the NOI. OSA utilized a risk-based approach to select 2 contracts issued by OCFS and a non-statistical random sample of all other contracts. Context: In fiscal year 2025, the Department expended $14.4 million in procurement-related transactions from CCDF funds of $45.1 million. Cause: • Lack of adequate policies and procedures • Lack of supervisory oversight Effect: • Potential questioned costs and future disallowances • Noncompliance with Federal and State procurement requirements, including NOI posting requirements, could result in the need to void a contract or exposure to legal proceedings. Recommendation: We recommend that OSPS: • increase agency awareness of the procedures related to the timing of procurement contract documentation being submitted to OSPS for review prior to the contract start date; and • finalize and implement an updated procurement policy and procedure manual that identifies the parties responsible for key aspects of the procurement process. We also recommend that DCM and OCFS develop policies and procedures and increase oversight to ensure all procurement transactions comply with Federal and State requirements, including: • DCM obtaining and reviewing documentation to support the assertions made by OCFS for accuracy and reasonableness; and • ensuring PJFs are completed, reviewed, and submitted to OSPS prior to the contract start date. Corrective Action Plan: See F-26 Management’s Response: DAFS Response: The Department agrees with this finding. OSPS does not authorize, encourage, or approve agencies allowing vendors to perform work at risk. However, OSPS also does not delay review and approval solely due to contract start-date issues, as doing so would increase the State’s risk exposure, potentially disrupt federally required programs, and hinder agencies’ compliance with federal period-of-performance requirements. To address these concerns, OSPS will formalize and issue policy guidance that clearly defines agency and OSPS roles and responsibilities in the contracting process. This guidance will expand the agency-focused section to emphasize timely submission and processing, along with the risks and implications associated with contracting delays. In advance of fiscal year-end, OSPS will issue a separate policy document and companion guidance as a spotlight topic in the monthly newsletter and posted to the intranet for agency reference. DAFS Contact: David Morris, Acting Chief Procurement Officer, OSPS, 207-624-7335 DHHS Response: The Department partially agrees with this finding. There is not a requirement to provide documentation that the Department personnel’s assertions are accurate regarding Department personnel’s review of PJFs. The Department agrees that it can improve the timing of procurement documents in relation to the start dates of the contracts. Extenuating circumstances exist periodically that prevent the timeliness of these documents. In some cases, there are delays in the grant approval at the Federal level. Delays in Legislative approval of budgets can also lead to procurement documentation delays. DHHS Contact: Jim Lopatosky, Director, Division of Contract Management, DHHS, 207-287-5075 Auditor’s Concluding Remarks: 2 CFR 200.303 requires the Department to establish, document, and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. Absent adequate documentation to support the veracity of the assertions made on the PJF by program personnel, the best value for the State cannot be ensured. The finding remains as stated. (State Number: 25-1114-06)

(2025-052) Title: Internal control over CCDF eligibility determinations needs improvement Prior Year Findings: None State Department: Health and Human Services State Bureau: Office of Child and Family Services Federal Agency: U.S. Department of Health and Human Services Assistance Listing Title: CCDF Cluster Assistance Listing Number: 93.489, 93.575, 93.596 Federal Award Identification Number: See E-65 to E-66 Compliance Area: Eligibility Type of Finding: Significant deficiency Questioned Costs: None Criteria: 2 CFR 200.303; 45 CFR 98.21, .100, and .101 The Department must establish, document, and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. The Department must have procedures in place for verifying eligibility for children receiving Child Care and Development Fund (CCDF) subsidies in accordance with Federal eligibility requirements, as well as the specific eligibility requirements selected by each lead agency in its approved State plan. The Department is required to calculate, prepare, and submit to the Federal government a triennial report of errors occurring in the administration of CCDF grant funds. States must use this report to calculate error rates, which is defined as the percentage of cases with an error, the percentage of cases with an improper payment, the percentage of improper payments, the average amount of improper payment, and the estimated amount of improper payments. Improper payments include any payment of CCDF grant funds to an ineligible recipient or for an ineligible service, any duplicate payment of CCDF grant funds, and payments of CCDF grant funds for services not received. In preparing the error reports, the Department shall conduct comprehensive reviews of case records by selecting a random sample of case records which is estimated to achieve the calculation of an estimated annual amount of improper payments with a 90 percent confidence interval of 5 percent. Condition: The CCDF program is administered by the Office of Child and Family Services (OCFS) and provides funding to increase the availability, affordability, and quality of childcare services in the State. CCDF provides childcare benefits to parents based on financial and program eligibility factors. Eligibility for benefits is determined based on application information from families through the childcare management system. On a monthly basis, the Department’s Quality Assurance Team performs Quality Control Reviews (QCRs) of a random sample of cases to review eligibility determinations and benefit amounts. The Department tracks error rates of improper payments which are reported to the Federal government on a triennial basis on the ACF-404 State Improper Payments Report. The Department did not perform QCRs in April and May 2025. Context: The Department did not perform 46 of the 276 required QCRs in fiscal year 2025. The Department provided $25.9 million in CCDF provider payments from total CCDF program expenditures of $45.1 million in fiscal year 2025. Cause: • Lack of adequate oversight procedures to ensure monthly QCRs are performed • Lack of resources Effect: • CCDF provider payments may be incorrectly calculated, resulting in households being underpaid and/or overpaid. • Potential future questioned costs and disallowances • Noncompliance with Federal regulations Recommendation: We recommend that the Department enhance existing oversight procedures to ensure that eligibility for children receiving CCDF subsidies is in accordance with Federal requirements. This should include confirming that QCRs are performed monthly as required. Corrective Action Plan: See F-27 Management’s Response: The Department agrees with this finding. During the rollout of the Baxter child care management system, a system error prevented the random selection of cases needed for monthly Quality Assurance (QA) audits. As a result, the 46 QA reviews scheduled for May and June 2025 were not completed. The issue was promptly identified, corrected, and normal QA activity resumed in July 2025. The Department would like to note that Maine’s QA process significantly exceeds federal requirements. While federal rules require 276 case reviews over a three‑year cycle, Maine reviews 276 cases annually—totaling approximately 828 over three years. Even with the missed 46 cases, the Department will complete 782 reviews this cycle, remaining well above federal minimums. Contact: Gina Forbes, Child Care Services Program Manager, OCFS, DHHS, 207-592-0865 Auditor’s Concluding Remarks: The Department agrees with the finding but states that “Maine’s QA process significantly exceeds federal requirements. While federal rules require 276 case reviews over a three‑year cycle, Maine reviews 276 cases annually—totaling approximately 828 over three years.” The Department is erroneously referencing ACF-404 reporting requirements rather than the controls they are relying on to ensure compliance over eligibility requirements, which have been documented in the Federally-approved State plan. Since the random sample of QCRs performed by the Department are based on initial eligibility determinations, adequate controls were not in place over initial eligibility determinations made in April and May 2025. The finding remains as stated. (State Number: 25-1114-01)

(2025-053) Title: Internal control over CCDF subrecipient cash management needs improvement Prior Year Findings: None State Department: Health and Human Services State Bureau: Office of Child and Family Services Federal Agency: U.S. Department of Health and Human Services Assistance Listing Title: CCDF Cluster Assistance Listing Number: 93.489, 93.575, 93.596 Federal Award Identification Number: See E-65 to E-66 Compliance Area: Cash management Subrecipient monitoring Type of Finding: Significant deficiency Questioned Costs: None Criteria: 2 CFR 200.303; 2 CFR 200.305 The Department must establish, document, and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. The Department is required to monitor cash drawdowns by their subrecipients to ensure that the time elapsing between the payment of Federal funds to the subrecipient and the subrecipient’s actual disbursement for program purposes is minimized. Condition: The Child Care and Development Fund (CCDF) program is administered by the Office of Child and Family Services (OCFS) and provides funding to increase the availability, affordability, and quality of childcare services in the State. The Department makes equal advance monthly payments to subrecipients and then reconciles those amounts to quarterly financial reports submitted by the subrecipient. This procedure does not consider the time elapsing between the payment of Federal funds to the subrecipient and the subrecipient’s actual disbursement for program purposes, and OCFS’ subrecipient monitoring procedures do not include a review of subrecipient compliance with cash management requirements. As a result, OCFS procedures do not support that subrecipient cash management is properly monitored as required by Federal regulations. Context: OCFS provided $2.8 million from a total of $45.1 million to CCDF program subrecipients during fiscal year 2025. Cause: • Lack of adequate subrecipient monitoring procedures • Lack of centralized oversight of subrecipient monitoring Effect: • Noncompliance with Federal regulations • Federal programs may not be effectively and efficiently administered. • The Federal government may require the implementation of more stringent subrecipient cash management procedures. Recommendation: We recommend that OCFS implement monitoring procedures over subrecipient cash management requirements to ensure that the time elapsing between the payment of Federal funds to the subrecipient and the subrecipient’s actual disbursement for program purposes is minimized for the CCDF program. Corrective Action Plan: See F-27 Management’s Response: The Department disagrees with this finding. The Department is in compliance with the requirement for minimizing the time between payments to our subrecipients and the disbursement of the funds. Payments are made as close as is administratively feasible. The Compliance Supplement suggested audit procedures for Cash Management for pass-through entities refers to 200.305(b)(1) ...that same paragraph states that the timing and amount of advance payments must be as close as is administratively feasible. Contact: Tara Williams, Associate Director of Early Care & Education, OCFS, DHHS, 207-557-2342 Auditor’s Concluding Remarks: The Department’s interpretation of the applicable Federal regulation emphasizes a single sentence from the broader paragraph, omitting context that informs the regulation’s full intent. According to the 2025 Compliance Supplement, pass-through entities must monitor cash drawdowns by their subrecipients to ensure that the time elapsing between the transfer of Federal funds to the subrecipient and their disbursement for program purposes is minimized as required by the applicable cash management requirements in the Federal award to the recipient (2 CFR 200.305(b)(1)). 2 CFR 200.305(b)(1) states that the recipient or subrecipient must be paid in advance, provided it maintains or demonstrates the willingness to maintain both written procedures that minimize the time elapsing between the transfer of funds and disbursement by the recipient or subrecipient, and financial management systems that meet the standards for fund control and accountability as established in this part. Advance payments to a recipient or subrecipient must be limited to the minimum amounts needed and be timed with actual, immediate cash requirements of the recipient or subrecipient in carrying out the purpose of the approved program or project. The timing and amount of advance payments must be as close as is administratively feasible to the actual disbursements by the recipient or subrecipient for direct program or project costs and the proportionate share of any allowable indirect costs. The recipient or subrecipient must make timely payments to contractors in accordance with the contract provisions. The Department references the phrase “as close as is administratively feasible” to justify their current process; however, this phrase is part of a broader requirement that establishes specific conditions for advance payments. The regulation requires that the timing between when the subrecipient receives Federal funds from the State and when the subrecipient disburses those funds is closely monitored to ensure that disbursements align with actual, immediate cash needs. The Department could not provide evidence to demonstrate that they adequately monitored subrecipient cash drawdowns to ensure alignment with actual, immediate cash needs. The finding remains as stated. (State Number: 25-1114-04)

(2025-054) Title: Internal control over CCDF subrecipient risk evaluation procedures needs improvement Prior Year Findings: None State Department: Health and Human Services State Bureau: Office of Child and Family Services Federal Agency: U.S. Department of Health and Human Services Assistance Listing Title: CCDF Cluster Assistance Listing Number: 93.489, 93.575, 93.596 Federal Award Identification Number: See E-65 to E-66 Compliance Area: Subrecipient monitoring Type of Finding: Significant deficiency Questioned Costs: None Criteria: 2 CFR 200.303; 2 CFR 200.332 The Department must establish, document, and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. The Department is required to evaluate each subrecipient’s risk of noncompliance with Federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate subrecipient monitoring described in 2 CFR 200.332. Condition: The Child Care and Development Fund (CCDF) program is administered by the Office of Child and Family Services (OCFS) and provides funding to increase the availability, affordability, and quality of childcare services in the State. The CCDF program contracts with subrecipients to administer the First 4 ME Pilot Project, a community-based, coordinated birth through kindergarten entry program which provides comprehensive, high-quality early child care and education to support a child’s school readiness. The Department is required to evaluate each subrecipient’s risk of noncompliance with Federal regulations for the purpose of determining the appropriate level of subrecipient monitoring to be performed. Subrecipient monitoring activities include, but are not limited to, review of financial and performance reports submitted by the subrecipient, periodic site visits, ensuring required audits of the subrecipient are completed, and ensuring that corrective action is taken for any deficiencies identified through the aforementioned procedures. These procedures are necessary to ensure the subrecipient is in compliance with Federal statutes, regulations, and the terms and conditions of the subaward. The Department provided evidence to support that subrecipient monitoring procedures were performed; however, documentation that risk evaluation procedures performed corresponded to the appropriate level of monitoring activities could not be provided. Context: The Department provided $2.8 million from a total of $45.1 million to CCDF subrecipients during fiscal year 2025. Cause: • Lack of policies and procedures • Lack of supervisory oversight Effect: • Noncompliance with Federal regulations • Subrecipients that are deemed higher risk may not be monitored on a more frequent basis. Conversely, subrecipients that are deemed lower risk may not be monitored on a less frequent basis, which would free resources and time to dedicate towards other higher risk subrecipients. Recommendation: We recommend that the Department implement policies and procedures that require evaluation of each subrecipient’s risk of noncompliance specifically for the purposes of determining the appropriate subrecipient monitoring to be performed. This will ensure that subrecipients are monitored appropriately based on risk designation. Corrective Action Plan: See F-27 Management’s Response: The Department disagrees with this finding. The Department evaluates risk on its subrecipients for the purposes of determining the appropriate subrecipient monitoring in multiple ways. The first assessment of risk is when a subaward is competitively bid. The second assessment of risk is built into the Maine Uniform Accounting and Auditing Practices for Community Agencies (MAAP) in which higher risk subrecipients undergo a higher level of testing by Independent Public Accountants. Finally, the Social Service Unit of the Division of Audit performs a risk assessment and tests transactions for those subrecipients that have been determined to be higher risk. Contact: John Feeney, Chief Operating Officer, OCFS, DHHS, 207-626-8614 Auditor’s Concluding Remarks: 2 CFR 200.332(b) states that the Department must evaluate each subrecipient’s risk of noncompliance with Federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate subrecipient monitoring. The Department has indicated in Management’s Response that the criteria set forth in 2 CFR 200.332(b) have been met; however, the following rebuttals illustrate that the Department is not in compliance with Federal requirements: • The Department identifies the first assessment of risk: when a subaward is competitively bid. o While the Office of the State Auditor acknowledges this does occur, not all subawards are competitively bid. o The level of subrecipient monitoring that the Department performs is based on the services provided, not on specific subrecipients, as required. • The Department identifies the second assessment of risk: built into MAAP in which higher risk subrecipients undergo a higher level of testing by independent public accountants. o A subrecipient deemed higher risk as the result of a risk evaluation in accordance with 2 CFR 200.332 may not be deemed higher risk in accordance with MAAP standards. • The Department identifies the third assessment of risk: the Social Service Unit of the Division of Audit performs a risk assessment and tests transactions for those subrecipients that have been determined to be higher risk. o The Department did not provide documentation to demonstrate that these procedures are performed as a result of a risk evaluation. The Department’s existing policies and procedures do not require nor provide support for the evaluation of each subrecipient’s risk of noncompliance specifically for the purpose of determining the appropriate subrecipient monitoring to be performed. The finding remains as stated. (State Number: 25-1114-05)

(2025-055) Title: Internal control over the Foster Care and Adoption Assistance eligibility and benefit determination process needs improvement Prior Year Findings: See Schedule of Findings and Questioned Costs for chart/table State Department: Health and Human Services State Bureau: Office of Child and Family Services Federal Agency: U.S. Department of Health and Human Services Assistance Listing Title: Foster Care – Title IV-E Adoption Assistance – Title IV-E Assistance Listing Number: 93.658; 93.659 Federal Award Identification Number: See E-65 to E-66 Compliance Area: Allowable costs/cost principles Eligibility Type of Finding: Material weakness Material noncompliance Questioned costs Known Questioned Costs: ALN 93.658 $51,247 ALN 93.659 $42,689 Likely Questioned Costs: Undeterminable; the Office of the State Auditor (OSA) selected a sample of clients who received Title IV-E benefits during fiscal year 2025 and identified known questioned costs associated with 11 clients based on various eligibility attributes. Since each exception is unique to the client, a projection of questioned costs cannot be reasonably estimated. Criteria: 2 CFR 200.303; 2 CFR 200.403; 45 CFR 1356.21 and .40; 42 USC 671; Department of Health and Human Services (DHHS) 10-148 Chapter 16 Rules Providing for the Licensing of Family Foster Homes for Children; Office for Child and Family Services’ (OCFS) Financial Resource Specialist (FRS) Policy and Procedure Manual The Department must establish, document, and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. To be allowable under Federal awards, costs must be necessary and reasonable for the performance of the Federal award and be adequately documented. 45 CFR 1356.21 outlines eligibility criteria which, if met, allows the State to pay foster care maintenance payments on behalf of eligible children, in accordance with the Title IV-E agency’s foster care maintenance payment rate schedule, to individuals serving as foster family homes, to childcare institutions, or to public or private child-placement or childcare agencies. 45 CFR 1356.40 outlines eligibility criteria which, if met, allows the State to pay a portion of the Federal Adoption Assistance maintenance payments and claim Federal financial participation for the payment. 42 USC 671 requires that prospective foster parents and any other adult living in the home who has resided in the provider home in the preceding 5 years satisfactorily meet a child abuse and neglect registry check. The requirement applies to foster care maintenance payments made on behalf of the foster child. DHHS 10-148 Chapter 16 Rules Providing for the Licensing of Family Foster Homes for Children states that an application may be denied if the applicant(s) have an open Child Protective Services case or a closed substantiated and/or indicated Child Protective Services case. In addition, applications for renewal of a license shall be made 60 days prior to the date of expiration to ensure that necessary licensing procedures may be completed for the continuity of the license. The OCFS FRS Policy and Procedure Manual defines Supplemental Security Income (SSI) as unearned income; documentation to support unearned income includes benefit award letters, copies of checks, child support printouts, Automated Client Eligibility System (ACES) printouts or other documentation. In addition, a child may be eligible for both SSI and Title IV-E. The Department, through an FRS, must make a decision as to which would yield greater financial benefits for the State. Condition: OCFS administers the Foster Care – Title IV-E (Foster Care) and Adoption Assistance – Title IV-E (Adoption Assistance) programs for the State as outlined below: • The Foster Care program is designed to help states provide safe and stable out-of-home care for children under its jurisdiction until the children are returned home safely, placed with adoptive families, or placed in other planned arrangements for permanency. • The Adoption Assistance program provides Federal funds to states to facilitate the timely placement of children, whose special needs or circumstances would otherwise make them difficult to place, with adoptive families. Funds are available for a one-time payment to assist with the costs of adopting a child, as well as for subsidies to adoptive families for the care of the eligible child on an ongoing basis. An FRS determines program eligibility and initiates benefits through completion of a determination checklist. The FRS reviews program eligibility factors, gathers required supporting documentation, and documents the certification decision on the checklist. The FRS enters the information into the child welfare information system for processing. Once the client is determined eligible in the child welfare information system, a level of benefits is assigned. OCFS relies on this information and the related system coding to ensure that benefits are accurately provided to eligible clients. OSA tested 60 initial client eligibility determinations and found 1 client’s prospective foster parent did not satisfactorily meet a child abuse and neglect registry check in accordance with 42 USC 671 and DHHS Rules Providing for the Licensing of Family Foster Homes for Children. The Resource Family Home (RFH) received $12,566 in Federal Foster Care benefits on behalf of 2 clients, resulting in questioned costs of the entire amount. OSA tested 60 Adoption Assistance benefit payments and 60 Foster Care benefit payments, along with the related eligibility determination for those clients, and found: • 5 clients who were placed in a RFH that the foster/adoptive parent did not satisfactorily meet a child abuse and neglect registry check in accordance with 42 USC 671 and DHHS Rules Providing for the Licensing of Family Foster Homes for Children. The RFHs received benefits from both Federal programs on behalf of multiple clients, resulting in questioned costs for the Foster Care and Adoption Assistance programs of $7,629 and $42,689, respectively. • 2 clients determined to be ineligible by OCFS due to a conversion issue within the newly implemented child welfare information system continued to receive Foster Care benefit payments during the fiscal year, resulting in questioned costs of $11,768. • 1 client who received Federal benefits for both Title IV-E and SSI during the fiscal year. OCFS could not provide documentation of their consideration of the SSI documented in ACES, or their decision regarding claiming Title IV-E benefits instead of SSI benefits, resulting in questioned costs for the Foster Care program of $12,687. • 1 client determined ineligible due to an inactive license for 6 months past the initial renewal period, continued to receive Foster Care benefit payments during the fiscal year, resulting in questioned costs for the Foster Care program of $6,447. • 1 client received a one-time payment to adjust Adoption Assistance childcare benefits; however, it was paid out of Foster Care benefits, resulting in questioned costs of $150. OSA selected non-statistical random samples. Context: In fiscal year 2025, the State provided approximately: • 1,000 Foster Care clients with $5.3 million in Federal benefits; and • 4,500 Adoption Assistance clients with $25.5 million in Federal benefits. Identified Cause: • Lack of adequate policies and procedures • Lack of appropriate oversight over eligibility and benefit determinations Potential Effect: • Known questioned costs • Potential future questioned costs and disallowances • Benefits were provided to ineligible clients. • Noncompliance with Federal regulations Recommendation: We recommend that the Department: • implement additional procedures to ensure that payments made on behalf of clients are accurate and allowable in accordance with program regulations; • establish recoupments for the overpayments identified; and • strengthen licensing practices for background screening of potential and current RFHs. Corrective Action Plan: See F-28 Management’s Response: The Department partially agrees with this finding. OCFS disagrees with the condition that child abuse and neglect registry checks for RFH require a denial. According to State of Maine Department of Health and Human Services Chapter 16 Rules Providing for the Licensing of Family Foster Homes for Children: Section 9: Licensing Requirements for Family Foster Homes for Children, Sect A. (9): An application may be denied if the applicant(s) have an open Child Protective Services Case or a closed substantiated and/or indicated Child Protective Services case. An open Child Protective Services Case includes a pending disposition of an open report, a case open for assessment or a case open for services. OCFS also disagrees with the condition that Title IV-E was claimed in error during their foster care placement, since the Social Security Administration (SSA) did not stop SSI payments to the biological parent, and is requiring OCFS to pay back the Title IV-E funding that was received to help pay for the child's care. This is an error of the SSA office that DHHS has no responsibility over. DHHS reports all children removed from their parents’ custody to SSA through a monthly federally required reporting process. SSA would be responsible for taking any action based on that reporting. DHHS does not agree that Maine taxpayers should be penalized for the federal agency's failure to take action and stop benefits to the parent. OCFS agrees to the remaining conditions noting that: Changes were made to the Katahdin system (User story 3002158) that were released on 8/3/2025 to avoid overlapping payments for childcare in both Foster Care and Adoption. Changes were made to the OCFS Licensing policy in July 2025, removing the 60-day time limit on the license renewal process. Contact: Robert Blanchard, Associate Director, OCFS, DHHS, 207-624-7955 Auditor’s Concluding Remarks: Regarding the exceptions related to child abuse and neglect registry checks for RFHs, OCFS is only citing State policy and omitting the Federal requirement (42 USC 671) which states that prospective foster parents and any other adult living in the home who has resided in the provider home in the preceding 5 years satisfactorily meet a child abuse and neglect registry check. For all 5 clients in the Condition, the foster/adoptive parent did not satisfactorily meet a child abuse and neglect registry check; 2 of the 5 clients were subsequently removed from the RFH as a result of the child abuse and neglect registry checks. Regarding the client who received both SSI and Federal Title IV-E benefits, though OCFS states that this exception is SSA’s responsibility, the FRS did not properly identify that the client was receiving SSI benefits when determining Foster Care eligibility. As a result, the FRS did not decide which benefit would yield greater financial benefits for the State, and the client received Federal benefits from both Title IV-E and SSI during fiscal year 2025. The finding remains as stated. (State Number: 25-1109-03)

(2025-056) Title: Internal control over Foster Care level of care assessments needs improvement Prior Year Findings: None State Department: Health and Human Services State Bureau: Office of Child and Family Services Federal Agency: U.S. Department of Health and Human Services Assistance Listing Title: Foster Care – Title IV-E Assistance Listing Number: 93.658 Federal Award Identification Number: See E-65 to E-66 Compliance Area: Special tests and provisions Type of Finding: Material weakness Material noncompliance Questioned costs Known Questioned Costs: ALN 93.658 $3,003 Likely Questioned Costs: Undeterminable; the Office of the State Auditor (OSA) selected a sample of clients who received Title IV-E benefits during fiscal year 2025 and identified known questioned costs for 1 client based on various level of care (LOC) requirements. Since each exception is unique to the client, a projection of questioned costs cannot be reasonably estimated. Criteria: 2 CFR 200.303; 45 CFR 1356.21; Department of Health and Human Services 10-148, Chapter 14 Rules for LOC for Foster Homes; Office of Child and Family Services’ (OCFS) Child and Family Services Manual The Department must establish, document, and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. The Title IV-E agency must review, at reasonable, specific, time-limited periods established by the agency, the amount of payments made for foster care maintenance to assure their continued appropriateness, and the amount made to a licensed or approved relative or kinship foster family home is the same as the amount that would have been made if the child was placed in a licensed or approved non-relative foster family home. Within 90 days of placement in a family foster home or a specialized foster home, an initial child assessment will be done by LOC reviewers to determine the child’s level of need. Initial assessments are conducted on children that are new in care and placed in a resource home and on children that have been previously assessed, have transitioned out of residential care, or have been placed in a resource home. This assessment should be conducted within the first 90 days of placement. Condition: OCFS administers the Foster Care – Title IV-E (Foster Care) program for the State and operates under a Federally-approved plan that requires the agency to perform a periodic review of payment rates for Foster Care maintenance payments to ensure the rates remain appropriate. Maintenance payments are issued based on the number of days in a bi-weekly period a child remains in placement. The payment amounts are established by State regulations but vary by the LOC needed for a child. The 2 types of foster homes where a child can be placed are: • a resource home for basic needs. The 2 LOCs are Levels A and B. LOC Level A receives the entry reimbursement rate and Level B receives an increased rate based on the child’s level of need. • a treatment foster care home. The 3 applicable LOCs are Levels C, D, and E. LOC Level C receives the entry reimbursement rate and Levels D and E receive increased rates based on the child’s level of need. OCFS’ schedule for periodic review is as follows: • All LOC levels require an initial 90-day assessment; • LOC Level A children remain at that level until an event triggers a review, or a request for reassessment is made; • LOC Level B children require a reassessment every 12 months; and • LOC Levels C, D, or E children require a reassessment every 6 months. OSA tested 60 cases with Foster Care maintenance payments and found: • 36 clients did not have an initial LOC assessment within 90 days of placement. Initial LOC assessments ranged from 11 to 302 days past the 90-day requirement. • 3 clients did not have an annual reassessment conducted as required for Level B. • 2 clients did not have a 6-month reassessment conducted as required for Levels C, D, and E. • 1 client’s LOC assessment was automatically adjusted by the child welfare information system from a Level A to a Level B, based on draft policies and procedures that have not been formally approved and implemented, resulting in questioned costs of $3,003 for fiscal year 2025. • 1 client’s LOC assessment was not approved by the LOC manager. OSA selected a non-statistical random sample. Context: The Department provided approximately 1,000 Foster Care clients with $5.3 million in Federal maintenance payments in fiscal year 2025. Cause: • Lack of adequate policies and procedures • Lack of resources • Lack of supervisory oversight Effect: • Known questioned costs • Potential future questioned costs and disallowances • Inaccurate client benefit payments • Noncompliance with Federal regulations Recommendation: We recommend that the Department allocate resources and enhance policies, procedures, and oversight to ensure LOC assessments are performed in accordance with the Federally-approved schedule for LOC assessments. Corrective Action Plan: See F-23 Management’s Response: The Department agrees with this finding. The Office of Child and Family Services has developed and will implement a corrective action plan to address the issues identified. Contact: Robert Blanchard, Associate Director, OCFS, DHHS, 207-624-7955 (State Number: 25-1109-02)

(2025-057) Title: Internal control over Foster Care procurement needs improvement Prior Year Findings: None State Department: Administrative and Financial Services Health and Human Services State Bureau: Office of State Procurement Services Division of Contract Management Office of Child and Family Services Federal Agency: U.S. Department of Health and Human Services Assistance Listing Title: Foster Care – Title IV-E Assistance Listing Number: 93.658 Federal Award Identification Number: See E-65 to E-66 Compliance Area: Procurement and suspension and debarment Type of Finding: Significant deficiency Questioned Costs: None Criteria: 2 CFR 200.303; 2 CFR 200.317; 5 MRSA 1825-B and D; Office of State Procurement Services (OSPS) policies The Department must establish, document, and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. The Department must follow the same policies and procedures it uses for procurements with non-Federal funds. Awards shall be made to the best-value bidder, taking into consideration the best interest of the State. The requirement to competitively bid a contract may be waived if specific criteria is met, including the item or service can only be procured from one source or it is an emergency procurement. Each bid, with the name of the bidder, must be entered on record. Each record, with the successful bid indicated, must be open to public inspection after the letting of the contract. The Department must justify the selection of vendor, either through competitive or noncompetitive process, and provide a detailed explanation of cost, demonstrating how the best value for the State is ensured. The Chief Procurement Officer shall make the public aware of contracts and grants for which bids are being requested and communicate the procedure used in reviewing bids. Contracts must be submitted to OSPS at least 14 days prior to the contract start date. A Notice of Intent to Waive the Competitive Bidding Process (NOI) must be posted to the OSPS website for 7 calendar days prior to the start of a noncompetitively bid contract. Condition: The Foster Care – Title IV-E (Foster Care) program is designed to help states provide safe and stable out-of-home care for children under its jurisdiction until the children are returned home safely, placed with adoptive families, or placed in other planned arrangements for permanency. The Foster Care program is administered by the Office of Child and Family Services (OCFS). OSPS is the central oversight agency for all State procurement. The Department of Health and Human Services (DHHS) Division of Contract Management (DCM) oversees the solicitation and contract implementation for all DHHS procurement. DCM coordinates with DHHS program personnel to evaluate and select vendors and subrecipients, determine contract terms, and provide required documentation to OSPS. OSPS is responsible for reviewing and approving Procurement Justification Forms (PJFs) submitted by DCM on behalf of program personnel prior to the award of contracts. The PJF represents program personnel’s assertion that the selected procurement method is appropriate under applicable State and Federal requirements, and that required evaluation procedures have been performed. OSPS must publicly post a NOI for all procurements over $10,000 entered into without a competitive process for a minimum of 7 calendar days prior to the start of the contract. The NOI includes the signed PJF provided to OSPS by DCM. The Office of the State Auditor (OSA) tested 4 contracts, 1 procured competitively and 3 procured noncompetitively, that accounted for approximately $4 million of the $4.6 million in Foster Care program procurement-related transactions in fiscal year 2025 and found: • PJFs were reviewed for reasonableness by DCM and OSPS, but DHHS could not provide documentation to support the assertions made by OCFS were accurate. • For 1 contract, DCM provided the PJF to OSPS for their review after the contract had commenced, 38 days after the contract start date. For all 4 contracts, OSPS approved the PJF after the contract commenced, between 25 and 60 days after the contract start date. • For 1 of the noncompetitive contracts, OSPS posted the NOI after contract performance had commenced, 40 days after the contract start date. For this contract, services had been initiated and financial obligations incurred prior to the NOI. OSA utilized a risk-based approach to select 2 contracts issued by OCFS and a non-statistical random sample of all other contracts. Context: In fiscal year 2025, the Department expended $4.6 million in procurement-related transactions from Foster Care funds of approximately $12 million. Cause: • Lack of adequate policies and procedures • Lack of supervisory oversight Effect: • Potential questioned costs and future disallowances • Noncompliance with Federal and State procurement requirements, including NOI posting requirements, could result in the need to void a contract or exposure to legal proceedings. Recommendation: We recommend that OSPS: • increase agency awareness of the procedures related to the timing of procurement contract documentation being submitted to OSPS for review prior to the contract start date; and • finalize and implement an updated procurement policy and procedure manual that identifies the parties responsible for key aspects of the procurement process. We also recommend that DCM and OCFS develop policies and procedures and increase oversight to ensure all procurement transactions comply with Federal and State requirements, including: • DCM obtaining and reviewing documentation to support the assertions made by OCFS for accuracy and reasonableness; and • ensuring PJFs are completed, reviewed, and submitted to OSPS prior to the contract start date. Corrective Action Plan: See F-28 Management’s Response: DAFS Response: The Department agrees with this finding. OSPS does not authorize, encourage, or approve agencies allowing vendors to perform work at risk. However, OSPS also does not delay review and approval solely due to contract start-date issues, as doing so would increase the State’s risk exposure, potentially disrupt federally required programs, and hinder agencies’ compliance with federal period-of-performance requirements. To address these concerns, OSPS will formalize and issue policy guidance that clearly defines agency and OSPS roles and responsibilities in the contracting process. This guidance will expand the agency-focused section to emphasize timely submission and processing, along with the risks and implications associated with contracting delays. In advance of fiscal year-end, OSPS will issue a separate policy document and companion guidance as a spotlight topic in the monthly newsletter and posted to the intranet for agency reference. DAFS Contact: David Morris, Acting Chief Procurement Officer, OSPS, 207-624-7335 DHHS Response: The Department partially agrees with this finding. There is not a requirement to provide documentation that the Department personnel’s assertions are accurate regarding Department personnel’s review of PJFs. The Department agrees that it can improve the timing of procurement documents in relation to the start dates of the contracts. Extenuating circumstances exist periodically that prevent the timeliness of these documents. In some cases, there are delays in the grant approval at the Federal level. Delays in Legislative approval of budgets can also lead to procurement documentation delays. DHHS Contact: Jim Lopatosky, Director, Division of Contract Management, DHHS, 207-287-5075 Auditor’s Concluding Remarks: 2 CFR 200.303 requires the Department to establish, document, and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. Absent adequate documentation to support the veracity of the assertions made on the PJF by program personnel, the best value for the State cannot be ensured. The finding remains as stated. (State Number: 25-1109-04)

(2025-058) Title: Internal control over Foster Care and Adoption Assistance cash management needs improvement Prior Year Findings: None State Department: Health and Human Services Administrative and Financial Services State Bureau: Office of Child and Family Services Health and Human Services Service Center Federal Agency: U.S. Department of Health and Human Services Assistance Listing Title: Foster Care – Title IV-E Adoption Assistance – Title IV-E Assistance Listing Number: 93.658; 93.659 Federal Award Identification Number: See E-65 to E-66 Compliance Area: Cash management Type of Finding: Significant deficiency Questioned Costs: None Criteria: 2 CFR 200.303; 2 CFR 200.302; 31 CFR 205.33; State Administrative and Accounting Manual (SAAM) Section 50.40.80 The Department must establish, document, and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. Financial records must adequately identify the source and application of funds and provide accountability for all funds, property, and other assets related to the Federally-funded activities. The Department must minimize the time between the drawdown of Federal funds and the disbursement of these funds for Federal program purposes. The timing and amount of fund transfers must be as close as administratively feasible to the Department’s actual cash outlay for program costs. Section 50.40.80 of the SAAM has defined administratively feasible as no more than 7 business days. Condition: The Office of Child and Family Services administers the Foster Care – Title IV-E (Foster Care) and Adoption Assistance – Title IV-E (Adoption Assistance) programs for the State. The programs are designed to help states provide safe and stable out-of-home care for children under its jurisdiction until the children are returned home safely, placed with adoptive families, or placed in other planned arrangements for permanency. The Department of Health and Human Services’ Service Center (DHHS SC) is responsible for the drawdown of Federal funds and grant accounting and reporting for the Foster Care and Adoption Assistance programs. Though DHHS SC monitors compliance with Federal cash management requirements by utilizing a cash on hand analysis, the analysis combines the following Title IV-E programs: • Foster Care • Adoption Assistance • Title IV-E Prevention Program • Guardianship Assistance As a result, Department procedures do not ensure that each individual program is in compliance with Federal cash management requirements. The Office of the State Auditor performed individual analyses for the Foster Care and Adoption Assistance programs and determined that both programs complied with cash management requirements for fiscal year 2025. Context: In fiscal year 2025, there were: • 52 Federal grant drawdowns totaling $21.5 million for the Foster Care program. • 50 Federal grant drawdowns totaling approximately $35 million for the Adoption Assistance program. Cause: • Lack of adequate procedures to ensure that the cash balance for each Title IV-E program is considered separately before requesting Federal funds • Lack of supervisory oversight Effect: Department policies and procedures would not identify noncompliance with cash management requirements, which could result in: • the Federal government imposing more stringent program-specific cash management requirements based on noncompliance. • the State incurring an interest liability on excess Federal cash balances. • noncompliance with Federal regulations. Recommendation: We recommend that the Department enhance existing procedures and increase oversight to ensure that Federal program cash balances are tracked by program in accordance with Federal requirements. Corrective Action Plan: See F-29 Management’s Response: The Departments agree with this finding. The DHHS Financial Service Center will update existing procedures and increase oversight to ensure that Federal program cash balances are tracked by program in accordance with Federal requirements by 3/31/2026. Contact: Sarah Gove, Director, DHHS Service Center, DAFS, 207-458-6626 (State Number: 25-1109-01)

(2025-059) Confidential finding, see below for more information Title: ________ Pursuant to paragraph 6.64 of the U.S. Government Accountability Office’s Government Auditing Standards (also known as the Yellow Book), we omitted details from this finding as they are confidential under the provisions of 5 MRSA 244-C (3). Though the content of this finding has been redacted, we provided the Department(s) with detailed information regarding the specific condition we identified, as well as the related criteria, context, causes, effects, and our specific recommendations for improvement. Prior Year Findings: See Schedule of Findings and Questioned Costs for chart/table Type of Finding: Significant deficiency Corrective Active Plan: See F-29 Contact: Shirley Browne, Deputy State Controller, Office of the State Controller, 207-626-8423 (State Number: 25-1109-05)

(2025-060) Title: Internal control over the Adoption Assistance – Title IV-E eligibility and benefit determination process needs improvement Prior Year Findings: See Schedule of Findings and Questioned Costs for chart/table State Department: Health and Human Services State Bureau: Office of Child and Family Services Federal Agency: U.S. Department of Health and Human Services Assistance Listing Title: Adoption Assistance – Title IV-E Assistance Listing Number: 93.659 Federal Award Identification Number: See E-65 to E-66 Compliance Area: Allowable costs/cost principles Eligibility Type of Finding: Significant deficiency Questioned costs Known Questioned Costs: $1,645 Likely Questioned Costs: Undeterminable; the Office of the State Auditor (OSA) selected a sample of clients who received Title IV-E benefits during fiscal year 2025 and identified known questioned costs for 1 client based on various eligibility attributes. Since each exception is unique to the client, a projection of questioned costs cannot be reasonably estimated. Criteria: 2 CFR 200.303; 2 CFR 200.403; 45 CFR 1356.40 The Department must establish, document, and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. To be allowable under Federal awards, costs must be necessary and reasonable for the performance of the Federal award and be adequately documented. The State is allowed to pay a portion of the Federal Adoption Assistance maintenance payments and claim Federal financial participation for Title IV-E eligible clients. Condition: The Adoption Assistance – Title IV-E (Adoption Assistance) program provides Federal funds to states to facilitate the timely placement of children, whose special needs or circumstances would otherwise make them difficult to place, with adoptive families. Funds are available for a one-time payment to assist with the costs of adopting a child as well as for subsidies to adoptive families to assist with the care of the eligible child on an ongoing basis. The Office of Child and Family Services (OCFS) administers the Adoption Assistance program for the State. OCFS financial resource specialists (FRS) are responsible for determining program eligibility and initiating benefits. The FRS uses the Adoption Assistance Checklist to ensure that program eligibility factors, required supporting information, and final determination for Federal Adoption Assistance benefits are obtained and documented. Once the client is determined eligible in the child welfare information system, a daily rate is negotiated by OCFS and the adoptive parents at a rate that does not exceed what the client would qualify for under the Foster Care – Title IV-E program. OSA tested 60 client benefit payments and identified that: • 1 adoptive parent continued to receive Adoption Assistance maintenance payments after OCFS was informed that the client moved out of the home. In addition, the client’s clothing allowance payment was erroneously sent to the individual they were living with at the time of issuance instead of the adoption placement. The client received a daily Adoption Assistance rate of $26.25, resulting in questioned costs of $1,645 during fiscal year 2025. • 1 client, who was eligible for Adoption Assistance, erroneously received a State-funded Foster Care childcare payment while also receiving Federally-funded Adoption Assistance childcare payments during fiscal year 2025. • 1 client, who was eligible for Adoption Assistance, erroneously received 2 weeks of State-funded Foster Care maintenance payments while also receiving Federally-funded Adoption Assistance maintenance payments during fiscal year 2025. OSA selected a non-statistical random sample. Context: In fiscal year 2025, the State provided approximately 4,500 Adoption Assistance clients with $25.5 million in Federal benefits. Cause: • Lack of adequate policies and procedures over verification and accuracy of benefit determinations and associated Adoption Assistance payments • Lack of supervisory oversight Effect: • Known questioned costs • Potential future questioned costs and disallowances • Noncompliance with Federal and State regulations Recommendation: We recommend that the Department enhance policies and procedures and increase oversight to ensure the accuracy of eligibility and benefit determinations, and verify that benefit payments are made in accordance with Federal regulations. Corrective Action Plan: See F-29 Management’s Response: The Department agrees with this finding. The Department will develop training information for distribution to child welfare staff defining steps for them to take when they discover that a child in an adoption assistance agreement is no longer receiving support from the adoptive parents. These steps will raise the information to the OCFS Adoption Unit Manager's attention so they can take appropriate actions. Contact: Denise Merrill, Manager of Child Welfare Statewide Programs, DHHS, 207-822-2255 (State Number: 25-1110-01)

(2025-061) Title: Internal control over Medicaid Nursing Facility audits needs improvement Prior Year Findings: See Schedule of Findings and Questioned Costs for chart/table State Department: Health and Human Services State Bureau: Division of Audit Federal Agency: U.S. Department of Health and Human Services Assistance Listing Title: Medicaid Cluster Assistance Listing Number: 93.775, 93.777, 93.778 Federal Award Identification Number: See E-65 to E-66 Compliance Area: Special tests and provisions Type of Finding: Material weakness Material noncompliance Questioned Costs: None Criteria: 2 CFR 200.303; 42 CFR 447.253(g); MaineCare Benefits Manual, Chapter III, Section 67 The Department must establish, document, and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. The Department is required to provide for the periodic audits of the financial and statistical records of participating providers. The MaineCare Benefits Manual (MCBM) Chapter III, Section 67 outlines the documentation and support required to be included in a provider’s annual cost report filing submission to the Division of Audit. The Division of Audit’s requirements for reviewing the cost reports and performing uniform desk reviews is also outlined. Section 67 states that the Division of Audit must perform a uniform desk review on each Nursing Facility (NF) cost report submission within 365 days of receipt of an acceptable cost report filing. Condition: For each participating Long Term Care Facility, the Department must provide for the filing of uniform cost reports in order to establish payment rates and must provide for the periodic audits of financial and statistical records. The specific audit requirements will be established by the State plan. The MCBM states uniform desk reviews shall be completed within 365 days after receipt of an acceptable cost report filing, including financial statements and other information requested from the provider, except in unusual situations including, but not limited to, delays in obtaining necessary information from a provider. Unless the Division of Audit intends to schedule an on-site audit or an unusual situation referenced above exists, a written summary report of findings and adjustments shall be issued upon completion of the uniform desk review. The Division of Audit did not complete NF audits in accordance with Federal regulations. The population of NF uniform desk reviews due for completion in fiscal year 2025 was 88. Of those 88 uniform desk reviews, none were completed at the time of audit testing in October 2025. Context: During fiscal year 2025, the Department: • provided $270.4 million in Federal Medicaid funding and $112.0 million in State Medicaid funding to NFs. • completed 61 NF uniform desk reviews related to prior fiscal years. Cause: Lack of resources Effect: • Noncompliance with Federal and State regulations • The determination of amounts owed to or from NFs is delayed. Recommendation: We recommend that the Department reallocate resources to address the backlog of NF uniform desk reviews. Timely audit issuance will minimize the impact on providers of potential payables and receivables. Corrective Action Plan: See F-30 Management’s Response: The Department agrees with this finding. Progress toward compliance is taking longer than expected due to continued difficulty in hiring staff and the completion of COVID related audit work. The COVID audit work is still hindering the audit process. However, recent changes to the Nursing Facility reimbursement methodology, effective January 1, 2025, reduce the amount of testing required in these audits. Contact: Herb Downs, Director, Division of Audit, DHHS, 207-287-2403 (State Number: 25-1106-01)

(2025-062) Title: Internal control over Medicaid drug rebates needs improvement Prior Year Findings: See Schedule of Findings and Questioned Costs for chart/table State Department: Health and Human Services State Bureau: Office of MaineCare Services Federal Agency: U.S. Department of Health and Human Services Assistance Listing Title: Medicaid Cluster Assistance Listing Number: 93.775, 93.777, 93.778 Federal Award Identification Number: See E-65 to E-66 Compliance Area: Allowable costs/cost principles Type of Finding: Significant deficiency Questioned Costs: None Criteria: 2 CFR 200.303; Section 1927 of the Social Security Act (42 USC 1396r-8) The Department must establish, document, and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. Section 1927 of the Social Security Act requires manufacturers that wish to have their outpatient drugs covered by Medicaid to enter into an agreement with the Centers for Medicare & Medicaid Services (CMS), under which the manufacturers agree to pay rebates for drugs dispensed and paid for by the State Medicaid agencies under the State plan. Drug rebates are shared between the State and Federal government. Condition: Drug manufacturers are required to submit a list of all covered outpatient drugs, along with each drug’s average manufacturer price and “best price” to CMS. Utilizing this information, CMS calculates a unit rebate amount (URA) for each covered outpatient drug and provides the amounts to the State on a quarterly basis. The Department is required to maintain drug utilization data that identifies, by National Drug Code (NDC), the number of units of each covered outpatient drug for which the Department has paid pharmacy providers. The utilization data is provided to CMS and the manufacturers. The number of dispensed units is applied to the URA to determine the rebate amount due from each manufacturer. The State contracts with a vendor to calculate the drug rebate amounts and invoice manufacturers for drug rebates. The Office of the State Auditor (OSA) identified that the Department does not have adequate procedures in place to ensure the accuracy and completeness of the drug rebate amounts invoiced by the vendor. Audit procedures identified that: • prior to issuing invoices, the Department reviews a sample of 10 invoices to ensure the drugs are rebatable and accurately calculated; however, the invoices are judgmentally selected and not based on risk. • though the Department reviews invoiced drug rebates for reasonableness, this review is performed at a summary level and after the invoicing cycle. Context: In fiscal year 2025, the State invoiced approximately $300 million for rebatable drugs. Cause: • Lack of adequate procedures • Lack of supervisory oversight Effect: • Inaccurate or incomplete invoicing of drug rebates would result in overpayments or underpayments to the State and Federal government. • Noncompliance with Federal regulations Recommendation: We recommend that the Department implement procedures to confirm the drug rebate amounts calculated and invoiced by the vendor are accurate and complete. These procedures should occur prior to issuing invoices and provide adequate coverage of the drug rebates invoiced, including: • validating that only rebatable drugs are invoiced; • verifying that all rebatable drugs are included for invoicing; • comparing drug utilization data to the number of dispensed units invoiced; and • corroborating the correct URA is applied to each NDC. This will ensure that correct drug rebate amounts are returned to the State and Federal government. Corrective Action Plan: See F-30 Management’s Response: The Department disagrees with this finding. Drug Rebate pre-invoicing and post-invoicing is completed quarterly. As demonstrated during walkthroughs and during our meetings Maine completes specific tasks to ensure accuracy of the invoicing process. The pre-invoicing and post-invoicing procedures are documented in the Pharmacy Rebate Information Management System (PRIMS) Desk Level Procedure (DLP). The pre-invoicing work is performed by the State that compares drug utilization data to the number of dispensed units invoiced. Upon the completion of the pre-invoicing review approval is provided to the vendor allowing them to continue with the invoicing process. There is no requirement on how we select our sample of invoices to review. Based on OSA noting no exceptions to the drug rebate amounts, our system in place to review invoiced drug rebates is functioning as intended. Contact: Michelle Probert, Director, Office of MaineCare Services, DHHS, 207-287-2093 Auditor’s Concluding Remarks: The procedures mentioned in Management’s Response only address whether the drug rebate information presented by the vendor for invoicing by the Department is reasonable. The Department’s procedures do not independently substantiate that all rebatable drugs are included for invoicing. Furthermore, the existing invoice review procedures address only a limited number of invoices and dispensed units, are performed at a summary level and do not consider risk factors. As a result, the Department does not have adequate assurance that all rebatable drugs are invoiced accurately and completely. The finding remains as stated. (State Number: 25-1106-05)

(2025-063) Title: Internal control over Medicaid SEFA reporting needs improvement Prior Year Findings: None State Department: Administrative and Financial Services State Bureau: Health and Human Services Service Center Federal Agency: U.S. Department of Health and Human Services Assistance Listing Title: Medicaid Cluster Assistance Listing Number: 93.775, 93.777, 93.778 Federal Award Identification Number: See E-65 to E-66 Compliance Area: Reporting Type of Finding: Significant deficiency Questioned Costs: None Criteria: 2 CFR 200.303; 2 CFR 200.510 The Department must establish, document, and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. The Department must prepare a Schedule of Expenditures of Federal Awards (SEFA) for the period covered by the State’s financial statements which must include the total Federal awards expended. At a minimum, the SEFA must include the total amount provided to subrecipients from each Federal program. Condition: The Department of Health and Human Services’ Service Center must complete and submit exhibits and related schedules to the Office of the State Controller (OSC) at the close of each fiscal year to report Federal award information for inclusion on the State’s SEFA. OSC is responsible for compiling this information on behalf of the State. The Office of the State Auditor reviewed amounts reported on the SEFA and identified $11.8 million of Federal expenditures incorrectly reported as amounts provided to subrecipients that should have been reported as direct expenditures. OSC subsequently corrected the SEFA. Context: In fiscal year 2025, Federal Medicaid expenditures totaled $3.4 billion. Cause: • Lack of adequate policies and procedures • Lack of supervisory oversight Effect: Inaccurate reporting of expenditure amounts on the SEFA, which is submitted to the Federal government, may result in incorrect information used for programmatic, policy, or statistical purposes. Recommendation: We recommend that the Department implement policies and procedures to ensure expenditures are appropriately classified and reported on the SEFA. Corrective Action Plan: See F-31 Management’s Response: The DHHS and the DHHS Financial Service Center agree with this finding. The DHHS Financial Service Center will update policies and procedures to ensure expenditures are appropriately classified and reported on the SEFA by February 2026. Contact: Sarah Gove, Director, DHHS Service Center, DAFS, 207-458-6626 (State Number: 25-1106-03)

(2025-064) Title: Internal control over Medicaid utilization control needs improvement Prior Year Findings: None State Department: Health and Human Services State Bureau: Office of MaineCare Services Federal Agency: U.S. Department of Health and Human Services Assistance Listing Title: Medicaid Cluster Assistance Listing Number: 93.775, 93.777, 93.778 Federal Award Identification Number: See E-65 to E-66 Compliance Area: Special tests and provisions Type of Finding: Significant deficiency Questioned Costs: None Criteria: 2 CFR 200.303; 42 CFR 456.3 and .23 The Department must establish, document, and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. Utilization control requirements are applicable to all services provided under a State plan. The State Medicaid Agency (SMA) must implement a statewide surveillance and utilization control program that provides for the oversight and monitoring of all services provided under the State plan, including procedures for ongoing post-payment review of all Medicaid services. The post-payment review must identify exceptions so that the SMA can correct misutilization practices of beneficiaries and providers on a timely basis. Condition: The Department’s Office of MaineCare Services’ Program Integrity Unit (PIU) is responsible for implementing and monitoring the State’s Medicaid utilization control (UC) program. A Medicaid UC program is a State-mandated, Federally-required system that monitors and manages the appropriateness, quality, and necessity of all medical services, and includes a sampling plan and post-payment review process designed to provide an ongoing evaluation of Medicaid beneficiaries and providers. PIU’s UC program includes a monthly sampling plan that relies on various data analytics. The results of the data analytics are reviewed to determine the extent of beneficiary or provider post-payment reviews. The Office of the State Auditor (OSA) reviewed PIU’s policies and procedures, the monthly sampling plan, and a selection of post-payment review files, and performed data analytics to determine the appropriateness of the design and implementation of the UC program. PIU could not provide documentation of the methodology used to identify projects and post-payment reviews performed in relation to surveillance of all Medicaid services provided under the State plan. Additionally, a sampling plan relying on data analytics as a source of post-payment review limits the scope of the UC program to only what can be identified through data anomalies. PIU’s sampling plan does not document consideration of misutilization practices of beneficiaries or providers. As a result, OSA could not determine the completeness of the UC program. Context: In fiscal year 2025, the State paid $3.2 billion to approximately 10,600 providers, including $2.5 billion in Federal funds. Cause: Lack of adequate policies and procedures Effect: PIU’s UC program may not provide adequate monitoring of all Medicaid services, resulting in potential noncompliance with Federal regulations. Recommendation: We recommend that the Department document policies and procedures to ensure that PIU’s UC program is designed to provide ongoing monitoring and evaluation of all Medicaid services provided under the State plan, and that documentation to support the extent of such monitoring is properly maintained. Corrective Action Plan: See F-31 Management’s Response: The Department disagrees with this finding. This finding represents a misunderstanding of the applicable federal regulations and the state entity responsible for compliance. A Utilization Control (UC) program is the responsibility of the State Medicaid Agency as a whole, not the Program Integrity Unit (PIU). Additionally, there are many more federal regulations governing UC programs than cited by the Office of State Auditor (OSA) in the finding and touch on a host of controls that were not reviewed or considered in this audit. Moreover, the OSA appears to be basing findings on interpretations that are unsupported by the regulatory text cited. Second, the OSA confuses PIU's annual review plan (a yearly plan of focused program integrity areas of focus and review) with an agency-wide UC program: these are not the same, nor are they required to be. The Department's current processes for PIU's annual review plan were implemented in response to OSA findings in 2015 relating to an OSA finding that the Department was not fully utilizing available data analytics. In the intervening years, the OSA has not found Program Integrity's annual review plan, or the process of developing the plan, to be deficient. There has been no change in the Department's process or the regulation to justify the OSA's newly found position here. The OSA's criticism of PIU's use of data analytics contradicts a prior OSA findings on data analytics use, is contrary to accepted Department adjustments made in response, and represents a significant departure from federal guidance and industry standards around best practices for leveraging data analytics to prevent and detect improper payments and/or utilization. The PIU's annual review plan supplements post-payment reviews that PIU conducts based upon complaints and referrals. Finally, this finding’s singular focus on PIU's annual review plan fails to account for a myriad of other systems and processes the Department has in place to monitor utilization, including, but not limited to: 1. A contracted vendor (HMS) performing post-payment reviews of hospitals, nursing facilities, and other long-term care facilities; 2. MaineCare's Case Mix unit - performing look back reviews of documentation and services in nursing facilities and other long-term care units; 3. A contracted vendor (Acentra) reviewing authorization requests for behavioral health services and continuing stay reviews of services at designated intervals; 4. A contracted vendor (Maximus) that performs assessments and authorizations for nursing and personal care services; 5. A contracted vendor (Optum) that performs prior authorization reviews for pharmacy services and produces a variety of reports on drug utilization; 6. Fiscal intermediaries performing oversight and administrative support for self-directed services; 7. State staff who review and approve plans of care for Home and Community Based Waiver Services and conduct quality reviews of providers; 8. State staff performing quality assurance reviews of providers of mental and behavioral health services; 9. State staff monitoring and addressing inappropriate emergency department usage by beneficiaries; and 10. State staff with oversight and performing qualitative and quantitative reviews of a variety of programs operated under delivery service reform, including: Accountable Communities, Behavioral Health Homes, Certified Community Behavioral Health Clinics, Community Care Teams, MaineMOM, Opioid Health Homes, and Primary Care Plus. 11. State and contracted vendor (Gainwell) staff reviewing medical necessity and other allowability for medical services requiring prior authorization for initial requests and renewals. 12. A CMS-compliant Electronic Visit Verification (EVV) system, in accordance with Section 12006 of the 21st Century Cures Act, that ensures payment for applicable services is tied to an EVV record demonstrating that the service occurred; data from the system also contributes to post-payment reviews for applicable services. Contact: Michelle Probert, Director, Office of MaineCare Services, DHHS, 207-287-2093 Auditor’s Concluding Remarks: PIU’s Policy and Procedure Handbook identifies PIU as the office responsible for ensuring the Medicaid program is in compliance with 42 CFR 456.3 and .23; these Federal requirements reference procedures that directly correlate to the data analysis and post-payment review processes performed by PIU. In response to the Department’s criticism of OSA’s approach, OSA develops an audit plan annually, independent of prior year audit procedures or results, in response to risks affecting each audit. In fiscal year 2025, OSA’s procedures performed over UC requirements were tailored in response to identified risks and should not be designed to support audit results from prior years; those procedures identified a population of Medicaid providers that PIU could not provide documentation to support monitoring had been performed. These providers and services do not appear to be included in the “other systems and processes” listed in Management’s Response. The finding remains as stated. (State Number: 25-1106-04)

(2025-065) Title: Internal control over Medicaid procurement needs improvement Prior Year Findings: None State Department: Administrative and Financial Services Health and Human Services State Bureau: Office of State Procurement Services Division of Contract Management Office of MaineCare Services Federal Agency: U.S. Department of Health and Human Services Assistance Listing Title: Medicaid Cluster Assistance Listing Number: 93.775, 93.777, 93.778 Federal Award Identification Number: See E-65 to E-66 Compliance Area: Procurement and suspension and debarment Type of Finding: Significant deficiency Questioned Costs: None Criteria: 2 CFR 200.303; 2 CFR 200.317; 5 MRSA 1825-B and D; Office of State Procurement Services (OSPS) policies The Department must establish, document, and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. The Department must follow the same policies and procedures it uses for procurements with non-Federal funds. Awards shall be made to the best-value bidder, taking into consideration the best interest of the State. The requirement to competitively bid a contract may be waived if specific criteria is met, including the item or service can only be procured from one source or it is an emergency procurement. Each bid, with the name of the bidder, must be entered on record. Each record, with the successful bid indicated, must be open to public inspection after the letting of the contract. The Department must justify the selection of vendor, either through competitive or noncompetitive process, and provide a detailed explanation of cost, demonstrating how the best value for the State is ensured. The Chief Procurement Officer shall make the public aware of contracts and grants for which bids are being requested and communicate the procedure used in reviewing bids. Contracts must be submitted to OSPS at least 14 days prior to the contract start date. A Notice of Intent to Waive the Competitive Bidding Process (NOI) must be posted to the OSPS website for 7 calendar days prior to the start of a noncompetitively bid contract. Condition: The Medicaid program is administered by the Office of MaineCare Services (OMS). OSPS is the central oversight agency for all State procurement. The Department of Health and Human Services (DHHS) Division of Contract Management (DCM) oversees the solicitation and contract implementation for all DHHS procurement. DCM coordinates with DHHS program personnel to evaluate and select vendors and subrecipients, determine contract terms, and provide required documentation to OSPS. OSPS is responsible for reviewing and approving Procurement Justification Forms (PJFs) submitted by DCM on behalf of program personnel prior to the award of contracts. The PJF represents program personnel’s assertion that the selected procurement method is appropriate under applicable State and Federal requirements, and that required evaluation procedures have been performed. OSPS must publicly post a NOI for all procurements over $10,000 entered into without a competitive process for a minimum of 7 calendar days prior to the start of the contract. The NOI includes the signed PJF provided to OSPS by DCM. The Office of the State Auditor (OSA) tested 26 contracts, 6 procured competitively and 20 procured noncompetitively, that accounted for $42.8 million of the $91.3 million in Medicaid procurement-related transactions in fiscal year 2025 and found: • PJFs were reviewed for reasonableness by DCM and OSPS, but DHHS could not provide documentation to support the assertions made by OMS were accurate. • For 18 contracts, DCM provided the PJF to OSPS for their review after the contract had commenced, between 5 and 152 days after the contract start date. For 18 contracts, OSPS approved the PJF after the contract commenced, between 7 and 182 days after the contract start date. For 2 contracts, documentary evidence of PJF approval by OSPS could not be provided. • For 9 noncompetitive contracts, OSPS posted the NOI after contract performance had commenced, between 7 and 169 days after the contract start date. For 7 of these contracts, services had been initiated and financial obligations incurred prior to the NOI. OSA utilized a risk-based approach to select 6 contracts issued by OMS and a non-statistical random sample of all other contracts. Context: In fiscal year 2025, the Department expended $91.3 million in procurement-related transactions from Medicaid funds of $3.4 billion. Cause: • Lack of adequate policies and procedures • Lack of supervisory oversight Effect: • Potential questioned costs and future disallowances • Noncompliance with Federal and State procurement requirements, including NOI posting requirements, could result in the need to void a contract or exposure to legal proceedings. Recommendation: We recommend that OSPS: • increase agency awareness of the procedures related to the timing of procurement contract documentation being submitted to OSPS for review prior to the contract start date; and • finalize and implement an updated procurement policy and procedure manual that identifies the parties responsible for key aspects of the procurement process. We also recommend that DCM and OMS develop policies and procedures and increase oversight to ensure all procurement transactions comply with Federal and State requirements, including: • DCM obtaining and reviewing documentation to support the assertions made by OMS for accuracy and reasonableness; and • ensuring PJFs are completed, reviewed, and submitted to OSPS prior to the contract start date. Corrective Action Plan: See F-32 Management’s Response: DAFS Response: The Department agrees with this finding. OSPS does not authorize, encourage, or approve agencies allowing vendors to perform work at risk. However, OSPS also does not delay review and approval solely due to contract start-date issues, as doing so would increase the State’s risk exposure, potentially disrupt federally required programs, and hinder agencies’ compliance with federal period-of-performance requirements. To address these concerns, OSPS will formalize and issue policy guidance that clearly defines agency and OSPS roles and responsibilities in the contracting process. This guidance will expand the agency-focused section to emphasize timely submission and processing, along with the risks and implications associated with contracting delays. In advance of fiscal year-end, OSPS will issue a separate policy document and companion guidance as a spotlight topic in the monthly newsletter and posted to the intranet for agency reference. DAFS Contact: David Morris, Acting Chief Procurement Officer, OSPS, 207-624-7335 DHHS Response: The Department partially agrees with this finding. There is not a requirement to provide documentation that the Department personnel’s assertions are accurate regarding Department personnel’s review of PJFs. The Department agrees that it can improve the timing of procurement documents in relation to the start dates of the contracts. Extenuating circumstances exist periodically that prevent the timeliness of these documents. In some cases, there are delays in the grant approval at the Federal level. Delays in Legislative approval of budgets can also lead to procurement documentation delays. DHHS Contact: Jim Lopatosky, Director, Division of Contract Management, DHHS, 207-287-5075 Auditor’s Concluding Remarks: 2 CFR 200.303 requires the Department to establish, document, and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. Absent adequate documentation to support the veracity of the assertions made on the PJF by program personnel, the best value for the State cannot be ensured. The finding remains as stated. (State Number: 25-1106-06)

(2025-066) Confidential finding, see below for more information Title: ________ Pursuant to paragraph 6.64 of the U.S. Government Accountability Office’s Government Auditing Standards (also known as the Yellow Book), we omitted details from this finding as they are confidential under the provisions of 5 MRSA 244-C (3). Though the content of this finding has been redacted, we provided the Department(s) with detailed information regarding the specific condition we identified, as well as the related criteria, context, causes, effects, and our specific recommendations for improvement. Prior Year Findings: See Schedule of Findings and Questioned Costs for chart/table Type of Finding: Significant deficiency Corrective Active Plan: See F-33 Contact: Shirley Browne, Deputy State Controller, Office of the State Controller, 207-626-8423 (State Number: 25-0900-02)

(2025-067) Confidential finding, see below for more information Title: ________ Pursuant to paragraph 6.64 of the U.S. Government Accountability Office’s Government Auditing Standards (also known as the Yellow Book), we omitted details from this finding as they are confidential under the provisions of 5 MRSA 244-C (3). Though the content of this finding has been redacted, we provided the Department(s) with detailed information regarding the specific condition we identified, as well as the related criteria, context, causes, effects, and our specific recommendations for improvement. Prior Year Findings: None Type of Finding: Significant deficiency Corrective Active Plan: See F-33 Contact: Shirley Browne, Deputy State Controller, Office of the State Controller, 207-626-8423 (State Number: 25-0900-03)

(2025-068) Confidential finding, see below for more information Title: ________ Pursuant to paragraph 6.64 of the U.S. Government Accountability Office’s Government Auditing Standards (also known as the Yellow Book), we omitted details from this finding as they are confidential under the provisions of 5 MRSA 244-C (3). Though the content of this finding has been redacted, we provided the Department(s) with detailed information regarding the specific condition we identified, as well as the related criteria, context, causes, effects, and our specific recommendations for improvement. Prior Year Findings: None Type of Finding: Significant deficiency Corrective Active Plan: See F-34 Contact: Shirley Browne, Deputy State Controller, Office of the State Controller, 207-626-8423 (State Number: 25-0900-04)

(2025-069) Title: Internal control over DG – PA program special reporting needs improvement Prior Year Findings: See Schedule of Findings and Questioned Costs for chart/table State Department: Defense, Veterans and Emergency Management State Bureau: Maine Emergency Management Agency Federal Agency: U.S. Department of Homeland Security Assistance Listing Title: Disaster Grants – Public Assistance (Presidentially Declared Disasters) (COVID-19) Assistance Listing Number: 97.036 Federal Award Identification Number: See E-65 to E-66 Compliance Area: Reporting Type of Finding: Material weakness Material noncompliance Questioned Costs: None Criteria: 2 CFR 200.303; 2 CFR 170 The Department must establish, document, and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. Agencies must report each subaward that equals or exceeds the first-tier subaward threshold of $30,000 in Federal funds in the public-facing Federal Funding Accountability and Transparency Act (FFATA) System for Award Management (SAM). Condition: When an amount exceeding the first-tier subaward threshold is awarded to a subrecipient of the Disaster Grants – Public Assistance (DG – PA) program, Maine Emergency Management Agency (MEMA) must collect and enter data into SAM. The Office of the State Auditor (OSA) tested 60 DG – PA program subawards totaling $16,759,534 that exceeded the first-tier subaward threshold. Federal regulations require the following information for identified noncompliance to be included in FFATA findings: • 11 subawards totaling $4,106,246 were not reported; • 60 subawards totaling $16,759,534 were not reported timely; • 10 subaward amounts were reported incorrectly; and • 49 subawards reported incorrect key data elements. OSA selected a non-statistical random sample. Context: In fiscal year 2025, MEMA was required to report 574 first-tier subawards totaling $135.6 million under the DG – PA program. First-tier subawards account for 84 percent of the program’s fiscal year 2025 expenditures. Cause: Lack of resources Effect: • Noncompliance with Federal regulations • Accurate first-tier subaward information for the DG – PA program was not reported to the Federal government timely and included inaccurate or incomplete information. This information may be used for programmatic, policy, or statistical purposes. Recommendation: We recommend that the Department allocate resources to ensure that first-tier subawards are reported accurately, timely, and in accordance with Federal regulations. Corrective Action Plan: See F-34 Management’s Response: The Department agrees with this finding. Corrective action was implemented beginning in November of 2025. Untimely or missing reports were primarily due to staff turnover in the agency, which has been remedied by successful recruitment efforts. Incorrect data elements were attributed to an ineffective element of the prior reporting process, which increased the reporting burden by tasking staff with creating ad-hoc unique identifiers rather than using existing unique identifiers. In the monthly reporting process since November 2025, federally assigned project numbers are used to distinctly identify each subaward, and reporting personnel retrieve obligation reports directly from the relevant federal system, minimizing the overall staff burden in reporting. Contact: Sunny Cyr, MEMA Business Office Director, DVEM, 207-707-2507 (State Number: 25-1502-03)

(2025-070) Title: Internal control over DG – PA program financial reporting needs improvement Prior Year Findings: See Schedule of Findings and Questioned Costs for chart/table State Department: Defense, Veterans and Emergency Management State Bureau: Maine Emergency Management Agency Federal Agency: U.S. Department of Homeland Security Assistance Listing Title: Disaster Grants – Public Assistance (Presidentially Declared Disasters) (COVID-19) Assistance Listing Number: 97.036 Federal Award Identification Number: See E-65 to E-66 Compliance Area: Reporting Type of Finding: Significant deficiency Questioned Costs: None Criteria: 2 CFR 200.303; 2 CFR 200.302 The Department must establish, document, and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. The Department must maintain accurate, current, and complete disclosure of the financial results of each Federal award or program in accordance with reporting requirements. Condition: The Maine Emergency Management Agency (MEMA) administers the Disaster Grants – Public Assistance (DG – PA) program for the State. MEMA is required to submit quarterly DG – PA program Federal Financial Reports (FFRs) to the Federal Emergency Management Agency (FEMA) Regional Office. FFRs provide FEMA with the status of funds for the award, Federal expenditures, and cost-sharing requirements. The Office of the State Auditor (OSA) tested 7 FFRs due in fiscal year 2025 and found deficiencies in 6, as follows: • 1 FFR inaccurately reported total Federal funds authorized as $442,026,321 when the correct total was $442,015,638, and the recipient share of expenditures as $19,499,834 when the correct share was $7,338,371; • 1 FFR inaccurately reported total Federal funds authorized as $16,582,190 when the correct total was $16,560,302, and the recipient share of expenditures as $13,249,493 when the correct share was $5,367,072; • 1 FFR inaccurately reported total Federal funds authorized as $17,805,320 when the correct total was $17,142,335; • 1 FFR inaccurately reported the recipient share of expenditures as $13,077,332 when the correct share was $13,081,295; • 1 FFR inaccurately reported the recipient share of expenditures as $4,698,599 when the correct share was $3,893,046; and • 1 FFR inaccurately reported the recipient share of expenditures as $778,776 when the correct share was $199,157. OSA selected a non-statistical random sample. Context: During fiscal year 2025, 45 FFRs were required to be filed by MEMA for the DG – PA program. Cause: • Lack of adequate policies and procedures to ensure data used for financial reporting is complete and accurate • Lack of supervisory oversight Effect: • Noncompliance with Federal reporting requirements • Inaccurate tracking of subawards may result in noncompliance with Federal matching requirements. Recommendation: We recommend that MEMA enhance policies and procedures to ensure that FFRs are accurate and include all required information for compliance with Federal reporting requirements. Corrective Action Plan: See F-34 Management’s Response: The Department agrees with this finding. The Department will publish and implement a revised Federal Financial Reporting procedure to fully preserve reporting/validation source material and clearly document the justification for any variances from the source material. Contact: Sunny Cyr, MEMA Business Office Director, DVEM, 207-707-2507 (State Number: 25-1502-04)

(2025-071) Title: Internal control over DG – PA program subrecipient audit procedures needs improvement Prior Year Findings: None State Department: Defense, Veterans and Emergency Management State Bureau: Maine Emergency Management Agency Federal Agency: U.S. Department of Homeland Security Assistance Listing Title: Disaster Grants – Public Assistance (Presidentially Declared Disasters) (COVID-19) Assistance Listing Number: 97.036 Federal Award Identification Number: See E-65 to E-66 Compliance Area: Subrecipient monitoring Type of Finding: Significant deficiency Questioned Costs: None Criteria: 2 CFR 200.303; 2 CFR 200.332; 2 CFR 200.521 The Department must establish, document, and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. The Department must follow up and ensure that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the Federal award provided to the subrecipient from the pass-through entity detected through audits, on-site reviews, and written confirmation from the subrecipient, highlighting the status of actions planned or taken to address Single Audit findings related to the particular subaward. The Department must issue a management decision for audit findings that relate to Federal awards provided to the subrecipient within 6 months of acceptance of the audit report by the Federal Audit Clearinghouse (FAC). Condition: The Maine Emergency Management Agency (MEMA) administers the Disaster Grants – Public Assistance (DG – PA) program for the State. MEMA is required to verify and document that Single Audits have been completed in the FAC and issue a management decision for audit findings related to awards to subrecipients. The Office of the State Auditor (OSA) tested 4 DG – PA program subrecipients subject to Single Audit requirements and found that documentation of review for 2 subrecipients could not be provided. OSA selected a non-statistical random sample. Context: In fiscal year 2025, the Department expended $160.5 million in DG – PA program funds, of which $154.6 million was provided to 27 subrecipients. Cause: • Lack of supervisory oversight • Lack of adequate policies and procedures Effect: • Noncompliance with Federal regulations • Subrecipients not complying with Federal statutes, regulations, or the terms and conditions of subawards may not be implementing appropriate corrective action in response to audit findings. Recommendation: We recommend that the Department enhance policies and procedures to ensure that adequate documentation is maintained and that subrecipient audits are received, reviewed, and appropriate action is taken in response to audit findings. Corrective Action Plan: See F-34 Management’s Response: The Department agrees with this finding. The Department will publish and implement an updated subrecipient monitoring procedure to require more extensive and narrative documentation of the single audit review process, including: - a list of subrecipients required to file a single audit report for a given audit year - whether or not an audit had been filed as of the review date - analysis of audit findings as relevant - summary of required actions per the subrecipient monitoring procedure, and/or updates on actions/communications since the prior review period as relevant Contact: Sunny Cyr, MEMA Business Office Director, DVEM, 207-707-2507 (State Number: 25-1502-05)

(2024-016) Title: Internal control over Unemployment Insurance financial reporting needs improvement Prior Year Findings: None State Department: Labor Administrative and Financial Services State Bureau: Unemployment Compensation Security and Employment Service Center Office of the State Controller Federal Agency: U.S. Department of Labor Assistance Listing Title: Unemployment Insurance (UI) (COVID-19) Assistance Listing Number: 17.225 Federal Award Identification Number: See E-77 Compliance Area: Reporting Type of Finding: Significant deficiency Questioned Costs: None Criteria: 2 CFR 200.303; 2 CFR 200.510; Governmental Accounting, Auditing, and Financial Reporting (GAAFR), Part 5, Section A: Internal Control; State Administrative and Accounting Manual (SAAM) Chapter 80 The Department must establish and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. The Department must prepare a Schedule of Expenditures of Federal Awards (SEFA) for the period covered by the State’s financial statements which must include the total Federal awards expended. At a minimum, the SEFA must provide total Federal awards expended for each individual Federal program. The GAAFR states that a comprehensive framework of internal control is required to obtain reasonable assurance over financial reporting. The Office of the State Controller (OSC) has the responsibility to develop and maintain a system of internal controls and procedures to check the accuracy and reliability of its accounting data, promote operational efficiency, and encourage adherence to prescribed managerial policies for accounting and financial controls. Condition: The Security and Employment Service Center (SESC) is responsible for recording accounting transactions and reconciling balances between Federal funds and the State-funded Unemployment Insurance (UI) program under the Employment Security Fund (ESF). SESC is required to periodically record transfers of revenues and expenditures between Federal and State funds, which are separately presented in the State’s financial statements, but combined for SEFA reporting purposes. OSC compiles information collected from SESC in year-end closing packages for financial and SEFA reporting purposes. The Office of the State Auditor’s (OSA) audit of year-end account balances and related SEFA reporting identified a deposit of $11.6 million, representing a transfer between Federal and State UI funds, that was not accurately recorded. This resulted in the following errors: • ESF Cash & Short-Term Investments was overstated by $11.6 million, and Restricted Deposits & Investments was understated by $11.6 million on the State’s financial statements. • SEFA expenditures were overstated by $11.6 million. OSA proposed an audit adjustment to reclassify and correct the balances on the State’s financial statements and SEFA. The adjustment was recorded by OSC. Context: Before OSA’s proposed audit adjustment: • ESF Cash & Short-Term Investments and Restricted Deposits & Investments totaled $13 million and $735.2 million, respectively. • SEFA expenditures for the UI program totaled $150.7 million. Cause: Lack of supervisory oversight Effect: Before OSC corrected year-end account balances and related SEFA reporting: • ESF asset balances on the State’s financial statements were misclassified. • total expenditures reported on the SEFA were inaccurate. The SEFA is submitted to the Federal government, and errors in reporting may result in incorrect information used for programmatic, policy, or statistical purposes. Recommendation: We recommend that SESC and OSC enhance supervisory oversight to ensure that balances reported on the State’s financial statements and SEFA are accurate. Corrective Action Plan: See F-11 Management’s Response: The Department agrees with this finding. The department will further expand the procedures used to prepare and review the SEFA. Contact: Marilyn Leimbach, Director, Security and Employment Service Center, DFPS, DAFS, 207-248-2556 (State Number: 24-0308-02)

(2024-017) Confidential finding, see below for more information Title: ________ over the ________ needs improvement Pursuant to paragraph 6.63 of the U.S. Government Accountability Office’s Government Auditing Standards (also known as the Yellow Book), we omitted details from this finding as they are confidential under the provisions of 5 MRSA 244-C (3). Though the content of this finding has been redacted, we provided the Department(s) with detailed information regarding the specific condition we identified, as well as the related criteria, context, causes, effects, and our specific recommendations for improvement. Prior Year Findings: See schedule of Findings and Questioned Costs for chart/table Type of Finding: Significant deficiency Corrective Action Plan: See F-12 Contact: Shirley Browne, Deputy State Controller, Office of the State Controller, 207-626-8423 (State Number: 24-0900-02)

(2024-018) Confidential finding, see below for more information Title: ________ over the ________ needs improvement Pursuant to paragraph 6.63 of the U.S. Government Accountability Office’s Government Auditing Standards (also known as the Yellow Book), we omitted details from this finding as they are confidential under the provisions of 5 MRSA 244-C (3). Though the content of this finding has been redacted, we provided the Department(s) with detailed information regarding the specific condition we identified, as well as the related criteria, context, causes, effects, and our specific recommendations for improvement. Prior Year Findings: None Type of Finding: Significant deficiency Corrective Action Plan: See F-12 Contact: Shirley Browne, Deputy State Controller, Office of the State Controller, 207-626-8423 (State Number: 24-0900-03)

(2024-019) Confidential finding, see below for more information Title: ________ over the ________ needs improvement Pursuant to paragraph 6.63 of the U.S. Government Accountability Office’s Government Auditing Standards (also known as the Yellow Book), we omitted details from this finding as they are confidential under the provisions of 5 MRSA 244-C (3). Though the content of this finding has been redacted, we provided the Department(s) with detailed information regarding the specific condition we identified, as well as the related criteria, context, causes, effects, and our specific recommendations for improvement. Prior Year Findings: None Type of Finding: Significant deficiency Corrective Action Plan: See F-12 Contact: Shirley Browne, Deputy State Controller, Office of the State Controller, 207-626-8423 (State Number: 24-0902-01)

(2024-020) Confidential finding, see below for more information Title: ________ over ________ and ________ needs improvement Pursuant to paragraph 6.63 of the U.S. Government Accountability Office’s Government Auditing Standards (also known as the Yellow Book), we omitted details from this finding as they are confidential under the provisions of 5 MRSA 244-C (3). Though the content of this finding has been redacted, we provided the Department(s) with detailed information regarding the specific condition we identified, as well as the related criteria, context, causes, effects, and our specific recommendations for improvement. Prior Year Findings: See schedule of Findings and Questioned Costs for chart/table Type of Finding: Significant deficiency Corrective Action Plan: See F-12 Contact: Shirely Browne, Deputy State Controller, Office of the State Controller, 207-626-8423 (State Number: 24-0909-01)

(2024-021) Confidential finding, see below for more information Title: ________ over ________ needs improvement Pursuant to paragraph 6.63 of the U.S. Government Accountability Office’s Government Auditing Standards (also known as the Yellow Book), we omitted details from this finding as they are confidential under the provisions of 5 MRSA 244-C (3). Though the content of this finding has been redacted, we provided the Department(s) with detailed information regarding the specific condition we identified, as well as the related criteria, context, causes, effects, and our specific recommendations for improvement. Prior Year Findings: None Type of Finding: Significant deficiency Corrective Action Plan: See F-13 Contact: Shirley Browne, Deputy State Controller, Office of the State Controller, 207-626-8423 (State Number: 24-0904-01)

(2024-022) Title: Internal control over SNAP eligibility determinations and benefit calculations needs improvement Prior Year Findings: See schedule of Findings and Questioned costs for chart/table State Department: Health and Human Services State Bureau: Office for Family Independence Federal Agency: U.S. Department of Agriculture Assistance Listing Title: SNAP Cluster Assistance Listing Number: 10.551, 10.561 Federal Award Identification Number: See E-77 to E-78 Compliance Area: Allowable costs/cost principles Eligibility Special tests and provisions Type of Finding: Material weakness Material noncompliance Questioned costs Known Questioned Costs: ALN 10.551 $12,335 Likely Questioned Costs: Undeterminable; incorrectly calculated Supplemental Nutrition Assistance Program (SNAP) benefits may result in overpayments or underpayments to clients. Since there are known overpayments and underpayments in our sample, a projection of questioned costs cannot be reasonably estimated. Criteria: 2 CFR 200.303; 2 CFR 200.403; 7 CFR 272.10; 7 CFR 273.2 The Department must establish and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. To be allowable under Federal awards, costs must be necessary and reasonable for the performance of the Federal award and be adequately documented. All State agencies must sufficiently automate their SNAP operations and computerize their systems for obtaining, maintaining, utilizing and transmitting information concerning SNAP. A SNAP application form must be signed to establish a filing date and to determine the State agency’s deadline for acting on the form. The State agency shall not certify a household without a signed form. Condition: SNAP is administered by the Office for Family Independence (OFI) and provides monthly benefits to eligible households to purchase nutritious foods. OFI is required by Federal program regulations to utilize an automated information system for SNAP. The information system must maintain all case file information necessary to properly process eligibility determinations and benefit calculations. The Automated Client Eligibility System (ACES) is the information system used by OFI to automate SNAP operations. ACES relies on the maintenance of a complex framework of system results to make eligibility determinations and related benefit calculations. The Office of the State Auditor (OSA) tested 60 household monthly benefit payments to verify the accuracy of SNAP operations utilizing ACES, and identified the following: • Nine overpayments of monthly SNAP benefits, including: o four benefit overpayments totaling $5,806; the Department was unable to provide documentation to support the maximum income limit requirement. o two benefit overpayments totaling $2,714 where the clients’ application for benefit renewal did not include SNAP; however, the households were open to SNAP benefits. o two benefit overpayments totaling $2,349 due to manual processing errors. o one benefit overpayment totaling $1,041; the client’s signature on their application was missing, which makes them ineligible for SNAP benefits. • One $395 underpayment of a monthly SNAP benefit due to manual processing errors • One household with an overpayment of $425 and an underpayment of $69 due to manual processing errors • Three households received accurate monthly benefit payments; however, asset and expense information were not accurately reflected within ACES. OSA selected a non-statistical random sample. The Department does not have adequate policies and procedures in place to ensure that ACES case file modifications, whether manual or system interfaced, that result in adjustments to previously issued monthly SNAP benefits are appropriately processed. This includes a recalculation of previously issued benefits when case file modifications are processed, establishment of corresponding overpayments or underpayments, and related follow-up actions with households. Context: In fiscal year 2024, the State provided approximately 129,000 SNAP clients with $371.4 million in Federal benefits. Cause: • Lack of adequate policies and procedures • Lack of supervisory oversight Effect: • Known questioned costs • Potential future questioned costs and disallowances • Benefits may be incorrectly calculated, resulting in households being underpaid and/or overpaid. • Noncompliance with Federal regulations Recommendation: We recommend that the Department implement additional policies and procedures to ensure that: • case information entered into ACES is accurate; • automated eligibility determinations and benefit calculations are processed in accordance with Federal regulations; and • recalculations of previously issued benefits and related follow-up actions occur when case file modifications are retroactive. Corrective Action Plan: See F-13 Management’s Response: The Department partially agrees with this finding. Of the 60 cases reviewed, 13 (21.67%) had errors in calculations or documentation. The Department is confident that the staff followed correct procedures in providing the TANF funded resource guide in the first four cases cited. The errors in these cases were merely a lack of documentation. The Department agrees with the calculation errors in the following 7 cases (11.67% of the 60 reviewed). The Department has developed a corrective action plan to ensure compliance moving forward. Contact: Michael E. Downs, Senior Program Manager, SNAP, DHHS, 207-592-4850 Auditor’s Concluding Remarks: The Department states that they are “confident that the staff followed correct procedures” for the four benefit overpayments totaling $5,806 and that “errors in these cases were merely a lack of documentation;” however, the Department cannot substantiate that staff followed established procedures if there is a lack of documentation to support adherence to procedures. The finding remains as stated. (State Number: 24-1108-04)

(2024-023) Title: Internal control over SNAP deceased client cases needs improvement Prior Year Findings: See schedule of Findings and Questioned Costs for chart/table State Department: Health and Human Services State Bureau: Office for Family Independence Federal Agency: U.S. Department of Agriculture Assistance Listing Title: SNAP Cluster Assistance Listing Number: 10.551, 10.561 Federal Award Identification Number: See E-77 to E-78 Compliance Area: Allowable costs/cost principles Eligibility Type of Finding: Material weakness Material noncompliance Questioned costs Known Questioned Costs: ALN 10.551 $11,080 Likely Questioned Costs: Undeterminable; the Office of the State Auditor (OSA) tested a sample of cases where Supplemental Nutrition Assistance Program (SNAP) benefits were issued after the client’s date of death (DOD). Issuance of benefits to a deceased client does not necessarily result in unallowable program costs, as the issued benefits may not be expended; therefore, an error rate cannot be applied to the population and a projection of questioned costs cannot be reasonably estimated. Criteria: 2 CFR 200.303; 2 CFR 200.403; 7 CFR 272.8 and .14 The Department must establish and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. To be allowable under Federal awards, costs must be necessary and reasonable for the performance of the Federal award and be adequately documented. State agency action on information items about recipient households shall include review of information and comparison of it to case record information. State agencies must initiate and pursue actions on recipient households within 45 days of the receipt of the information items. States shall establish a system to verify and ensure that benefits are not issued to individuals who are deceased. Condition: The Office for Family Independence (OFI) manages the Automated Client Eligibility System (ACES) used to determine eligibility for Federal assistance programs, including SNAP. Information maintained in ACES is relied upon by OFI for determining monthly SNAP benefits issued to client Electronic Benefit Transaction (EBT) cards. OFI relies on numerous data sources for identifying and providing client DOD information for input into ACES, including monthly data exchanges with the Maine Center for Disease Control & Prevention (MeCDC) Vital Records, which includes Social Security Administration data. Federal program regulations require OFI to act on client cases within 45 days of receipt of DOD information. This includes review and comparison of DOD information to ACES case file information, and suspension of program participation and related benefits as warranted. OFI policies for SNAP require deactivation of the client’s EBT card as well as expungement of authorized benefits from the EBT card. If activity occurred on the client’s EBT card subsequent to the DOD, the case must be reported as potential fraud and referred for investigation. OSA obtained DOD information from MeCDC Vital Records and compared it to clients who received SNAP benefits during fiscal year 2024. OSA identified 214 cases where SNAP benefits were issued more than 75 days following the client’s DOD; this benchmark was applied to denote the 45-day Federal program regulation related to monthly receipt of DOD information. OSA tested 43 of these SNAP cases and identified the following: • 16 single member household clients had EBT card purchase activity after DOD. Of these 16 clients: o 14 clients had transaction activity after DOD that occurred in fiscal year 2024, resulting in unallowable costs totaling $11,080. Additional issues were noted for six of the 14 clients, as follows: • Two clients were not identified as potential fraud in the ACES case file. As a result, they were not referred for investigation as required by OFI policies. • One client’s EBT card was not deactivated upon receipt of DOD information. • Two clients’ benefits were not expunged upon receipt of DOD information as required by OFI policies; benefits were only expunged by the system-automated process based on inactivity after 274 days. • One client’s case remained open 91 days after OFI was notified of the client’s DOD, resulting in three months of unauthorized SNAP benefit issuances. o two clients had transaction activity that occurred subsequent to fiscal year 2024. Of the two clients, one client was not identified as potential fraud in the ACES case file. As a result, they were not referred for investigation as required by OFI policies. • Eight clients with no EBT card purchase activity after DOD had additional issues noted, as follows: o For six clients, the EBT card was never deactivated; therefore, benefits remained open and available for use 83 to 112 days after DOD. o One client’s benefits were not expunged upon receipt of DOD information as required by OFI policies; benefits were only expunged by the system-automated process based on inactivity after 274 days. o One client’s EBT card was never deactivated and benefits were not expunged upon receipt of DOD information as required by OFI policies. OSA selected a non-statistical random sample. Context: In fiscal year 2024, the State provided approximately 129,000 SNAP clients with $371.4 million in Federal benefits. Of the 129,000 SNAP clients, 1,789 had a DOD in fiscal year 2024. Cause: • Lack of adequate policies and procedures • Lack of supervisory oversight Effect: • Benefits issued to deceased clients may result in unauthorized EBT card purchase activity. • Known questioned costs • Potential future questioned costs and disallowances • Noncompliance with Federal regulations Recommendation: We recommend that the Department enhance policies and procedures to ensure that DOD information is received, reviewed, and updated in ACES on a more frequent basis to prevent unauthorized SNAP benefit issuances and EBT card purchase activity. In addition, we recommend that the Department review all client cases noted in the Condition of this finding to ensure that: • ACES case file DOD information is accurate; • SNAP benefits are expunged and EBT cards are deactivated in accordance with existing policies; • cases are identified as potential fraud and referred for investigation as warranted; and • unallowable costs are identified and reported to Federal oversight agencies and required recoupment activities are pursued. Corrective Action Plan: See F-13 Management’s Response: The Department partially agrees with this finding. In most cases cited the Department took appropriate action within the 45 days required by federal regulation related to IEVS information or within the 10-12-10 standard required for community complaints depending on the source of the information. The Department recognizes that some actions were lacking or could have been taken more quickly. A dedicated MaineCare Program Integrity Team is now working on the IEVS reports related to deceased members and has detailed SOPs for death matches. Based on the data improvements, this finding may continue to a small degree in the SFY 2025 audit and should be cleaned up in the SFY 2026 audit. Contact: Michael E. Downs, Senior Program Manager, SNAP, DHHS, 207-592-4850 Auditor’s Concluding Remarks: The exceptions noted in the Condition were identified within a sample of SNAP cases where benefits were issued more than 75 days following the client’s DOD. The 75-day benchmark was applied to include considerations of the monthly (30 day) receipt and the Federal program regulation (45 day). These cases demonstrate that the Department did not take appropriate action as required by Federal regulations in all exceptions identified. The finding remains as stated. (State Number: 24-1108-03)

(2024-024) Title: Internal control over automated SNAP eligibility certification periods needs improvement Prior Year Findings: See schedule of Findings and Questioned Costs for chart/table State Department: Health and Human Services State Bureau: Office for Family Independence Federal Agency: U.S. Department of Agriculture Assistance Listing Title: SNAP Cluster Assistance Listing Number: 10.551, 10.561 Federal Award Identification Number: See E-77 to E-78 Compliance Area: Allowable costs/cost principles Eligibility Special tests and provisions Type of Finding: Material weakness Material noncompliance Questioned costs Known Questioned Costs: ALN 10.551 $3,973 Likely Questioned Costs: Undeterminable; incorrectly suspending Supplemental Nutrition Assistance Program (SNAP) benefits may result in overpayments or underpayments to households. Since there are known overpayments and underpayments in our sample, a projection of questioned costs cannot be reasonably estimated. Criteria: 2 CFR 200.303; 2 CFR 200.403; 7 CFR 272.10; 7 CFR 273.10 and .12 The Department must establish and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. To be allowable under Federal awards, costs must be necessary and reasonable for the performance of the Federal award and be adequately documented. All State agencies must sufficiently automate their SNAP operations and computerize their systems for obtaining, maintaining, utilizing and transmitting information concerning SNAP, which includes automatic cutoff of participation for households which have not been recertified at the end of their certification period. SNAP households must be assigned eligibility certification periods of at least six months unless the household is classified as exempt based on program regulations. The State agency must have at least one contact with each SNAP household every 12 months. Submission of periodic eligibility reports is required by non-exempt households. Non-exempt households that are certified for longer than six months must file a periodic report between four months and six months, as required by the State agency. In addition, the State agency must not require the submission of periodic reports by households certified for 12 months or less in which all adult members are elderly or have a disability and no earned income. Condition: SNAP is administered by the Office for Family Independence (OFI) and provides monthly benefits to eligible households to purchase nutritious foods. OFI is required by Federal program regulations to utilize an automated information system for SNAP. The information system must maintain all case file information necessary to properly process eligibility determinations and benefit computations. The Automated Client Eligibility System (ACES) is the information system used by OFI to automate SNAP operations. ACES relies on the maintenance of a complex framework of system rules to make eligibility determinations, including notification letters to clients when 6-month reports and 12-month redeterminations of eligibility are required. All SNAP households, except for elderly and disabled cases with no earned income, are required to submit 6-month reports. In addition, all SNAP households must undergo an annual redetermination of eligibility. Each household’s recertification requirements are indicated by date fields in the ACES case file. If a required report or redetermination is not completed by the date indicated in the applicable field, the case’s monthly SNAP benefit is automatically suspended by the system. The Office of the State Auditor (OSA) tested a sample of 20 cases automatically suspended for failure to complete a required review in fiscal year 2024 to verify the accuracy of automated SNAP operations utilizing ACES. In 14 of the 20 cases tested, OSA identified that ACES incorrectly suspended benefits, as follows: • One case was suspended four months after the 6-month reporting requirement, resulting in a known overpayment of $92. • One case was suspended one month after the annual redetermination requirement, resulting in a known overpayment of $535. • Six cases were underpaid SNAP benefits totaling $4,424 because of incorrect benefit suspensions, ranging from one to five months prior to the applicable 6-month reporting requirement. • Five cases were underpaid SNAP benefits totaling $4,206 because of incorrect benefit suspensions, ranging from five to ten months prior to the annual redetermination requirement. • One case was never required to submit 6-month reports or annual redeterminations since commencement of SNAP benefits in July 2022. This resulted in overpayments for the entirety of fiscal year 2024 totaling $3,346. The Department identified the overpayment in July 2024 but has not recouped it yet, thus OSA is questioning costs totaling $3,346. OSA selected a non-statistical random sample. Context: In fiscal year 2024, the State provided approximately 129,000 SNAP clients with $371.4 million in Federal benefits. 213 clients were automatically suspended by ACES during fiscal year 2024 due to recertification or redetermination requirements. Cause: • Lack of adequate policies and procedures • Lack of supervisory oversight • Automated SNAP eligibility system recertification and suspension criteria was not configured in accordance with Federal regulations. Effect: • Known questioned costs • Potential future questioned costs and disallowances • Noncompliance with Federal regulations • Benefits may be incorrectly suspended, resulting in households being underpaid or overpaid. Recommendation: We recommend that the Department enhance policies and procedures to ensure that automated SNAP eligibility certification periods and related ACES case file fields are properly configured to process benefits in accordance with Federal regulations. In addition, we recommend that the Department identify underpayments and/or overpayments resulting from recertification period errors and take action as warranted. Corrective Action Plan: See F-14 Management’s Response: The Department agrees with the factual conclusions and calculations. The Department believes the necessary corrective action has been taken and will be reflected in the SFY25 audit. Contact: Ian Yaffe, Director, Office for Family Independence, DHHS, 207-592-1481 (State Number: 24-1108-02)

(2024-025) Title: Internal control over SNAP EBT card security needs improvement Prior Year Findings: See schedule of Findings and Questioned Costs for chart/table State Department: Health and Human Services State Bureau: Office for Family Independence Federal Agency: U.S. Department of Agriculture Assistance Listing Title: SNAP Cluster Assistance Listing Number: 10.551, 10.561 Federal Award Identification Number: See E-77 to E-78 Compliance Area: Special tests and provisions Type of Finding: Significant deficiency Questioned Costs: None Criteria: 2 CFR 200.303; 7 CFR 274.5 The Department must establish and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. The State is required to provide the following minimum security and control procedures for EBT cards: secure storage; access limited to authorized personnel; inventory control records; and a periodic review and validation of inventory controls and records by parties not otherwise involved in maintaining control records. Issuance, inventory, reconciliation, and other accountability records must be maintained for a period of three years. Condition: The Supplemental Nutrition Assistance Program (SNAP) provides monthly benefits to eligible households to purchase nutritious foods. The program utilizes Electronic Benefit Transfer (EBT) cards as the mechanism to provide benefits. SNAP benefit information is transmitted to the Electronic Payment Processing and Information Control (EPPIC) system used for EBT. An EBT card is issued using the EPPIC system and mailed to the client’s mailing address. EBT cards that are undeliverable are returned to the regional Department of Health and Human Services office for processing. Upon receipt of a returned EBT card, the Automated Client Eligibility System (ACES) is used to verify a client’s personal information, determine what action to take based on case file information, and document the action through electronic case notes. The Department has assigned responsibility for processing returned EBT cards to one employee. This process includes receipt of returned cards, maintenance of inventory control records including supporting documentation in ACES and EPPIC, and destruction or retransmission of the card. Proper segregation of duties does not exist within the current process, as recordkeeping, custody of EBT cards, and authorization of processing activity should be assigned to different employees. In addition, the State is required to maintain accurate and complete inventory records for returned EBT cards. Returned cards are either destroyed or retransmitted, and are tracked using spreadsheets and related documentation through client case notes in ACES and EBT card activity in the EPPIC system. The Office of the State Auditor (OSA) tested a sample of 60 returned EBT cards to verify the accuracy and completeness of the activity recorded on the inventory tracking spreadsheets, and identified: • one returned EBT card where processing activity was not documented in a case note; • one returned EBT card where the disabled card status was not applied in the EPPIC system until nine months after it was destroyed; • one returned EBT card where the action documented in ACES did not match the action taken in the EPPIC system; and • two returned EBT cards were recorded on the tracking spreadsheet as retransmitted to an updated address, but no documentation was maintained in ACES to support that a new address was obtained. OSA selected a non-statistical random sample. A data analysis and cross-match of the inventory tracking spreadsheets identified that one returned EBT card was processed utilizing client information which erroneously included two unrelated client names tied to the same client identification number. Quarterly, management monitors the inventory tracking spreadsheets by selecting a sample of returned EBT cards for review; however, this oversight procedure does not detect and correct processing errors on a timely basis. Furthermore, the State is required to maintain secure storage of, and limited access to, EBT cards. The current process does not require proper physical security over returned EBT cards as the returned cards are placed in an open mailbox during processing. While the mailbox is in a secure area of the facility, any employee working within the regional office has access to this mailbox. Existing policies and procedures in place do not provide adequate security over returned EBT cards, including proper segregation of duties, maintenance of accurate and complete inventory control records, and appropriate physical security controls over EBT cards. Context: In fiscal year 2024, the State provided approximately 129,000 SNAP clients with $371.4 million in Federal benefits. The Department processed 2,469 returned EBT cards; 853 were recorded as retransmitted and 1,616 were recorded as destroyed. Cause: • Lack of segregation of duties • Lack of adequate policies and procedures relating to the security and oversight of returned EBT cards Effect: • Potential unauthorized use of EBT cards, which may lead to unallowable costs • Noncompliance with Federal regulations Recommendation: We recommend that the Department enhance policies and procedures to require adequate security and oversight of returned EBT cards, including proper segregation of duties within the process, maintenance of accurate and complete inventory control records, and increased physical security controls. Corrective Action Plan: See F-14 Management’s Response: The Department agrees with this finding. During the audit period, the process for handling returned EBT cards was assigned to one (1) individual. In response to a prior year finding, the Department implemented corrective actions effective July 1, 2024. The current process has the duties separated into 3 roles. First, an Accounting Associate I receives the returned EBT cards at OFI’s Central Office. The Accounting Associate scans the card and envelope to an Office Associate II in a separate office. The Office Associate II enters the cards into a spreadsheet (returned card log) and researches the cases to determine what to do with the card. The Office Associate records the necessary information into the returned card log and makes an ACES case note to reflect any action taken. Then a response is sent back to the Accounting Associate to advise which EBT cards should be shredded and which cards should be resent. Finally, the EBT Manager conducts a periodic review of the returned card log to ensure the cards are being handled appropriately. The Department will also be hiring a new Office Associate II (Supervisor) to assist in this process. Because these procedures were implemented effective 7/1/2024, they were not captured during this single audit. No corrective action is required due to our current procedures meeting state and Federal card security requirements. Contact: Ian Yaffe, Director, Office for Family Independence, DHHS, 207-592-1481 (State Number: 24-1108-01)

(2024-026) Title: Internal control over DHHS special reporting needs improvement Prior Year Findings: None State Department: Health and Human Services State Bureau: Division of Contract Management Federal Agency: U.S. Department of Agriculture U.S. Department of Health and Human Services Assistance Listing Title: SNAP Cluster Special Supplemental Nutrition Program for Women, Infants, and Children (WIC) (COVID-19) Opioid STR Assistance Listing Number: 10.551, 10.561; 10.557; 93.788 Federal Award Identification Number: See E-77 to E-78 Compliance Area: Reporting Type of Finding: Significant deficiency Questioned Costs: None Criteria: 2 CFR 200.303; 2 CFR 170 The Department must establish and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. Agencies must report each subaward that equals or exceeds the first-tier subaward threshold of $30,000 in Federal funds in the public-facing Federal Funding Accountability and Transparency Act (FFATA) Subaward Reporting System (FSRS). Condition: When an amount exceeding the first-tier subaward threshold is awarded to a subrecipient, the Department must collect and enter data into FSRS. The Office of the State Auditor (OSA) tested nine first-tier subawards totaling $1,515,620 that exceeded the first-tier subaward threshold. Federal regulations require the following information for identified noncompliance to be included in FFATA findings: • three WIC subawards totaling approximately $746,000 were not reported and thus, not reported timely; • one Supplemental Nutrition Assistance Program (SNAP) subaward totaling approximately $95,000 was not reported and thus, not reported timely; • one Opioid State Targeted Response (STR) subaward totaling approximately $68,000 was not reported and thus, not reported timely; • no subaward amounts were reported incorrectly; and • no subawards reported incorrect key data elements. The unreported Opioid STR subaward was a contract modification that included multiple sources of grant funds including the Temporary Assistance for Needy Families program. Upon OSA’s inquiry, the Department stated that the Opioid STR subaward was not reported because the Federal Award Identification Number (FAIN) was missing. The Department provided a verification workbook that serves as a working log for subawards that may require FFATA reporting but have not been reported in FSRS for various reasons. Review of the log revealed additional grant programs, including WIC and SNAP, with unreported subawards due to missing FAINs. OSA was able to locate the missing FAINs by contacting the grant program administrators listed on the encumbered contract. OSA selected a non-statistical random sample. Context: During fiscal year 2024, the Department disbursed: • $5.9 million to subrecipients from WIC grant funds of $22.8 million. • $5.2 million to subrecipients from SNAP administrative grant funds of $19.1 million. • $4.9 million to subrecipients from Opioid STR grant funds of $5.9 million. Cause: • Lack of supervisory oversight • Lack of adequate policies and procedures Effect: • Noncompliance with Federal regulations • Accurate first-tier subaward information for the WIC, SNAP, and Opioid STR programs was not reported to the Federal government. This information may be used for programmatic, policy or statistical purposes. Recommendation: We recommend that the Department enhance policies and oversight procedures to ensure that all first-tier subawards are reported accurately, timely, and in accordance with Federal regulations. Corrective Action Plan: See F-14 Management’s Response: The Department agrees with this finding. The Division of Contract Management has developed and will implement a corrective action plan to address the issues identified. Contact: Jeanne Garza, Deputy Director, Division of Contract Management, DHHS, 207-287-1848 (State Number: 24-1100-02)

(2024-027) Confidential finding, see below for more information Title: ________ over ________ and ________ needs improvement Pursuant to paragraph 6.63 of the U.S. Government Accountability Office’s Government Auditing Standards (also known as the Yellow Book), we omitted details from this finding as they are confidential under the provisions of 5 MRSA 244-C (3). Though the content of this finding has been redacted, we provided the Department(s) with detailed information regarding the specific condition we identified, as well as the related criteria, context, causes, effects, and our specific recommendations for improvement. Prior Year Findings: See schedule of Findings and Questioned Costs for chart/table Type of Finding: Significant deficiency Corrective Action Plan: See F-15 Contact: Shirley Browne, Deputy State Controller, Office of the State Controller, 207-626-8423 (State Number: 24-0905-01)

(2024-029) Confidential finding, see below for more information Title: ________ over ________ and ________ needs improvement Pursuant to paragraph 6.63 of the U.S. Government Accountability Office’s Government Auditing Standards (also known as the Yellow Book), we omitted details from this finding as they are confidential under the provisions of 5 MRSA 244-C (3). Though the content of this finding has been redacted, we provided the Department(s) with detailed information regarding the specific condition we identified, as well as the related criteria, context, causes, effects, and our specific recommendations for improvement. Prior Year Findings: See schedule of Findings and Questioned Costs for chart/table Type of Finding: Significant deficiency Corrective Action Plan: See F-15 Contact: Shirley Browne, Deputy State Controller, Office of the State Controller, 207-626-8423 (State Number: 24-0905-02)

(2024-028) Confidential finding, see below for more information Title: ________ over the ________ needs improvement Pursuant to paragraph 6.63 of the U.S. Government Accountability Office’s Government Auditing Standards (also known as the Yellow Book), we omitted details from this finding as they are confidential under the provisions of 5 MRSA 244-C (3). Though the content of this finding has been redacted, we provided the Department(s) with detailed information regarding the specific condition we identified, as well as the related criteria, context, causes, effects, and our specific recommendations for improvement. Prior Year Findings: See schedule of Findings and Questioned Costs for chart/table Type of Finding: Significant deficiency Corrective Action Plan: See F-15 Contact: Shirley Browne, Deputy State Controller, Office of the State Controller, 207-626-8423 (State Number: 24-0905-03)

(2024-030) Title: Internal control over CNC eligibility needs improvement Prior Year Findings: None State Department: Education State Bureau: Child Nutrition Services Federal Agency: U.S. Department of Agriculture Assistance Listing Title: Child Nutrition Cluster Assistance Listing Number: 10.553, 10.555, 10.556, 10.559, 10.582 Federal Award Identification Number: See E-77 to E-78 Compliance Area: Allowable costs/cost principles Eligibility Type of Finding: Material weakness Material noncompliance Questioned costs Known Questioned Costs: ALN 10.559 $628,924 Likely Questioned Costs: Undeterminable; there is insufficient information on the application to identify programs that may be operating under an incorrect classification. Criteria: 2 CFR 200.303; 7 CFR 210.7 and .9; 7 CFR 225.6, .14, and .16; 7 CFR 245.12 The Department must establish and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. 7 CFR 210 outlines the application requirements for participation in the National School Lunch Program (NSLP), and specifies that applications shall provide the State agency with sufficient information to determine eligibility. 7 CFR 225 requirements include: • the type of information that must be required in sponsor applications for participation; • sites that serve an area in which poor economic conditions exist or is approved for reimbursement only for meals served free to enrolled children who meet the program's income standards; • the proposed site is not or will not be served in whole or in part by another site; • State agency requirements related to the approval of applications and determinations of eligibility; and • the process and requirements for claims for reimbursement (CFRs). 7 CFR 245 describes the action taken by State agencies related to the eligibility determination of individuals and special eligibility determinations of schools including Provision II and Community Eligible Provision (CEP) schools. These regulations outline how the School Food Authority (SFA) and State agency should collect and report eligibility information in the schools, and how that information should be used in establishing rates and percentages in CFRs. Condition: The Child Nutrition Cluster (CNC) includes the School Breakfast Program, NSLP, Special Milk Program for Children, Summer Food Service Program (SFSP) and the Fresh Fruit and Vegetable Program. The objectives of the programs are to provide nutritious meals to eligible children in schools, residential childcare institutions, and summer food programs; to foster healthy eating habits by providing fresh fruits and vegetables to children attending elementary schools; and to encourage the consumption of nutritious agriculture commodities. The Department of Education (DOE) is responsible for the administration of child nutrition programs for the State. DOE provides benefits to each SFA or sponsor on a reimbursement basis. SFAs and sponsors must submit applications for participation in CNC programs and DOE is required to review every application and site information sheet to ensure that only eligible SFAs or sponsors participate in the programs. The Office of the State Auditor (OSA) tested 48 applications and found instances that did not align with program regulations for NSLP and SFSP, as follows: National School Lunch Program Applications to participate in child nutrition programs must include attestations and written agreement to the regulations set forth in 7 CFR 210 and 7 CFR 245. Agreements must be signed and returned to Child Nutrition Services (CNS) prior to meal service and the submission of a CFR by the SFA. OSA tested 32 applications from SFAs and sponsors for participation in NSLP and identified six applications that were not complete or were approved prior to participation in the program, as follows: • Three applications were approved for participation with missing information, including: o one application missing an agreement for participation in CEP; o one application not indicating the year of operation; and o one application missing the signature of the SFA superintendent. • Two applications were submitted after participation in the program had begun. • One application was missing the meal pattern agreement attestation that made them eligible for the eight-cent performance-based reimbursement for every lunch served and was also submitted after participation in the program had begun. OSA selected a non-statistical random sample. Summer Food Service Program While SFAs may operate SFSP, residential and non-residential day camps, units of local, municipal, county or State governments, and private nonprofit organizations may also participate in the program; these providers are called sponsors. Sponsors must submit a written application to CNS by June 15 to participate in the program. Sponsors operate individual sites, and sponsor applications must include site sheets for each site. OSA tested 16 applications from sponsors for participation in SFSP and found: • four applications were revised and the revisions were erroneously applied to prior months, resulting in questioned costs totaling $1,767 for meals served prior to approved revisions; and • eleven applications, including two with more than one error, that were approved with sites that did not meet the eligibility criteria, as follows: o Four sponsors had sites where CNS incorrectly categorized non-residential day camps as open sites, which allowed the site to use the area eligibility determination instead of using individual eligibility determinations, resulting in questioned costs totaling $68,342 for meals served without eligibility information provided. o Two sponsors of camps did not provide the number of eligible children for each session at their sites prior to submitting a CFR, resulting in questioned costs totaling $63,493 for meals served without eligibility information provided. o Three sponsors had four sites that used incorrect school or census data to demonstrate eligibility, resulting in one site that was ineligible for participation, and questioned costs totaling $33,682 for the operation of an ineligible site. o One application was approved with a breakfast time of 11:30 a.m.; there was no documentation to support that this meal was served near the site’s opening time as required by regulations, resulting in questioned costs totaling $8,635 for meals that do meet meal time requirements. o Three applications were approved for non-congregate sites that did not include procedures to ensure duplicate meals would not be distributed. One sponsor had seven open sites with overlapping meal times within a quarter-mile radius. OSA selected a non-statistical random sample. In addition, OSA performed analytical procedures over SFSP site classifications and found: • 58 sites from 32 sponsors did not apply eligibility criteria for camp participation, as follows: o 29 sites were classified as open sites or closed enrolled sites when additional information on the application or publicly available information indicated that the program met the definition of camps provided at 7 CFR 225; these sites used area eligibility to claim reimbursement for all meals served instead of only the meals served to eligible children, resulting in questioned costs totaling $208,142. o 9 sites indicated they were camps; however, they were classified as open sites or closed enrolled sites that used area eligibility to claim reimbursement for all meals served instead of only the meals served to eligible children, resulting in questioned costs totaling $100,379. o 13 sites indicated they were camps; however, their applications were not revised to include actual eligibility counts for each session prior to submission of CFRs, resulting in questioned costs totaling $82,567. o 7 sites described camp activities in their description of operations, but classified themselves as open sites or closed enrolled sites that used area eligibility to claim reimbursement for all meals served instead of only the meals served to eligible campers, resulting in questioned costs totaling $48,224. • 16 sponsors had site revisions approved by CNS that added operating days, increased capacities, changed meal types, added meals, or added non-congregate operations to a prior month. CNS permitted sponsors to include those revisions in the prior month’s CFR which were not in accordance with the agreement in place at the time of service, resulting in questioned costs totaling $13,693. Context: CNS processed $55.8 million in CFRs for NSLP, and $2.8 million in CFRs for SFSP in fiscal year 2024. Cause: • Lack of adequate policies and procedures • Lack of supervisory oversight Effect: • CNC participation by ineligible SFAs or sponsors • Known questioned costs • Potential future questioned costs and disallowances • Noncompliance with Federal regulations Recommendation: We recommend that CNS revise policies and procedures to ensure: • SFSP site information sheet revisions prohibit the sponsor from using the revised information in a claim for a prior month; • site classifications appropriately identify camps, consistent with Federal regulations; and • site information sheets contain non-congregate plans that include required information. Additionally, we recommend that CNS enhance oversight to ensure: • all required documents for applications are complete and signed prior to meal service; • session-specific eligibility information is available on the site information sheets for camps; and • the eligibility of the locations of non-congregate sites is properly supported. Corrective Action Plan: See F-15 Management’s Response: The Department agrees with this finding. Procedures for “Application Approvals” will be delineated regarding application and claim revisions, Site classification, non-congregate plan requirements, Eligibility criteria and back up documentation, and all requirement documents will be adequately reviewed. Contact: Jane McLucas, Director of Child Nutrition, DOE, 207-624-6880 (State Number: 24-1203-05)

(2024-031) Title: Internal control over CNC claim reimbursements needs improvement Prior Year Findings: See schedule of Findings and Questioned Costs for chart/table State Department: Education State Bureau: Child Nutrition Services Federal Agency: U.S. Department of Agriculture Assistance Listing Title: Child Nutrition Cluster Assistance Listing Number: 10.553, 10.555, 10.556, 10.559, 10.582 Federal Award Identification Number: See E-77 to E-78 Compliance Area: Allowable costs/cost principles Reporting Type of Finding: Material weakness Material noncompliance Questioned costs Known Questioned Costs: ALN 10.555 $1,605 ALN 10.582 $9,535 ALN 10.559 $117,259 Likely Questioned Costs: Undeterminable; due to the variety of site types in the test population and varied meal claim counts, an error rate cannot be applied to the population and a projection of questioned costs cannot be reasonably estimated. Criteria: 2 CFR 200.303; 2 CFR 200.403; 7 CFR 210.7 and .8; 7 CFR 225.6, .9, and .16; Richard B. Russell National School Lunch Act, Section 19; U.S. Department of Agriculture Fresh Fruit and Vegetable Handbook The Department must establish and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. To be allowable under Federal awards, costs must be necessary and reasonable for the performance of the Federal award and be adequately documented. 7 CFR 210.7 National School Lunch Program (NSLP) claims for reimbursement (CFRs) must be based on lunch counts taken daily at the point of service (POS), which correctly identify the number of free, reduced price, and paid lunches served to eligible children. 7 CFR 210.8 (NSLP) on a monthly basis, the State agency shall, at a minimum, compare the number of free and reduced price lunches claimed to the number of children approved for free and reduced price lunches enrolled in the School Food Authority (SFA) for the month of October, and multiply that number by the days of operation and the attendance factor employed by the SFA. At its discretion, the State agency may conduct this comparison against data which reflects the number of children approved for free and reduced price lunches for a more current month(s). 7 CFR 225.6 Summer Food Service Program (SFSP) required information must be on a site information sheet that the State agency must provide to the sponsor for approval by the State agency prior to participation in SFSP, including estimated meal counts, types of meals, meal service times, and procedures to ensure duplicate meals are not distributed at non-congregate sites. In order to approve a site, the area where the site proposes to serve is not or will not be served in whole or in part by another site. 7 CFR 225.9 (SFSP) outlines that payments to a sponsor must equal the amount derived by multiplying the number of eligible meals, by type, actually served under the sponsor's program to eligible children by the current applicable reimbursement rate for each meal type. Sponsors must be eligible to receive additional reimbursement for each meal served to participating children at rural or self-preparation sites. 7 CFR 225.16 (SFSP) meals served outside of the meal time listed on the sponsor’s application are not eligible for reimbursement. Sponsors agree in writing to claim reimbursement only for the types of meals specified in the agreement that are served. Section 19 of the Richard B. Russell National School Lunch Act (NSLA) states that the per-pupil grant provided to a school under the Fresh Fruit and Vegetable Program (FFVP) shall be not less than $50, nor more than $75. U.S. Department of Agriculture’s (USDA) FFVP Handbook, referenced as guidance in Policy Memo SP 17-2023, states that all nonfood costs must be carefully reviewed and deemed reasonable. Condition: The Child Nutrition Cluster (CNC) includes the School Breakfast Program, NSLP, Special Milk Program for Children, SFSP and FFVP. The objectives of the programs are to provide nutritious meals to eligible children in schools, residential childcare institutions and summer food programs; to foster healthy eating habits by providing fresh fruits and vegetables to children attending elementary schools; and to encourage the consumption of nutritious agriculture commodities. The Department of Education (DOE) is responsible for the administration of child nutrition programs for the State. DOE provides benefits to each SFA or sponsor on a reimbursement basis. SFAs and sponsors must submit claims for reimbursement based on actual meals served for the month and permissible fresh fruits and vegetables utilizing the Child Nutrition Program (CNPWeb) system. The Department is required to review each SFA’s or sponsor’s CFR to ensure that monthly claims are limited to the number of meals served to eligible children and that the cost of the fresh fruits and vegetables are allowable. Once the claims are approved, claims are reimbursed based on the rates that are programmed in the CNPWeb system. The Office of the State Auditor (OSA) tested CFRs for the CNC and found instances that did not align with program regulations for NSLP, FFVP, and SFSP, as follows: National School Lunch Program CNS must perform procedures as outlined in Federal regulations, including a review of CFRs on a monthly basis through analysis utilizing a product of the enrollment information from the month of October multiplied by the days of operation and the attendance factor employed by the SFA. OSA procedures identified that CNS did not review or perform analysis on CFRs on a monthly basis as required. OSA tested 60 CFRs and identified nine CFRs from five SFAs where eligibility information entered on the CFR varied significantly from the information provided and verified by the SFA in October 2023. In order to verify the allowability of the claims identified, OSA requested supporting documentation from those five SFAs. OSA compared the eligibility counts from the CFR, the SFA’s POS reports, the SFA’s October data provided to CNS, and the SFA’s master list of eligible students for the month of the CFR and found: • five POS reports with eligibility counts that conflicted with the master eligibility list provided by the SFA for that month, and with the number of eligible children reported on the CFR, resulting in questioned costs totaling $897; • one POS report from October with eligibility counts that matched the site CFR, but did not match the master eligibility list provided by the SFA, or the data reported to CNS by the SFA for the same month, resulting in questioned costs totaling $708; and • documentation for three CFRs could not be provided. OSA selected a non-statistical random sample. Fresh Fruit and Vegetable Program CNS ensures compliance with Federal regulations through the annual administrative review process. OSA tested 17 FFVP CFRs from the nine SFAs who had an administrative review in fiscal year 2024 and found: • nine claims from five SFAs had sites with nonfood costs that were not reviewed during the administrative review process. • for six of the nine SFAs, portions of the administrative review process were erroneously omitted; therefore, CNS did not review or examine the allowability for any FFVP CFRs for those six SFAs. OSA selected a non-statistical random sample. The FFVP fiscal year is October 1 to September 30; therefore, though schools may begin the school year with unspent funds from the prior school year, these funds must be spent by September 30. OSA tested 19 FFVP SFAs that participated in both fiscal year 2023 and 2024 and found that three SFAs exceeded their fiscal year 2023 allocation in September 2023. CNS did not detect or correct this allocation issue until OSA inquired in September 2024. OSA selected a non-statistical random sample. Section 19 of the Richard B. Russell NSLA requires that FFVP allocations made by CNS result in a per-pupil grant not less than $50, nor more than $75 to participating SFAs. OSA tested 19 SFAs that participated in FFVP in fiscal year 2024 and found that 14 SFAs had manual allocation adjustments which resulted in ten per-pupil allocations that were not between $50 and $75 per pupil, ranging from $24 per pupil to $109 per pupil. The allocation of funds over $75 per pupil resulted in questioned costs of $9,535. OSA selected a non-statistical random sample. Summer Food Service Program CNS requires applications from sponsors that include individual site sheets. The information on the sheet must include the estimated number of meals, types of meals to be served, and meal service times. Meal service times must align with the approved application at the time the meals are served. Non-congregate sites must provide enough detail to ensure the area where the site proposes to serve meets certain criteria, including verification that the site: • is rural; • is not or will not be served in whole or in part by another site; • serves an area in which poor economic conditions exist or is approved for reimbursement only for meals served free to enrolled children who meet income standards; and • has procedures to ensure that duplicate meals are not served to any child. Residential and non-residential camps must include in their site sheets the number of children enrolled in each session who meet income standards prior to filing the camp’s CFR for each session. OSA tested 39 SFSP CFRs and found: • nine residential or non-residential camp CFRs that did not include the number of children enrolled in each session who met income standards prior to filing their CFR, resulting in questioned costs totaling $95,902. • two CFRs to non-congregate sites not located in an area where poor economic conditions exist per USDA data. The ineligible sites resulted in questioned costs totaling $15,536. • four CFRs included revised information from the site sheet that did not reflect the conditions at the time the meals were served. The revisions submitted between the meal service and submission of the CFR included an increase in capacity, an addition of meal types, and an addition of operating days, resulting in questioned costs totaling $5,821. • five CFRs to non-congregate sites that did not have documented procedures to prevent duplicate meal service on the site sheet. OSA selected a non-statistical random sample. Additionally, SFSP has two tiers of administrative rates for reimbursement, self-prep and vended. Sites classified as rural are all reimbursed at the highest rate, but sites classified as urban can either be reimbursed at the higher rate if they serve self-prep meals, or at the lower rate if their meals are vended. CNS previously determined that the field on the application for the sponsor to select whether the meal served is vended or self-prep is not required in the CNPWeb system. At that time, CNS submitted a ticket to request a change to the CNPWeb system to require the sponsor to select a meal type in that field on future applications; however, because that information was not required previously, CNS does not have assurance that urban sites that did not select self-prep or vended are being reimbursed at the correct rate. Furthermore, for each month of operation, CNS must report the number of meals served by meal type and sponsor type to USDA Food Nutrition Services (FNS) on the FNS-418 report. CNS does not have assurance that their default classification of urban sites as self-prep when the field was left blank is accurate for FNS-418 reporting. Context: In fiscal year 2024, CNS processed CFRs totaling: • $55.8 million under NSLP; • $2.8 million under FFVP; and • $2.8 million under SFSP. Cause: • Lack of adequate policies and procedures • Lack of supervisory oversight Effect: • Noncompliance with Federal regulations • Known questioned costs • Potential future questioned costs and disallowances • Potential incorrect rates of reimbursement paid to SFAs and sponsors • Inaccurate FNS-418 reports submitted to FNS Recommendation: We recommend that CNS enhance policies and procedures to: • require a review of CFRs on a monthly basis in accordance with Federal regulations; • ensure all required information is included in the applications and approved prior to participation; • review and approve area eligibility for non-congregate sites; • require inclusion of self-prep or vended meal types and non-congregate plans on site information sheets that document procedures to prevent duplicate meal service; • ensure session-specific eligibility information is received prior to claim approval for camp sites; and • ensure that site information sheet revisions prohibit the sponsor from using the revised information in a claim for the prior month. In addition, we recommend that CNS enhance oversight over FFVP to ensure: • claims with nonfood costs are reasonable; • allocation amounts remain within $50 to $75 per pupil; and • administrative reviews conducted by CNS include FFVP allowability reviews. Corrective Action Plan: See F-16 Management’s Response: The Department partially agrees with this finding. These findings come from various programs and are correctly outlined in the Condition. However, the Department disagrees with the first bullet in the Recommendation regarding the review of CFRs monthly and has contacted the Northeast Regional Office of the USDA for clarification. Additionally, we disagree with the first bullet point regarding non-food costs in the FFVP program, as it’s addressed in the Administrative Review process. The Department has developed a corrective action plan to address the remaining recommendations. Contact: Jane McLucas, Director of Child Nutrition, DOE, 207-624-6880 Auditor’s Concluding Remarks: 7 CFR 210.8(b)(2) provides detailed requirements outlining the minimum CFR monthly claim review procedures that CNS must perform. CNS has not implemented required procedures, and erroneous CFRs are not detected or corrected, resulting in questioned costs and potential disallowances. In addition, CNS asserts that FFVP nonfood costs are addressed as part of the Administrative Review process; however, OSA identified a material weakness and material noncompliance as issued in finding 2024-032 Internal control over CNC subrecipient monitoring procedures needs improvement. The finding reports that six of the nine Administrative Reviews tested for FFVP inappropriately omitted Federally required steps and that a cost analysis over nonfood costs was not performed. The finding remains as stated. (State Number: 24-1203-02)

(2024-032) Title: Internal control over CNC subrecipient monitoring procedures needs improvement Prior Year Findings: See schedule of Findings and Questioned Costs for chart/table State Department: Education State Bureau: Child Nutrition Services Federal Agency: U.S. Department of Agriculture Assistance Listing Title: Child Nutrition Cluster Assistance Listing Number: 10.553, 10.555, 10.556, 10.559, 10.582 Federal Award Identification Number: See E-77 to E-78 Compliance Area: Subrecipient monitoring Type of Finding: Material weakness Material noncompliance Questioned Costs: None Criteria: 2 CFR 200.303; 2 CFR 200.332; 7 CFR 210.18; 7 CFR 225.7; U.S. Department of Agriculture Policy Memo SP 46-2015 The Department must establish and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. The Department must monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. The Department must conduct administrative reviews of School Food Authorities (SFAs) participating in the National School Lunch Program (NSLP) and the School Breakfast Program (SBP). These procedures must also be followed, as applicable, to conduct administrative reviews of the afterschool snacks, Special Milk Program (SMP) and the Fresh Fruit and Vegetable Program (FFVP). Documented corrective action is required for any degree of violation of general or critical areas identified in an administrative review. Corrective action may be provided at the time of the review; however, it must be postmarked or submitted to the State agency electronically no later than 30 days from the deadline for completion of each required corrective action. The State agency must maintain any documented corrective action on file for review by the Food and Nutrition Service (FNS). The Department must withhold all program payments to a SFA if: • documented corrective action for critical area violations is not provided with deadlines specified; or • corrective action for critical area violations was not completed. FNS may suspend or withhold program payments, in whole or in part, to those states failing to withhold payments in accordance with regulations and may withhold administrative funds. The Department must review sponsors to ensure compliance with Summer Food Service Program (SFSP) regulations. The Department is required to conduct a review of base year certification and benefit issuance documentation for any SFA requesting approval to participate in NSLP or SBP using U.S. Department of Agriculture (USDA) Special Provision 2, which is a provision established to reduce application burdens and simplify claim procedures. The review must occur at some point during the base year. If errors are identified as a result of the review, the Department must adjust all of the SFA’s closed claims that occurred in the current school year. Condition: The Child Nutrition Cluster (CNC) includes the NSLP, SBP, SMP, SFSP, and FFVP. The objectives of the programs are to provide nutritious meals to eligible children in schools and summer food programs; to foster healthy eating habits by providing fresh fruits and vegetables to children attending elementary schools; and to encourage consumption of nutritious agriculture commodities. The Department of Education (DOE) is responsible for the administration of child nutrition programs for the State. DOE partners with local SFAs and sponsors to provide benefits to school-aged children. DOE has assigned subrecipient monitoring responsibilities, which include administrative reviews and other reviews as needed, to the Child Nutrition Services (CNS) division. Administrative reviews of all SFAs are required at least once every five years; however, regulations also specify that high-risk SFAs must receive targeted follow-up within two years. CNS utilizes a spreadsheet to track and facilitate the reviews, and a USDA questionnaire to document the completion of the review. CNS does not have a mechanism to centrally track the high-risk SFAs to ensure follow-up occurs. CNS is required to retain documentation to support all elements of the administrative reviews and to demonstrate the SFA’s compliance with the program, even if corrective action occurs onsite during the review. The Office of the State Auditor (OSA) tested 29 administrative reviews completed by CNS and found: • Performance Standard 1 findings, deemed critical findings by USDA, were identified in four reviews, but were not tracked for follow-up. In addition, corrective action was not provided within 30 days for one review. • Performance Standard 2 findings, also deemed critical by USDA, were identified in three reviews, but were not tracked for follow-up. In addition, corrective action was not provided within 30 days for two reviews. • corrective action completed onsite was indicated in five reviews; however, CNS could not provide documentation to support the corrective action. • corrective action for three reviews did not fully address the deficiencies noted. • corrective action for two reviews was received more than 30 days late. • 12 reviews were closed; however, corrective action remained outstanding. • one sponsor submitted corrective action in October 2023, but as of audit testing in March 2025, CNS had not notified the sponsor of the approval and had not closed the sponsor’s review. • corrective action submitted from two SFAs was not approved, and the SFAs were not notified until nine months after their submission. • the review tracking spreadsheet was not fully completed or conflicted with information obtained from the administrative review for 16 reviews. • questionnaires were not fully completed for seven reviews. • USDA questionnaire sections related to FFVP and SMP were erroneously excluded for eight reviews. • the date for required corrective action to be provided was omitted for seven reviews. • one review was erroneously excluded from the review tracking spreadsheet. In addition to administrative reviews, CNS must perform base year reviews for all SFAs that have applied to participate in USDA Special Provision 2. These base year reviews provide the required information necessary to determine the level of claims the SFA may submit in the subsequent three years. After completion of the base year review, a letter detailing the results, including any adjustments to previously submitted claims, is provided to the SFA. The SFA is required to adjust claims and enrollment data through the claim revision process and CNS is responsible for verifying that the appropriate revisions have been completed. In fiscal year 2024, CNS identified 17 SFAs that required a base year review. OSA tested four base year reviews and identified three SFAs that did not properly revise claims and enrollment data, and CNS did not verify the accuracy of the revisions completed by the SFAs. In addition, one SFA had an eligibility determination that was not supported by the application. The income amount included in the application exceeded income requirements for reduced-price eligibility, but the SFA categorized the applicant as eligible for reduced-price meals. In the base year review, the application was not recategorized by CNS, and claims were not revised to match the eligibility determination. OSA cannot determine if unallowable costs exist through the audit of subrecipient monitoring activities, as required information was not collected. OSA has questioned costs through the audit of allowable costs/costs principles and eligibility, see findings 2024-031 Internal control over CNC reimbursements needs improvement and 2024-030 Internal control over CNC eligibility needs improvement, respectively. OSA selected non-statistical random samples. Context: In fiscal year 2024, CNC expenditures totaled approximately $68 million, of which $67.6 million was provided to 241 SFAs and sponsors. Cause: • Lack of policies and procedures • Lack of supervisory oversight Effect: • Noncompliance with Federal regulations • Subrecipients may not be complying with Federal statutes, regulations, or the terms and conditions of the subaward. • Potential questioned costs and disallowances. Base year reviews provide authorization for the level of allowable claims the SFA can claim in subsequent periods. Without a base year review and necessary revisions, SFAs could be underclaiming or overclaiming costs. Recommendation: We recommend that the Department implement policies and procedures and increase oversight to ensure that: • reviews are completed as required and supporting documentation is retained; • high-risk SFAs are tracked and considered in planning follow-up reviews; • SFAs revise claims appropriately after a base year review; and • CNS verifies that claim adjustments occur as necessary. Corrective Action Plan: See F-17 Management’s Response: The Department agrees with this finding. The Department will improve tracking and create procedures to evaluate the Administrative Review Processes for the team. Contact: Jane McLucas, Director of Child Nutrition, DOE, 207-624-6880 (State Number: 24-1203-06)

(2024-033) Confidential finding, see below for more information Title: ________ over ________, ________, and ________ needs improvement Pursuant to paragraph 6.63 of the U.S. Government Accountability Office’s Government Auditing Standards (also known as the Yellow Book), we omitted details from this finding as they are confidential under the provisions of 5 MRSA 244-C (3). Though the content of this finding has been redacted, we provided the Department(s) with detailed information regarding the specific condition we identified, as well as the related criteria, context, causes, effects, and our specific recommendations for improvement. Prior Year Findings: See schedule of Findings and Questioned Costs for chart/table Type of Finding: Material weakness Corrective Action Plan: See F-17 Contact: Shirley Browne, Deputy State Controller, Office of the State Controller, 207-626-8423 (State Number: 24-0909-02)

(2024-034) Title: Internal control over the submission of CNC Schedule of Expenditures of Federal Awards information needs improvement Prior Year Findings: See schedule of Findings and Questioned Costs for chart/table State Department: Education State Bureau: Child Nutrition Services Federal Agency: U.S. Department of Agriculture Assistance Listing Title: Child Nutrition Cluster Assistance Listing Number: 10.553, 10.555, 10.556, 10.559, 10.582 Federal Award Identification Number: See E-77 to E-78 Compliance Area: Reporting Type of Finding: Significant deficiency Questioned Costs: None Criteria: 2 CFR 200.303; 2 CFR 200.502 and .510; 7 CFR 250.58(e); U.S. Department of Agriculture Policy No. FD-104 The Department must establish and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. The Department must prepare a Schedule of Expenditures of Federal Awards (SEFA) for the period covered by the State’s financial statements which must include the total Federal awards expended, including distribution or use of food commodities. Federal non-cash assistance, such as food commodities, must be valued at fair market value at the time of receipt or the assessed value provided by the Federal Agency. For a cluster of programs, the SEFA must list individual Federal programs within the cluster. In meeting the commodity offer value of donated foods for the school food authority, the distributing agency must use the cost-per-pound donated food price posted annually by the U.S. Department of Agriculture (USDA), the most recently published cost-per-pound price in the USDA donated foods catalog, and/or a rolling average of the USDA prices. Each distributing or recipient agency must choose a method of valuing USDA donated foods for audit purposes. In most cases, it is recommended that a distributing or recipient agency use one of the options listed in 7 CFR 250.58(e). Once a method of assigning value to USDA donated foods is selected, it must be used consistently in all its audit activities and the State must maintain a record of the means of valuing donated foods for such purposes. Condition: The Department must complete and submit exhibits and related schedules to the Office of the State Controller (OSC) at the close of each fiscal year to report Federal award information for the Child Nutrition Cluster (CNC) for inclusion on the State’s SEFA. OSC is responsible for compiling this information on behalf of the State. The Department submitted exhibits to OSC that: • incorrectly excluded $1.2 million of fresh food distributed to subrecipients and additional commodity items received. • incorrectly reported $4,481 of non-cash food assistance under ALN 10.555 National School Lunch Program that should have been reported under ALN 10.559 Summer Food Service Program. • incorrectly excluded $256 of expenditures under ALN 10.556 Special Milk Program. • incorrectly categorized $98,963 in expenditures related to the State’s juvenile correctional facility as subrecipient expenditures instead of direct expenditures. Context: In fiscal year 2024: • CNC expenditures totaled approximately $68 million. • noncash assistance totaling $1.2 million was not reported to OSC by the Department for inclusion on the SEFA. Noncash assistance for CNC totaled $6.2 million. Cause: • Lack of policies and procedures relating to Department SEFA submissions to OSC • Lack of supervisory oversight Effect: Inaccurate reporting of expenditure amounts on the SEFA, which is submitted to the Federal government, may result in incorrect information used for programmatic, policy, or statistical purposes. Recommendation: We recommend that the Department implement policies and procedures that require a comprehensive review of SEFA schedules prior to submission to OSC. In addition, we recommend enhanced oversight of policies and procedures to ensure they are consistently applied and the SEFA is accurate and complete. Corrective Action Plan: See F-17 Management’s Response: The Department agrees with this finding. The SEFA Review Procedure has been updated to include more specific information regarding the calculation of amounts reported for the Special Milk Program and noncash assistance and the classification of payments made to a school as direct payments rather than subrecipient expenditures. Contact: Nicole Denis, Director of Finance, DOE, 207-530-2161 (State Number: 24-1203-01)

(2024-035) Title: Internal control over CNC donated food inventory needs improvement Prior Year Findings: See schedule of Findings and Questioned Costs for chart/table State Department: Education State Bureau: Child Nutrition Services Federal Agency: U.S. Department of Agriculture Assistance Listing Title: Child Nutrition Cluster Assistance Listing Number: 10.553, 10.555, 10.556, 10.559, 10.582 Federal Award Identification Number: See E-77 to E-78 Compliance Area: Special tests and provisions Type of Finding: Significant deficiency Questioned Costs: None Criteria: 2 CFR 200.303; 7 CFR 250.12 and .19 The Department must establish and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. On an annual basis, the distributing agency must conduct a physical review of donated food inventories at all storage facilities used by the distributing agency and must reconcile physical and book inventories of donated foods. The distributing agency must ensure that a separate inventory record of donated foods is maintained. The distributing agency’s system of inventory management must ensure that donated foods are distributed in a timely manner and in optimal condition. Condition: The Child Nutrition Cluster includes the School Breakfast Program, National School Lunch Program, Special Milk Program for Children, Summer Food Service Program, and the Fresh Fruits and Vegetable Program. The objectives of the programs are to provide nutritious meals to eligible children in schools and summer food programs, to foster healthy eating habits by providing fresh fruits and vegetables to children attending elementary schools, and to encourage consumption of nutritious agriculture commodities. The Department receives donated foods from the U.S. Department of Agriculture (USDA) for distribution to School Food Authorities (SFAs) and sponsors participating in the National School Lunch Program or the Summer Food Service Program. In fiscal year 2022, the Department implemented a new inventory system for tracking donated foods. In March 2024, the Department identified that inventory tracking within the Child Nutrition Program system (CNPWeb) was not functioning correctly and order quantities were duplicated. As a result, accurate inventory records were not maintained during fiscal year 2024. The Department submitted a ticket to remediate the system error, and the USDA Food Coordinator manually adjusted inventory records to reflect the duplicated items. The Office of the State Auditor (OSA) tested 11 donated food items to ensure that the Department had properly tracked the items. OSA reviewed the manually-adjusted USDA food requests, inventory receipts, and distributions made to SFAs and sponsors and to verify that the documentation corresponded to information in the inventory system and physical inventory counts, and found four instances where the adjusted records did not agree, as follows: • Manually-adjusted system inventory records for: o one food item identified 26 cases less than OSA calculated, and the physical inventory count indicated 27 cases less than the manually-adjusted system inventory records. o one food item requested through CNPWeb exceeded the number of cases available due to the system edit check for ordering in excess of items available was not implemented. o one food item identified three cases less than OSA calculated, and the physical inventory documentation indicated one less case than the manually-adjusted system inventory records. • Physical inventory documentation for one food item identified two cases more than OSA calculated and two cases more than manually-adjusted system inventory records. OSA selected a non-statistical random sample. OSA performed a physical inventory inspection and identified that discrepancies existed between the manually-adjusted system inventory items and the physical items on hand for 36 of the 41 food items tested. The Department did not document justification for the inventory discrepancies. Context: In fiscal year 2024, the Department distributed $6.3 million of USDA donated foods to SFAs and sponsors. Cause: Lack of oversight to ensure that: • the newly implemented inventory tracking system is properly configured; and • review, remediation and justification of inventory discrepancies is documented. Effect: • Noncompliance with Federal regulations • Inaccurate reporting of noncash Federal awards on the Schedule of Expenditures of Federal Awards • Theft, loss, or damage of inventory may go undetected. Recommendation: We recommend that the Department: • review the configuration of the inventory tracking system to remediate variances; • regularly reconcile system inventory records to physical inventory counts; and • document the justification of any inventory discrepancies. Corrective Action Plan: See F-17 Management’s Response: The Department agrees with this finding. CNPWeb is still not working correctly, and there were too many errors during the physical inventory. Contact: Jane McLucas, Director of Child Nutrition, DOE, 207-624-6880 (State Number: 24-1203-03)

(2024-036) Title: Internal control over CNC cash management needs improvement Prior Year Findings: None State Department: Education Administrative and Financial Services State Bureau: Child Nutrition Services General Government Service Center Federal Agency: U.S. Department of Agriculture Assistance Listing Title: Child Nutrition Cluster Assistance Listing Number: 10.553, 10.555, 10.556, 10.559, 10.582 Federal Award Identification Number: See E-77 to E-78 Compliance Area: Cash management Type of Finding: Significant deficiency Questioned Costs: None Criteria: 2 CFR 200.303; 31 CFR 205.33; State Administrative and Accounting Manual (SAAM) Section 50.40.80 The Department must establish and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. The Department must minimize the time between the drawdown of Federal funds and the disbursement of these funds for Federal program purposes. The timing and amount of fund transfers must be as close as administratively feasible to the Department’s actual cash outlay for program costs. Section 50.40.80 of the SAAM has defined administratively feasible as no more than seven business days. Condition: Child Nutrition Services (CNS) is responsible for approving monthly Claims For Reimbursement (CFRs) submitted by School Food Authorities (SFAs). The Department of Administrative and Financial Services’ General Government Service Center (GGSC) is responsible for the drawdown of Federal funds to pay for Child Nutrition Cluster (CNC) program expenditures. GGSC utilizes a batch report of CFR amounts approved through the Child Nutrition Program system (CNPWeb) for the drawdown. The Office of the State Auditor (OSA) performed analytical procedures over CFRs and identified two reimbursements that exceeded average CFRs. Further procedures found: • one payment was the result of the SFA erroneously claiming all meals served as free meals, and therefore, paid entirely with Federal funds. The SFA subsequently modified the CFR and claimed only 16 percent of meals served as free, resulting in an overpayment of approximately $113,000. To recover the overpayment, CNS subtracted a portion from subsequent monthly claims with the final recoupment occurring in April 2024. As a result, the SFA had excess cash on hand from November 2023 through April 2024. • the other payment was the result of a rejected payment. The November 2023 payment intended for September and October CFRs was rejected by the State’s accounting system. As a result, the December payment to the SFA included CFRs from September through November. The drawdown of Federal funds for the September and October CFRs occurred in November; however, the SFA was not paid until December. GGSC and CNS did not have controls in place to monitor and ensure that batch payments were processed timely. As a result, the State had excess cash on hand for one month. Context: CNS processed $61.8 million in CFRs in fiscal year 2024. Cause: • Lack of supervisory oversight • Lack of adequate policies and procedures • A revision to a CFR within 60 days that does not increase total reimbursement does not trigger an edit check in the CNPWeb system for manual review. The edit check function is designed to only check overall increases or decreases in the total CFR; therefore, the overpayment of Federal funds went undetected because CNS supplements the Federal meal reimbursement with State funds. Effect: • The Federal government may impose more stringent program-specific cash management requirements based on noncompliance. • Noncompliance with Federal regulations Recommendation: We recommend that CNS: • continue to work with GGSC to ensure that batch payments approved for processing are paid timely; and • adjust edit checks in the CNPWeb system to identify changes in Federal and State funding rather than using the total claim amount in order to prevent overpayments. Corrective Action Plan: See F-18 Management’s Response: The Department partially agrees with this finding. The Department acknowledges that improvements could be made over the controls to ensure the timely processing of batch payments. As a result, new procedures have been developed and implemented to confirm that batch payments are processed without delay. However, the Department disagrees with the characterization of noncompliance with cash management requirement regarding the overpayment recoupment and believes the current controls effectively addressed the issue. The CNPWeb system already includes edit checks that track, offset, and reconcile adjustments between state and federal payments within the federal fiscal year, ensuring compliance with both 7 CFR 210.9 and 2 CFR 200.302. The $113,000 overpayment was fully recouped within the same fiscal year through systematic monthly offsets. These offsets occurred within the fund account (school lunch), and the balance was fully corrected through the current claims without any risk of misallocation. All actions were taken within CNPWeb, with no need for intervention outside of the system. 7 CFR 210.9 provides guidance on maintaining appropriate balances for school-level accounts and is not intended to govern isolated errors that were promptly detected and resolved through established program procedures. The Department does not believe that a three-month excess threshold applies in this case, as the error was corrected in accordance with program requirements, and the funds were reconciled in a timely manner. The Department maintains that the existing internal controls, along with the newly implemented procedures, adequately address the identified issues. Contact: Jane McLucas, Director of Child Nutrition, DOE, 207-624-6880 Auditor’s Concluding Remarks: The Department’s Management Response incorrectly cites 7 CFR 210.9 which outlines requirements for the SFA, not the State. The applicable criteria for the compliance exceptions is 31 CFR 205.33 which is referenced in the finding Criteria. The Department did not return excess funds to the Federal government, nor gain approval to retain the funds when the overpayment was identified. This resulted in excess cash on hand at the Department level and thus, noncompliance with 31 CFR 205.33. The Department is misinterpreting that the return of Federal funds at the State level is only required when the funds are returned to the Department from the SFA. Therefore, the Department does not have adequate controls over cash management requirements. The finding remains as stated. (State Number: 24-1203-07)

(2024-037) Title: Internal control over WIC subrecipient cash management needs improvement Prior Year Findings: See schedule of Findings and Questioned Costs for chart/table State Department: Health and Human Services State Bureau: Division of Contract Management Maine Center for Disease Control & Prevention Federal Agency: U.S. Department of Agriculture Assistance Listing Title: Special Supplemental Nutrition Program for Women, Infants, and Children (WIC) (COVID-19) Assistance Listing Number: 10.557 Federal Award Identification Number: See E-77 to E-78 Compliance Area: Cash management Subrecipient monitoring Type of Finding: Significant deficiency Questioned Costs: None Criteria: 2 CFR 200.303; 2 CFR 200.305 The Department must establish and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. The Department is required to monitor cash drawdowns by their subrecipients to ensure that the time elapsing between the payment of Federal funds to the subrecipient and the subrecipient’s actual disbursement for program purposes is minimized. Condition: The Department’s Division of Contract Management (DCM) has three methods for providing payments to subrecipients: cost-settled, cost-settled by invoice, and fee-for-service subawards. • For cost-settled subawards, DCM procedures include making equal advance monthly payments and then reconciling those amounts to the quarterly financial reports submitted by the subrecipient. This procedure does not take into consideration the time elapsing between the payment of Federal funds to the subrecipient and the subrecipient’s actual disbursement for program purposes. • For “cost-settled by invoice” (reimbursement) subawards, DCM procedures do not require subrecipients to include supporting documentation with monthly requests for reimbursement nor do they request supporting documentation at a subsequent date. This procedure does not take into consideration the time elapsing between the payment of Federal funds to the subrecipient and the subrecipient’s actual disbursement for program purposes. • Cash management requirements are not applicable for fee-for-service subawards. Maine Center for Disease Control & Prevention (MeCDC) is responsible for ensuring the WIC program’s subrecipients comply with Federal requirements; however, MeCDC’s subrecipient monitoring procedures do not include review of subrecipient compliance with cash management requirements. All of WIC’s subawards are cost-settled. Therefore, DCM and MeCDC procedures do not support that subrecipient cash management is properly monitored as required by Federal regulations. Context: In fiscal year 2024, the Department provided $5.9 million to subrecipients from WIC grant funds totaling $22.8 million. Cause: • Lack of adequate subrecipient monitoring procedures • Lack of centralized oversight of subrecipient monitoring Effect: • Noncompliance with Federal regulations • Federal programs may not be effectively and efficiently administered. • The Federal government may require the implementation of more stringent subrecipient cash management procedures. Recommendation: We recommend that MeCDC collaborate with DCM to implement monitoring procedures over subrecipient cash management requirements to ensure that the time elapsing between the payment of Federal funds to the subrecipient and the subrecipient’s actual disbursement for program purposes is minimized for the WIC program. Corrective Action Plan: See F-18 Management’s Response: The Department disagrees with this finding. The Department is in compliance with the requirement for minimizing the time between payments to our subrecipients and the disbursement of the funds. Payments are made as close as administratively feasible. The Compliance Supplement suggested audit procedures for Cash Management for pass-through entities refers to 200.305(b)(1)...that same paragraph states that the timing and amount of advance payments must be as close as is administratively feasible. Contact: Anthony Madden, Deputy Director, Division of Audit, DHHS, 207-287-2834 Auditor’s Concluding Remarks: The Department’s interpretation of the applicable Federal regulation selectively emphasizes a single sentence from the broader paragraph, omitting critical context that informs the regulation’s full intent. According to the 2024 Compliance Supplement, pass-through entities must monitor cash drawdowns by their subrecipients to ensure that the time elapsing between the transfer of Federal funds to the subrecipient and their disbursement for program purposes is minimized as required by the applicable cash management requirements in the Federal award to the recipient (2 CFR section 200.305(b)(1)). 2 CFR section 200.305(b)(1) states that the recipient or subrecipient must be paid in advance, provided it maintains or demonstrates the willingness to maintain both written procedures that minimize the time elapsing between the transfer of funds and disbursement by the recipient or subrecipient, and financial management systems that meet the standards for fund control and accountability as established in this part. Advance payments to a recipient or subrecipient must be limited to the minimum amounts needed and be timed with actual, immediate cash requirements of the recipient or subrecipient in carrying out the purpose of the approved program or project. The timing and amount of advance payments must be as close as is administratively feasible to the actual disbursements by the recipient or subrecipient for direct program or project costs and the proportionate share of any allowable indirect costs. The recipient or subrecipient must make timely payments to contractors in accordance with the contract provisions. The Department references the phrase “as close as is administratively feasible” to justify their current process; however, this phrase is part of a broader requirement that establishes specific conditions for advance payments. The regulation requires that the timing between when the subrecipient receives Federal funds from the State and when the subrecipient disburses those funds is closely monitored to ensure that disbursements align with actual, immediate cash needs. A full reading of the provision indicates that “administratively feasible” does not negate the obligation to implement effective controls that minimize this gap, nor does it permit delays or inadequate oversight in Federal cash management. The Department could not provide evidence to demonstrate that they adequately monitored subrecipient cash drawdowns to ensure alignment with actual, immediate cash needs. Additionally, the Department does not require subrecipients to submit invoice documentation to substantiate the timing, amount, or nature of expenditures included in the request of Federal funds. As a result, the Department cannot demonstrate an adequate level of monitoring, as there is no evidence that they collect the necessary information to ensure compliance with Federal cash management requirements. The finding remains as stated. (State Number: 24-1113-03)

(2024-038) Title: Internal control over WIC cash balances needs improvement Prior Year Findings: See schedule of Findings and Questioned Costs for chart/table State Department: Health and Human Services Administrative and Financial Services State Bureau: Maine Center for Disease Control & Prevention Health and Human Services Service Center Federal Agency: U.S. Department of Agriculture Assistance Listing Title: Special Supplemental Nutrition Program for Women, Infants, and Children (WIC) (COVID-19) Assistance Listing Number: 10.557 Federal Award Identification Number: See E-77 to E-78 Compliance Area: Cash management Type of Finding: Significant deficiency Questioned Costs: None Criteria: 2 CFR 200.303; 2 CFR 200.302 The Department must establish and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and terms and conditions of the awards. Financial records must adequately identify the source and application of funds and provide accountability for all funds, property, and other assets related to the Federally-funded activities. Condition: The Office of the State Auditor (OSA) issued finding 2019-021 as a result of procedures performed for the fiscal year 2019 audit. This finding identified that “Program personnel did not take the existing cash balance into consideration when requesting Federal funds for the Food portion of the WIC grant.” This resulted in an excess cash balance for the Food grant. The finding continues to be repeated as the Department has not returned the funds to the Federal awarding agency and the excess cash balance remains. Context: The Department calculated a $1,055,104 residual cash balance from the 2013 WIC Food grant and a $4,100 residual cash balance from the 2018 WIC Food grant. Cause: Lack of adequate recordkeeping and account reconciliation in prior years. The Department has made efforts to seek disposition from the Federal awarding agency; however, the issue has not been resolved. Effect: The State may be required to return $1,059,204 to the Federal awarding agency. Recommendation: We recommend that the Department continue efforts to resolve this matter with the Federal awarding agency. Corrective Action Plan: See F-18 Management’s Response: The Department and the DHHS Financial Service Center agree with this finding. The Department will work with the Federal Agency on steps needed to resolve the cash discrepancy. Contact: Sarah Gove, Director, DHHS Service Center, DAFS, 207-458-6626 (State Number: 24-1113-01)

(2024-039) Confidential finding, see below for more information Title: Internal control over UI claim payments needs improvement Prior Year Findings: See schedule of Findings and Questioned costs for chart/table State Department: Labor State Bureau: Unemployment Compensation Federal Agency: U.S. Department of Labor Assistance Listing Title: Unemployment Insurance (UI) (COVID-19) Assistance Listing Number: 17.225 Federal Award Identification Number: See E-77 to E-78 Compliance Area: Eligibility Type of Finding: Significant deficiency Questioned Costs: None Criteria: 2 CFR 200.303; 20 CFR 615.8; Middle Class Tax Relief and Job Creation Act of 2012; Social Security Act Title III, Section 303; Unemployment Insurance Program Letter No. 5-13; 26 MRSA 1190 through 1199 The Department must establish and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. A State administering Unemployment Insurance (UI) must have State laws and policies in place that are consistent with Federal provisions and required by 20 CFR 615.8; the Middle Class Tax Relief and Job Creation Act of 2012; Social Security Act Title III, Section 303; and Unemployment Insurance Program Letter No. 5-13, as follows: • Standards for claim filing and processing including appeals and reviews, communication with claimants and employers, eligibility standards and disqualifications, and Interstate Benefit Payments and agreements • Standards for reasonable work search criteria and policies requiring performance of internal audits of work search activity • Standards for program integrity outlining procedures for identification and recovery of overpayments and penalties, including recovery through offset of future benefit payments The State of Maine’s statutory requirements for UI program benefits are outlined in 26 MRSA 1190 through 1199. Condition: Pursuant to paragraph 6.63 of the U.S. Government Accountability Office’s Government Auditing Standards (also known as the Yellow Book), we omitted details from this finding as they are confidential under the provisions of 5 MRSA 244-C (3). Though the content of this finding has been redacted, we provided the Department(s) with detailed information regarding the specific condition we identified, as well as the related criteria, context, causes, effects, and our specific recommendations for improvement. The Department has complementary controls in place over claimant eligibility, including: • performance of internal work search audits by MDOL personnel for one percent of weekly claims, and • establishment of a Benefits Quality Control Unit tasked with investigating a prescribed number of UI paid claims and denied claims each week. The Office of the State Auditor performed data analytic procedures surrounding continuing eligibility requirements for weekly claim submission and work search activity entered by claimants and identified the following indications of claimant program abuse: • 21 claimants reported repetitive work search activities for all fiscal year 2024 claims, ranging from 7 to 14 consecutive benefit weeks. • 24 claimants reported the same work search contact for all fiscal year 2024 claims, ranging from 17 to 34 consecutive benefit weeks. • Six claimants reported new return to work dates ranging from 7 to 11 consecutive benefit weeks, which generated new temporary unemployment waivers allowing claimants to file weekly claims without reporting work search activities. • Five claimants reported part-time work totaling less than 10 hours per week ranging from 8 to 21 consecutive benefit weeks, generating new weekly unemployment waivers allowing the claimant to file weekly claims without reporting work search activities. Context: In fiscal year 2024, the UI program provided approximately $119 million in State UI benefits and $800 thousand in Federal UI benefits. Cause: • Lack of adequate policies and procedures over continuing claimant eligibility determinations • Lack of adequate supervisory oversight of information system application controls Effect: • Claimants may be incorrectly determined eligible for UI benefits without meeting Federal program requirements, which may result in unallowable issuances of benefit payments that could remain undetected. • Potential questioned costs and disallowances Recommendation: We recommend that the Department enhance policies and procedures to require: • implementation of additional information system application controls. • incorporation of data analytics and data cross-matching procedures to prevent or detect payments to ineligible claimants. This will provide assurance that eligibility requirements are met and adequately supported, and that payments to ineligible claimants are prevented, or detected and corrected, in a timely manner. Corrective Action Plan: See F-18 Management’s Response: The Department partially agrees with this finding. The Department acknowledges these audit findings and uses them to refine its system controls to enhance compliance and accuracy in processing claims. Regarding work search waivers for individuals with a return-to-work date, the Department agrees with the finding and implemented a system update in January 2025 to more effectively administer return to work, work search waivers. Based on specifics of the selected cases, management disagrees with the characterization of some work search activities as repetitive. Work search assistance through the Department’s CareerCenters may appear repetitive on a weekly claim but work search assistance from Department staff is both varied and productive. Additionally, job openings during the covered period were frequent, even with the same employer. When work search or other issues are detected on a claim, the Department schedules a fact-finding interview and requests additional documentation. State law requires the Department to continue an individual’s benefits pending a fact-finding review, for which the individual must be given at least seven days’ notice. In addition to conducting fact-finding interviews on issues detected on the weekly claim, the Department randomly audits 3% of claims each week to verify the information provided. Using information obtained through fact-finding interview, a claims adjudicator may uphold the payment of benefits or require the benefits to be repaid. While our policies and procedures align with existing regulations and are functioning as intended, the Department is committed to continuously improving our systems and processes in order to better serve claimants and uphold program integrity. The identified cases will be used to further refine our procedures. Contact: Suzan McKechnie, Director, Bureau of Unemployment Compensation, DOL, 207-621-5126 Auditor’s Concluding Remarks: The Department is required to establish and maintain effective internal control over compliance with eligibility requirements. While the Department does have controls in place to perform fact-finding interviews and work search audits, those procedures are carried out after UI benefits have been paid. The data analytics procedures noted in the Condition identified potential instances of program abuse and claimant activity with a high risk of noncompliance that was not detected by the Department’s existing internal controls. Implementation of additional information system application controls and incorporation of data analytics and data cross-matching procedures will provide further assurance that eligibility requirements are met and adequately supported, and that payments to ineligible claimants are prevented, or detected and corrected, in a timely manner. The finding remains as stated. (State Number: 24-1302-02)

(2024-040) Title: Internal control over UI overpayments needs improvement Prior Year Findings: None State Department: Labor State Bureau: Unemployment Compensation Federal Agency: U.S. Department of Labor Assistance Listing Title: Unemployment Insurance (UI) (COVID-19) Assistance Listing Number: 17.225 Federal Award Identification Number: See E-77 to E-78 Compliance Area: Special tests and provisions Type of Finding: Significant deficiency Questioned Costs: None Criteria: 2 CFR 200.303; Public Law Nos. 112-40 and 113-67 The Department must establish and maintain effective internal controls over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. The State is required to properly identify and establish overpayments, track repayments, and process them regularly to ensure recovered payments are returned to the original funding source. The Department must sufficiently automate Unemployment Insurance (UI) operations and appropriately handle overpayment information to obtain, correspond, maintain, and transmit information concerning UI benefits. Condition: The Maine Department of Labor (MDOL) promotes and maintains the integrity of the UI program through the prevention, detection, and recovery of UI overpayments made to claimants. An UI overpayment may be established if a claimant is ultimately deemed ineligible for UI benefits after already receiving payment. MDOL must properly identify and establish overpayments to ensure that appropriate follow up action is initiated based on the classification of the overpayment. Once an overpayment is established and classified, a Demand for Payment Notice is generated within the ReEmployME system and transmitted to the claimant to initiate recoupment. The ReEmployME information system stores all claimant overpayment information including data on specific overpayment classifications, causes, and decisions; history logs; and correspondence with claimants. The Office of the State Auditor (OSA) tested 60 claimant overpayments to determine whether MDOL properly established, classified, and monitored overpayments and collections, and found that: • the ReEmployME system established a duplicate overpayment for one claimant for the same claim week. Because of the duplication, one record of overpayment totaling $520 remained active within the system after the overpayment was liquidated. • One Demand for Payment Notice was not communicated to the claimant. The overpayment totaling $9,668 remained active and uncollected from August 2023 to the time of audit testing in February 2025. OSA selected a non-statistical random sample. Context: In fiscal year 2024, the UI program provided $119 million in State UI benefits and $800,000 in Federal UI benefits, and the Department identified $6.5 million in claimant overpayments. Cause: • ReEmployME system error • Lack of supervisory oversight • Lack of adequate policies and procedures Effect: • Inaccurate UI claimant and overpayment information within the ReEmployME system • Potential untimely or ineffective recoupment of UI benefit overpayments • Noncompliance with Federal regulations Recommendation: We recommend that the Department enhance policies and procedures, including increased supervisory oversight, to ensure that claimant overpayments are accurately recorded in the ReEmployME system, properly monitored, and collected timely. Corrective Action Plan: See F-19 Management’s Response: The Department agrees with this finding. Remediation efforts are already underway for both issues. Several parameters have been established based on prior findings, and manual monitoring is in place to ensure overpayments are correctly identified. Additionally, federal compliance with the Benefit Accuracy Measurement (BAM) program provides an additional layer of oversight to verify the accuracy of unemployment claims. BAM audits are completed by a unit within the Bureau of Unemployment Compensation. Audits include a comprehensive review of claims and payments. To further enhance oversight, system parameters will be implemented to ensure functionality aligns with MDOL’s agreed-upon standards. The agency remains committed to ensuring compliance, improving system functionality, and reinforcing procedural accuracy to mitigate future occurrences of these issues. Contact: Suzan McKechnie Director, Bureau of Unemployment Compensation, MDOL, 207-621-5126 (State Number: 24-1302-01)

(2024-041) Title: Internal control over monitoring of employee classification and compensation needs improvement Prior Year Findings: See schedule of Findings and Questioned costs for chart/table State Department: Administrative and Financial Services State Bureau: Human Resources Federal Agency: U.S. Department of the Interior U.S. Department of Labor U.S. Department of Education U.S. Department of Health and Human Services Assistance Listing Title: Fish and Wildlife Cluster Unemployment Insurance (UI) (COVID-19) Special Education Cluster (IDEA) (COVID-19) Rehabilitation Services – Vocational Rehabilitation Grants to States CCDF Cluster (COVID-19) Assistance Listing Number: 15.605, 15.611, 15.626; 17.225; 84.027, 84.173; 84.126; 93.489, 93.575, 93.596 Federal Award Identification Number: See E-77 to E-78 Compliance Area: Allowable costs/cost principles Type of Finding: Significant deficiency Questioned Costs: None Criteria: 2 CFR 200.303; 2 CFR 200.430; 5 MRSA 7061 The Department must establish and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. Costs of compensation are allowable to the extent that personal services are rendered during the period of performance under the Federal award, total compensation is reasonable for the services rendered and conforms to the established written policy of the non-Federal entity, and follows an appointment made in accordance with a non-Federal entity’s laws and/or rules or written policies. 5 MRSA 7061 states that the (Bureau of Human Resources (BHR)) director shall record the duties and responsibilities of all positions in State service and establish classes for these positions. The procedure shall provide for periodic updating of job descriptions at least every five years to accurately reflect current duties and responsibilities of each job classification. Condition: BHR maintains the job classification specifications and related compensation plan of State employees. A specific salary specification and grade is assigned based on the duties and responsibilities referenced in the job classification specification; this represents reasonable compensation for the services rendered for all positions that inhabit a given job classification specification. The assigned salary grade provides a basis for the allowability of compensation costs charged to Federal awards by documenting the reasonableness of compensation for services rendered by State employees, and that the position appointments under the job classification specification were made and maintained in accordance with State statute. While BHR relies on data collected from State agencies to implement procedures regarding the classification plan, BHR retains ultimate oversight responsibility. BHR is the only agency with the authority to modify the classification plan. According to 5 MRSA 7061, BHR must provide for periodic updating of job descriptions at least every five years to accurately reflect current duties and responsibilities of each job classification. The Office of the State Auditor (OSA) tested 19 job classification specifications for compliance with 5 MRSA 7061. BHR could not provide documentation for 14 of the 19 job classification specifications tested to support that they were updated within five years as required by 5 MRSA 7061. Additionally, BHR’s current tracking mechanism does not effectively identify the dates of the last review and next scheduled review, thus hindering compliance with the statutory five-year cycle. OSA selected a non-statistical random sample. Context: • During fiscal year 2024, approximately $139 million in payroll expenditures were charged to Federal grants. This represents approximately ten percent of fiscal year 2024 Statewide payroll expenditures, which totaled $1.3 billion. • BHR was responsible for managing approximately 1,200 job classification specifications in fiscal year 2024. Cause: • Lack of resources • Lack of adequate policies and procedures • Lack of supervisory oversight Effect: State employee job classification and compensation may not accurately reflect the current duties and responsibilities of each position. Without documented evidence that review activities are occurring, BHR cannot ensure that the decisions involving the classification and compensation plan of all State employee positions are properly supported by documentation that accurately reflects the current duties and responsibilities of each position. As a result, this may lead to noncompliance with Federal and State regulations.   Recommendation: We recommend that the Department: • enhance oversight regarding the maintenance of the State classification and compensation plan in accordance with State statute; • implement policies and procedures to ensure updates or reviews of the State classification and compensation plan at the job classification specification level are adequately documented; and • implement a tracking mechanism to accurately monitor the dates of past reviews and schedule forthcoming reviews to aid in adherence to the statutory requirement. Corrective Action Plan: See F-19 Management’s Response: The Department disagrees with this finding. The procedure referenced in 5 M.R.S. Sec. 7061(4) is laid out in 18-389 C.M.R. Ch. 4. The Department complies with these written policies and procedures as required by federal and state law. Section 7061(4) was last updated in 2023, with an effective date in October 2023. Pursuant to the JSC on Appropriations, Section 7061(4)(A) requires a review every five years of the state compensation plan for each class or position in the classified service. The FJA process is not related to the compensation plan, however, it is administered under a separate internal control structure that is in place and operating effectively and ensures that the compensation for individual employees is reasonable for the services rendered. The requirement for review of each classification through the FJA process is covered under Section 7061(4)(C) and is required to be reviewed every 10 years. It is also important to note that the Department has conferred with the OAG, who determined that Section 7061(4)(C) is not retroactive, meaning the Department has another 8.5 years to complete a review of all classifications. Additionally, salary studies conducted on State employee wages have shown that the salary and wages of job classifications paid by the State are consistently lower than industry averages, removing the risk that the utilization of these salary schedules as a component of payroll costs will cause overcharges to Federal grants. Contact: Michael J. Dunn, Acting State Human Resources Officer, Bureau of Human Resources, DAFS, 207-287-4651 Auditor’s Concluding Remarks: OSA acknowledges BHR’s reference to 5 MRSA 7061(4), as amended in October 2023, and the procedures for the classification maintenance outlined in 18-389 C.M.R. Ch. 4. We also recognize the distinction BHR draws between the five-year statutory requirement under 5 MRSA 7061(4)(A) for updating job descriptions and compensation plan components, and the ten-year classification plan review introduced under 5 MRSA 7061(4)(C). OSA’s review focused on BHR’s compliance with the five-year update requirement under 5 MRSA 7061(4)(A). While the statute was amended in 2023, the requirement that job descriptions be updated at least every five years has been in place since 1987. The recent amendment did not create this requirement; it expanded BHR’s obligation by tying the update process to the compensation plan and introducing a separate ten-year comprehensive classification review under 5 MRSA 7061(4)(C). These changes reflect an intent to strengthen oversight and modernize the State’s personnel system, not to delay or diminish BHR’s statutory responsibilities. To distinguish between BHR’s statutory responsibilities under 5 MRSA 7061(4)(A) and 5 MRSA 7061(4)(C), subsection (4)(A) requires periodic updating of job descriptions and the compensation plan at least every five years; this ensures that individual job classification specifications remain current and accurately reflect the duties and responsibilities of State positions. In contrast, subsection (4)(C), introduced in 2023, requires a broader, ten-year comprehensive review of the classification plan as a whole. The two requirements serve different purposes and operate on separate cycles. The five-year review of individual classifications under subsection (4)(A) remains an ongoing statutory obligation, regardless of the addition of subsection (4)(C). While BHR references its internal procedures under 18-389 C.M.R. Ch. 4 as evidence of compliance, those procedures do not incorporate or reflect the statutory five-year update requirement in subsection (4)(A) or the ten-year update in subsection (4)(C). Furthermore, BHR could not provide documentation to support that 14 of the 19 job classifications tested by OSA had been reviewed or updated within the required timeframe. BHR does not have a comprehensive system to track classification review dates across the classification plan, making it difficult to demonstrate compliance with the statute or proactively manage updates. Internal policy may guide operations, but compliance is ultimately measured against the statutory requirements that govern those operations. The issues identified in audit testing also have implications for the compensation system. Under 5 MRSA 7065, the State’s compensation plan is developed based on the classification plan, with salary grades assigned to specific job classes according to documented duties and responsibilities. The classification plan is the foundational structure upon which compensation decisions are made. If job descriptions are outdated, or not periodically reviewed as required, positions may be misaligned with inappropriate salary grades, which may lead to pay that does not accurately reflect the nature or complexity of the work, including Federally-funded positions. Without a properly maintained classification system, the State cannot ensure that compensation, whether paid with State or Federal funds, is supported by a valid and compliant classification system. Under 2 CFR 200.430(a)(2), compensation for personal services is allowable under Federal awards only when it follows “an appointment made in accordance with the recipient’s…laws, rules, or written policies.” This Federal regulation places the burden of compliance on the State’s adherence to its own legal framework. The Federal government allows flexibility, but that flexibility hinges on the condition that the State follows its own laws; it is the minimum threshold for allowability requirements over personnel costs. Compliance with this law is not discretionary; it is a legal obligation and direct reflection of the expectations placed on the State by the Legislature and the Federal government. BHR asserts that State employee compensation is consistently below market rates and therefore poses no risk of overcharging Federal programs. Even if BHR’s current assertion that State salaries are below market is accepted, Federal guidance provides that reasonableness in amount is only one factor in determining allowability. Compensation must also follow lawful appointment processes and reflect compliance with State personnel laws. A claim of underpayment is not a compensating control to prevent noncompliance with required classification updates. The following statutes only serve to emphasize the responsibility placed upon BHR and the State Human Resources Officer. Under 5 MRSA 7036, the State Human Resources Officer is explicitly responsible for adopting rules for both classification and compensation plans (7036(I) and (J)), enforcing the Civil Service Law (7036(21)), and conducting both short-term and long-term planning for the State’s personnel system (7036(10)). The Officer is also responsible for responding to reclassification requests (7036(5)) and working closely with agencies on their personnel needs (7036(7)). These statutory responsibilities further confirm that maintaining accurate, up-to-date classification specifications is not discretionary. Moreover, failure to fulfill these legal duties has implications that underscore the purpose of a centralized human resources function. These conditions present a risk to the accessibility to public service employment, including potential delayed hiring decisions and diminished ability to attract and retain a skilled workforce. When classification structures are outdated and statutory mandates are not followed, BHR cannot deliver on its mission. We acknowledge BHR’s consultation with the Office of the Attorney General and its efforts to clarify its interpretation of the law; however, the condition observed during the audit period reflects a neutralization of internal controls and subsequent risk of noncompliance with statutory requirements that directly affect both classification and the allowability of personnel costs under Federal awards. The finding remains as stated. (State Number: 24-0111-01)

(2024-042) Title: Internal control over HAF Program reporting and earmarking needs improvement Prior Year Findings: None State Department: Professional and Financial Regulation State Bureau: Consumer Credit Protection Federal Agency: U.S. Department of the Treasury Assistance Listing Title: Homeowner Assistance Fund Program (COVID-19) Assistance Listing Number: 21.026 Federal Award Identification Number: See E-77 to E-78 Compliance Area: Matching, level of effort, earmarking Reporting Type of Finding: Material weakness Material noncompliance Questioned Costs: None Criteria: 2 CFR 200.303; American Rescue Plan Act of 2021, Section 3206; 15 USC 9058d(c)(2) The Department must establish and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. The Department must submit quarterly reports providing financial and performance data regarding administration of the Homeowner Assistance Fund (HAF) Program that include financial data, targeting data, and other information. The Department is also required to submit an annual report to the U.S. Department of the Treasury regarding the impact of the HAF Program. The HAF Program’s earmarking requirements include: • counseling or educational efforts targeted to households eligible to be served related to foreclosure prevention or displacement, in an aggregate amount up to five percent of the funding received by the HAF participant. • planning, community engagement, needs assessment, and administrative expenses for qualified expenses, in an aggregate amount not to exceed 15 percent of the funding received by the HAF participant. If the HAF participant has only received the initial ten percent of its allocation, no more than 50 percent of the initial payment is permitted to be used for the expenses mentioned. • participants providing not less than 60 percent of funds to homeowners with income less than 100 percent Area Median Income (AMI) or 100 percent of U.S. median income. • participants should target homeowners that are classified as Socially Disadvantaged Individuals and 100 percent AMI or less. Condition: The Department contracts with a subrecipient to administer the HAF Program. A Memorandum of Understanding (MOU) between the Department and the subrecipient outlines the following: • The subrecipient is responsible for preparation of all required reporting under the HAF Program. • The Department is responsible for certification and submission of all reports prepared by the subrecipient. During fiscal year 2024, four quarterly financial reports and one annual performance report for the HAF Program were required to be submitted to the Federal government. The MOU requires Department certification and submission of all HAF Program reports; however, the subrecipient prepared and certified all required reports during fiscal year 2024 with no oversight from the Department. In addition, the Department did not maintain records of any fiscal year 2024 HAF Program financial or performance reports or supporting documentation. The Department solicited the reports from the subrecipient only after the Office of the State Auditor’s (OSA) request for audit documentation. The Department subsequently provided OSA with all reports in response to the audit request; however, the Department could not provide documentation to support: • the Department’s review of each financial and performance report prepared by the subrecipient, as it did not occur prior to certification and submission by the subrecipient. • amounts reported on the State’s fiscal year 2024 HAF Program financial and performance reports. • amounts reported on key line items for HAF Program earmarking requirements and related obligation and expenditure totals. The Department has no assurance that HAF Program reports prepared by the subrecipient and submitted to the Federal government on behalf of the State are accurate or properly supported. In addition, the Department has no assurance that the HAF Program was in compliance with Federal requirements for earmarking, as supporting documentation for such compliance is part of the subrecipient’s reporting process. Furthermore, OSA was unable to verify the accuracy of submitted reports or compliance with earmarking requirements, as supporting documentation was not maintained. Context: In fiscal year 2024, the Department expended $29.4 million in HAF Program funds; the entire amount was passed through to the subrecipient. Cause: • Lack of supervisory oversight • Lack of adequate policies and procedures Effect: • Noncompliance with Federal regulations • HAF Program reports, including earmarking requirements, submitted to the Federal government are not properly supported and may not be accurate as documentation is not reviewed or maintained by the Department. • Incomplete or inaccurate HAF Program reports may result in incorrect information used by the Federal government for programmatic, policy, or statistical purposes. Recommendation: We recommend that the Department establish and implement policies and procedures to require a documented review and approval of all HAF Program reports and related earmarking requirements prepared by the subrecipient, prior to certification and submission by the Department as required by the established MOU. This will ensure that information reported to the Federal government is accurate, complete, and properly supported, and that earmarking requirements have been met. Corrective Action Plan: See F-20 Management’s Response: The Department agrees with this finding. The Department will establish and implement additional policies and procedures for this program. The Department will require that the subrecipient submit the required program and financial reports to the department for review prior to submission to the federal agency starting with the reporting period ending March 2025 reporting period. Contact: Rachel Hendsbee, Director, Administrative Services Division, Department of Professional and Financial Regulation, 207-624-8500 (State Number: 24-1698-01)

(2024-043) Title: Internal control over HAF Program subrecipient monitoring needs improvement Prior Year Findings: None State Department: Professional and Financial Regulation State Bureau: Consumer Credit Protection Federal Agency: U.S. Department of the Treasury Assistance Listing Title: Homeowner Assistance Fund Program (COVID-19) Assistance Listing Number: 21.026 Federal Award Identification Number: See E-77 to E-78 Compliance Area: Subrecipient monitoring Type of Finding: Material weakness Material noncompliance Questioned Costs: None Criteria: 2 CFR 200.303; 2 CFR 200.332 The Department must establish and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. The Department must: • evaluate each subrecipient’s risk of noncompliance with Federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate subrecipient monitoring procedures. • verify that the subrecipient is audited as required when a subrecipient’s Federal award expenditures are expected to equal or exceed $750,000 during the fiscal year. • monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. Condition: The Homeowner Assistance Fund (HAF) Program provides funding to mitigate financial hardships associated with the pandemic, including preventing homeowner mortgage delinquencies, defaults, foreclosures, and loss of utilities or home energy services and displacements of homeowners experiencing financial hardships. In fiscal year 2024, the Department passed through HAF Program funds to one subrecipient responsible for administering the program. The Department contracted with a vendor to perform all subrecipient monitoring for the HAF Program; however, only one monitoring report for the first quarter of fiscal year 2024 had been received by the Department at the time of audit testing in February 2025. No subrecipient monitoring information was received by the Department during the actual use of the grant award in fiscal year 2024. As a result, the Department had no assurance in fiscal year 2024 that: • the subrecipient’s risk of noncompliance with Federal statutes, regulations, and the terms and conditions of the subaward was evaluated for purposes of determining the appropriate subrecipient monitoring procedures. • the subrecipient received a Single Audit as required. The Office of the State Auditor reviewed the quarterly monitoring report received from the vendor and noted that the subrecipient’s Single Audit requirement and related monitoring was not addressed. • the activities of the subrecipient were monitored as necessary to ensure that the subaward was used for authorized purposes and in compliance with Federal statutes, regulations, and the terms and conditions of the subaward, and that subaward performance goals were achieved. In addition to untimely vendor subrecipient monitoring reports, the Department’s review and approval of subrecipient reimbursement requests was not adequately designed, as submission of detailed expenditure information with the subrecipient’s requests for reimbursement of HAF Program funds was not required. A summary spreadsheet outlining actual and projected expenditures for the second-tier subrecipient was the only support provided to the Department with each reimbursement request, which does not provide adequate detail to ensure that the subaward was used for authorized purposes. Context: In fiscal year 2024, the Department expended $29.4 million in HAF Program funds; the entire amount was passed through to the subrecipient. Cause: • Lack of supervisory oversight • Lack of adequate policies and procedures Effect: • Noncompliance with Federal regulations • Lack of ongoing or adequate subrecipient monitoring procedures could result in subrecipient noncompliance that would go undetected during the award term. Recommendation: We recommend that the Department develop and implement policies and procedures to ensure that: • all Federal award program subrecipients of the Department are subject to ongoing monitoring activities during the grant award term. • detailed documentation in support of subrecipient reimbursement requests is received prior to payment approval. Corrective Action Plan: See F-20 Management’s Response: The Department agrees with this finding. The Department has contracted with a vendor to perform subrecipient monitoring of the HAF program. The Department will ensure that subrecipient reports adequately detail expenditures. Contact: Rachel Hendsbee, Director, Administrative Services Division, Department of Professional and Financial Regulation, 207-624-8500 (State Number: 24-1698-02)

(2024-044) Title: Internal control over CSLFRF reporting needs improvement Prior Year Findings: See schedule of Findings and Questioned Costs for chart/table State Department: Administrative and Financial Services State Bureau: Security and Employment Service Center Federal Agency: U.S. Department of the Treasury Assistance Listing Title: Coronavirus State and Local Fiscal Recovery Funds (COVID-19) Assistance Listing Number: 21.027 Federal Award Identification Number: See E-77 to E-78 Compliance Area: Reporting Type of Finding: Significant deficiency Questioned Costs: None Criteria: 2 CFR 200.303; 2 CFR 200.332(b); 2 CFR 200.510 The Department must establish and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. The Department must maintain accurate, current, and complete disclosure of the financial results of each Federal award or program in accordance with reporting requirements. The Department must prepare a Schedule of Expenditures of Federal Awards (SEFA) for the period covered by the State’s financial statements which must include the total Federal awards expended. At a minimum, the SEFA must provide total Federal awards expended for each individual Federal program and the Assistance Listing Number (ALN) and include the total amount provided to subrecipients from each Federal program. Condition: The Department of Administrative and Financial Services’ Security and Employment Service Center (SESC) is responsible for accurately recording information needed to report on the Coronavirus State and Local Fiscal Recovery Funds (CSLFRF) Quarterly Project and Expenditure Reports. Information from these CSLFRF reports is used by the Office of the State Controller for SEFA preparation. The Office of the State Auditor reviewed amounts reported on the SEFA and identified $9.7 million of Federal expenditures incorrectly reported as amounts provided to subrecipients that should have been reported as direct expenditures. SESC inaccurately identified vendors as subrecipients. As a result, vendor payments were incorrectly classified as subrecipient payments on the CSLFRF Quarterly Project and Expenditure Reports and were incorrectly included in the initial amount reported on the SEFA as amounts provided to subrecipients. Context: Payments to the providers totaled $9.7 million of the $209.6 million in fiscal year 2024 CSLFRF expenditures. Cause: • Lack of adequate policies and procedures • Lack of supervisory oversight Effect: • Incomplete or inaccurate reporting of expenditures on the CSLFRF reports and SEFA, which are submitted to the Federal government, may result in incorrect information used for programmatic, policy or statistical purposes. • Noncompliance with Federal regulations Recommendation: We recommend that the Department implement policies and procedures to ensure contractors and subrecipients are appropriately classified and reported on the CSLFRF Quarterly Project and Expenditure Reports and SEFA. Corrective Action Plan: See F-20 Management’s Response: The Department agrees with this finding. The Security and Employment Service will continue to work with our partner agencies to help ensure the sub-recipient/vendor classification is appropriately determined when the initial contracts are written. In this case, the contracts ended in July 2023 and the contracting agency did not amend the contracts to change the classification. Contact: Marilyn Leimbach, Director, SESC, DAFS, 207-248-2556 (State Number: 24-1699-03)

(2024-045) Title: Internal control over CSLFRF subrecipient risk evaluation procedures needs improvement Prior Year Findings: See schedule of Findings and Questioned costs for chart/table State Department: Labor State Bureau: Commissioner’s Office Federal Agency: U.S. Department of the Treasury Assistance Listing Title: Coronavirus State and Local Fiscal Recovery Funds (COVID-19) Assistance Listing Number: 21.027 Federal Award Identification Number: See E-77 to E-78 Compliance Area: Subrecipient monitoring Type of Finding: Significant deficiency Questioned Costs: None Criteria: 2 CFR 200.303; 2 CFR 200.332 The Department must establish and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. The Department is required to evaluate each subrecipient’s risk of noncompliance with Federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate subrecipient monitoring described in 2 CFR 200.332. Condition: As part of the American Rescue Plan Act, the State was advanced approximately $997 million in Federal Coronavirus State and Local Fiscal Recovery Funds (CSLFRF) to support its response to and recovery from the COVID-19 public health emergency. The Maine Department of Labor (MDOL) partnered with subrecipients to support the administration of CSLFRF. MDOL has a documented policy that requires subrecipient risk evaluations. The Office of the State Auditor (OSA) tested 44 subrecipients paid by various State agencies under CSLFRF, including five MDOL subrecipients, to ensure that proper subrecipient monitoring was performed as required by Federal regulations. MDOL subrecipient monitoring procedures included providing Federal award information in grant award agreements, communicating program guidelines, establishing reporting requirements, providing technical assistance, and communicating with the subrecipients to discuss program performance; however, MDOL could not provide evidence to demonstrate that monitoring procedures were established in response to an evaluation of the subrecipient’s risk of noncompliance for the five MDOL subrecipients tested. OSA selected a nonstatistical random sample. Context: During fiscal year 2024, the Department provided $5.8 million to 39 MDOL subrecipients, from a total of $137.9 million provided to all CSLFRF subrecipients. Cause: • Lack of supervisory oversight • Lack of adequate procedures Effect: Subrecipients that are deemed higher risk may not be monitored on a more frequent basis. Conversely, subrecipients that are deemed lower risk may not be monitored on a less frequent basis, which would free resources and time to dedicate towards other higher risk subrecipients. Recommendation: We recommend that the Department enhance oversight over policies and procedures that require evaluation of each subrecipient’s risk of noncompliance specifically for the purposes of determining the appropriate subrecipient monitoring to be performed. This will ensure subrecipients are monitored appropriately based on risk designation. Corrective Action Plan: See F-20 Management’s Response: The Department agrees with this finding. MDOL received funds via the Maine Jobs and Recovery Plan to accomplish several goals across 20 unique initiatives. To best meet the goals of several initiatives, MDOL selected various partners to work with - via a competitive Request for Applications (RFA) process or other contractual arrangement. MDOL’s competitive RFA process required evaluating individual applicants’ previous experience in managing grants and delivering similar programs, which directly correlated with selection criteria and grantee scoring. After selection, grantees are required to submit quarterly performance reports and participate in grantee check-in calls at least twice per year. For grantees not on track to meet their performance goals, monthly calls were held with interim progress milestones set to track performance. While the above procedures were implemented for all subrecipients, going forward, the Department will document that monitoring procedures were established in response to an evaluation of the subrecipient’s risk of noncompliance. Contact: Kimberley Moore, Director, Bureau of Employment Services, MDOL, 207-620-0183 (State Number: 24-1699-04)

(2024-046) Title: Internal control over CSLFRF subrecipient cash management needs improvement Prior Year Findings: None State Department: Health and Human Services State Bureau: Division of Contract Management Office of Aging and Disability Services Federal Agency: U.S. Department of the Treasury Assistance Listing Title: Coronavirus State and Local Fiscal Recovery Funds (COVID-19) Assistance Listing Number: 21.027 Federal Award Identification Number: See E-77 to E-78 Compliance Area: Cash management Subrecipient monitoring Type of Finding: Significant deficiency Questioned Costs: None Criteria: 2 CFR 200.303; 2 CFR 200.305 The Department must establish and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. The Department is required to monitor cash drawdowns by their subrecipients to ensure that the time elapsing between the payment of Federal funds to the subrecipient and the subrecipient’s actual disbursement for program purposes is minimized. Condition: The Department’s Division of Contract Management (DCM) has three methods for providing payments to subrecipients: cost-settled, cost-settled by invoice, and fee-for-service subawards. • For cost-settled subawards, DCM procedures include making equal advance monthly payments and then reconciling those amounts to the quarterly financial reports submitted by the subrecipient. This procedure does not take into consideration the time elapsing between the payment of Federal funds to the subrecipient and the subrecipient’s actual disbursement for program purposes. • For “cost-settled by invoice” (reimbursement) subawards, DCM procedures do not require subrecipients to include supporting documentation with monthly requests for reimbursement nor do they request supporting documentation at a subsequent date. This procedure does not take into consideration the time elapsing between the payment of Federal funds to the subrecipient and the subrecipient’s actual disbursement for program purposes. • Cash management requirements are not applicable for fee-for-service subawards. The Office of Aging and Disability Services (OADS) is responsible for ensuring its subrecipients that received Coronavirus State and Local Fiscal Recovery Funds (CSLFRF) comply with Federal requirements; however, OADS’ subrecipient monitoring procedures do not include review of subrecipient compliance with cash management requirements. All of the CSLFRF subawards from OADS are cost-settled. Therefore, DCM and OADS procedures do not support that subrecipient cash management is properly monitored as required by Federal regulations. Context: In fiscal year 2024, the Department provided $1.5 million to OADS subrecipients from CSLFRF grant funds totaling $209.6 million. Cause: • Lack of adequate subrecipient monitoring procedures • Lack of centralized oversight of subrecipient monitoring Effect: • Noncompliance with Federal regulations • Federal programs may not be effectively and efficiently administered. • The Federal government may require the implementation of more stringent subrecipient cash management procedures. Recommendation: We recommend that OADS collaborate with DCM to implement monitoring procedures over subrecipient cash management requirements to ensure that the time elapsing between the payment of Federal funds to the subrecipient and the subrecipient’s actual disbursement for program purposes is minimized for the CSLFRF program. Corrective Action Plan: See F-20 Management’s Response: The Department disagrees with this finding. The Department is in compliance with the requirement for minimizing the time between payments to our subrecipients and the disbursement of funds. Payments are made as close as administratively feasible. The Compliance Supplement suggested audit procedures for Cash Management for pass-through entities refers to 200.305(b)(1)...that same paragraph states that the timing and amount of advance payments must be as close as is administratively feasible. Contact: Anthony Madden, Deputy Director, Division of Audit, DHHS, 207-287-2834 Auditor’s Concluding Remarks: The Department’s interpretation of the applicable Federal regulation selectively emphasizes a single sentence from the broader paragraph, omitting critical context that informs the regulation’s full intent. According to the 2024 Compliance Supplement, pass-through entities must monitor cash drawdowns by their subrecipients to ensure that the time elapsing between the transfer of Federal funds to the subrecipient and their disbursement for program purposes is minimized as required by the applicable cash management requirements in the Federal award to the recipient (2 CFR section 200.305(b)(1)). 2 CFR section 200.305(b)(1) states that the recipient or subrecipient must be paid in advance, provided it maintains or demonstrates the willingness to maintain both written procedures that minimize the time elapsing between the transfer of funds and disbursement by the recipient or subrecipient, and financial management systems that meet the standards for fund control and accountability as established in this part. Advance payments to a recipient or subrecipient must be limited to the minimum amounts needed and be timed with actual, immediate cash requirements of the recipient or subrecipient in carrying out the purpose of the approved program or project. The timing and amount of advance payments must be as close as is administratively feasible to the actual disbursements by the recipient or subrecipient for direct program or project costs and the proportionate share of any allowable indirect costs. The recipient or subrecipient must make timely payments to contractors in accordance with the contract provisions. The Department references the phrase “as close as is administratively feasible” to justify their current process; however, this phrase is part of a broader requirement that establishes specific conditions for advance payments. The regulation requires that the timing between when the subrecipient receives Federal funds from the State and when the subrecipient disburses those funds is closely monitored to ensure that disbursements align with actual, immediate cash needs. A full reading of the provision indicates that “administratively feasible” does not negate the obligation to implement effective controls that minimize this gap, nor does it permit delays or inadequate oversight in Federal cash management. The Department could not provide evidence to demonstrate that they adequately monitored subrecipient cash drawdowns to ensure alignment with actual, immediate cash needs. Additionally, the Department does not require subrecipients to submit invoice documentation to substantiate the timing, amount, or nature of expenditures included in the request of Federal funds. As a result, the Department cannot demonstrate an adequate level of monitoring, as there is no evidence that they collect the necessary information to ensure compliance with Federal cash management requirements. The finding remains as stated. (State Number: 24-1699-05)

(2024-047) Title: Internal control over Special Education period of performance needs improvement Prior Year Findings: See schedule of Findings and Questioned costs for chart/table State Department: Education Administrative and Financial Services State Bureau: Special Services & Inclusive Education General Government Service Center Federal Agency: U.S. Department of Education Assistance Listing Title: Special Education Cluster (IDEA) (COVID-19) Assistance Listing Number: 84.027, 84.173 Federal Award Identification Number: See E-77 to E-78 Compliance Area: Allowable costs/cost principles Period of performance Type of Finding: Significant deficiency Questioned costs Known Questioned Costs: ALN 84.027 $7,303 Likely Questioned Costs: ALN 84.027 $31,768; likely questioned costs were projected by dividing the known questioned costs identified in the sample by total Federal fiscal year 2022 grant award expenditures tested to establish an error rate, then applying that error rate to total Federal fiscal year 2022 grant award expenditures paid in fiscal year 2024. Criteria: 2 CFR 200.303; 2 CFR 200.403; 34 CFR 76.703 and .709 The Department must establish and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. To be allowable under Federal awards, costs must be necessary and reasonable for the performance of the Federal award and be adequately documented. The Department must obligate Federal award funds during the 27-month period of performance, extending from July 1 of the fiscal year for which the funds were appropriated through September 30 of the second following fiscal year. Condition: The Department of Education’s (DOE) Office of Special Services & Inclusive Education, in conjunction with the Department of Administrative and Financial Services’ General Government Service Center (GGSC), administers Federal funding received through the Special Education Cluster (SEC) program. The SEC program provides grants to states, and through them to Local Education Agencies (LEAs), to assist in providing special education and related services to eligible children. DOE and GGSC procedures include review and approval of requests for reimbursement from LEAs and other programmatic costs including payroll, administrative expenditures, and awards to subrecipients of State-level activities. This review includes a determination of whether the costs are obligated within the applicable Federal award’s period of performance through a comparison of billing dates and billing periods to grant award terms. Period of performance Federal regulations applicable to the SEC program in fiscal year 2024 relate to the Federal fiscal year 2022 grant award. The award’s obligation period ended September 30, 2023, and the liquidation period ended 120 calendar days following, on January 28, 2024. The Office of the State Auditor (OSA) tested 60 expenditure transactions that occurred during the Federal fiscal year 2022 grant award’s liquidation period to ensure that the expenditures were obligated and liquidated in accordance with Federal regulations. OSA identified five transactions totaling $7,303 where obligations occurred after September 30, 2023. Therefore, these transactions did not meet Federal fiscal year 2022 grant award’s period of performance requirements and are not allowable under the terms of the award. As a result, OSA identified questioned costs totaling $7,303. OSA selected a non-statistical random sample. Context: In fiscal year 2024, the Department expended $68.2 million in SEC program funds. Of this total, $5.8 million of Federal fiscal year 2022 grant funds was expended during the award’s liquidation period which occurred during fiscal year 2024. Cause: • Lack of adequate procedures • Lack of supervisory oversight Effect: • Known questioned costs • Potential future questioned costs and disallowances • Noncompliance with Federal regulations Recommendation: We recommend that the Department enhance procedures and increase oversight to ensure that obligation of grant funds is made within period of performance requirements established in the terms and conditions of Federal grant awards. Corrective Action Plan: See F-21 Management’s Response: The Department agrees with this finding. The Office of Special Services & Inclusive Education has developed and will implement a corrective action plan to address the issue identified. Contact: Barbara McGowen, Director of Financial Management, Office of Special Services & Inclusive Education, DOE, 207-624-6645 (State Number: 24-1201-01)

(2024-048) Title: Internal control over Special Education level of effort needs improvement Prior Year Findings: None State Department: Education State Bureau: Commissioner’s Office Special Services & Inclusive Education Federal Agency: U.S. Department of Education Assistance Listing Title: Special Education Cluster (IDEA) (COVID-19) Assistance Listing Number: 84.027, 84.173 Federal Award Identification Number: See E-77 to E-78 Compliance Area: Matching, level of effort, earmarking Type of Finding: Significant deficiency Questioned Costs: None Criteria: 2 CFR 200.303; 34 CFR 300.163 The Department must establish and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. As part of the Special Education program’s level of effort, referred to as maintenance of effort (MOE) requirements, a State must not reduce the amount of State financial support for special education and related services for children with disabilities, or otherwise made available because of the excess costs of educating those children, below the amount of that support for the preceding fiscal year. This is referred to as the State’s Maintenance of State Financial Support (MSFS). Condition: The Department of Education’s (DOE) School Finance and Operations team within the Commissioner’s Office, in conjunction with DOE’s Office of Special Services & Inclusive Education, is responsible for gathering, preparing, and compiling the State’s MSFS data. The MSFS data includes State funds spent on Special Education as well as a calculation of per pupil State support for Special Education. This data, accumulated in a spreadsheet by DOE personnel, is included on DOE’s annual application under Part B of the Individuals with Disabilities Education Act (IDEA). DOE’s application review procedures include the Commissioner certifying that the State has met the MSFS for grant funds made available for Special Education and related services for children with disabilities prior to submission to the Federal government. The Office of the State Auditor (OSA) tested the fiscal year 2024 MSFS calculation and identified that outdated data was used in three formulas in the spreadsheet. While the State’s MSFS was calculated incorrectly, OSA was able to verify that the Department met MOE requirements for fiscal year 2024, which was the greater of: • $481,309,366 for total State financial support made available to Special Education and related services for children with disabilities; or • $13,470 for per capita amount of State financial support. Context: On the fiscal year 2024 IDEA Part B application, the Department reported $484,482,061 for the MSFS; however, $496,227,407 should have been reported. Cause: • Lack of adequate procedures • Lack of supervisory oversight Effect: • The Department is required to maintain a certain level of State financial support. An inaccurate MSFS calculation could result in the Department not meeting MOE requirements. • Inaccurate information reported to the Federal government may be used for programmatic, policy or statistical purposes. Recommendation: We recommend that the Department enhance procedures to ensure that the MSFS data reported to the Federal government is accurate and complete prior to submission. Corrective Action Plan: See F-21 Management’s Response: The Department agrees with this finding. The Office of Special Services & Inclusive Education has developed and will implement a corrective action plan to address the issue identified. Contact: Barbara McGowen, Director of Financial Management, Office of Special Services & Inclusive Education, DOE, 207-624-6645 (State Number: 24-1201-02)

(2024-049) Title: Internal control over ESF subrecipient monitoring procedures needs improvement Prior Year Findings: See schedule of Findings and Questioned costs for chart/table State Department: Education State Bureau: Commissioner’s Office Federal Agency: U.S. Department of Education Assistance Listing Title: Education Stabilization Fund (ESF) (COVID-19) Assistance Listing Number: 84.425D, 84.425R, 84.425U Federal Award Identification Number: See E-77 to E-78 Compliance Area: Subrecipient monitoring Type of Finding: Significant deficiency Questioned Costs: None Criteria: 2 CFR 200.303; 2 CFR 200.313; 2 CFR 200.332 The Department must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the Department is managing the award in compliance with Federal statutes, regulations, and the terms and conditions of the award. For equipment acquired with Federal funding, records must be maintained that include: • a description and identification number; • the source of funding, including the Federal Award Identification Number; • who holds title and the acquisition date; • the cost of the property, including the percentage of Federal participation in the project costs for the Federal award under which the property was acquired; • the location, use and condition; and • any ultimate disposition data including the date of disposal and sale price of the property. A physical inventory of the property must be taken and the results reconciled with the property records at least once every two years. A control system must be developed to ensure adequate safeguards to prevent loss, damage, or theft of the property. Any loss, damage, or theft must be investigated. The Department must monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward, and that subaward performance goals are achieved. Condition: The Education Stabilization Fund (ESF) provides funding to school administrative units (SAUs) to purchase equipment for use in preventing, preparing for, or responding to the COVID-19 pandemic. All SAU equipment purchases reimbursed with ESF are subject to applicable inventory control, log maintenance, and disposition requirements consistent with Federal regulations for equipment and real property management. In the fiscal year 2022 and 2023 audits, the Office of the State Auditor identified that the Department did not have procedures in place to track SAU equipment purchases reimbursed with ESF. During fiscal year 2024, the Department developed policies and procedures to track SAU equipment purchases reimbursed with ESF. These procedures outline documentation to be obtained from SAUs during the next subrecipient monitoring activity. Because the Department has not completed the subrecipient monitoring to obtain the necessary documentation, the Department does not have assurance that: • a complete and accurate record of all equipment purchased with ESF was maintained by each SAU. • subrecipients are in compliance with Federal regulations for equipment and real property management. Context: In fiscal year 2024, ESF expenditures totaled $194.1 million, of which $175.1 million was paid to subrecipient SAUs. Because a complete and accurate record of equipment purchased with ESF is not maintained, the amount of equipment purchased in fiscal year 2024 is unknown. Cause: • Newly developed policies and procedures have not been fully implemented. • Lack of supervisory oversight Effect: • Noncompliance with Federal regulations • SAUs may not be in compliance with equipment and real property management requirements. • Recordkeeping for assets purchased with ESF is not adequate, and as a result, the assets may not be properly safeguarded. Recommendation: We recommend that the Department conduct necessary subrecipient monitoring activities to ensure that a complete and accurate record of all equipment purchased with ESF is maintained by the Department and by each SAU. This record should be documented and maintained in order to verify ongoing compliance with Federal regulations for equipment and real property management. Corrective Action Plan: See F-21 Management’s Response: The Department agrees with this finding. The former Office of Federal Emergency Relief Programs will incorporate the collection of this information in the fiscal year 2024 and 2025 annual performance report. All equipment purchased with ESF will be self-reported by each individual School Administrative Unit. Contact: Shelly Chasse-Johndro, Director, ESEA, DOE, 207-458-3180 (State Number: 24-1235-01)

(2024-050) Title: Internal control over ICA program subrecipient cash management needs improvement Prior Year Findings: See schedule of Findings and Questioned costs for chart/table State Department: Health and Human Services State Bureau: Division of Contract Management Maine Center for Disease Control & Prevention Federal Agency: U.S. Department of Health and Human Services Assistance Listing Title: Immunization Cooperative Agreements (COVID-19) Assistance Listing Number: 93.268 Federal Award Identification Number: See E-77 to E-78 Compliance Area: Cash management Subrecipient monitoring Type of Finding: Significant deficiency Questioned Costs: None Criteria: 2 CFR 200.303; 2 CFR 200.305; 2 CFR 200.332 The Department must establish and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. The Department is required to monitor cash drawdowns by their subrecipients to ensure that the time elapsing between the payment of Federal funds to the subrecipient and the subrecipient’s actual disbursement for program purposes is minimized. The Department must monitor the activities of the subrecipient as necessary to ensure that subawards are used for authorized purposes and in compliance with Federal statutes, regulations, and the terms and conditions of the subaward. Condition: The Department’s Division of Contract Management (DCM) has three methods for providing payments to subrecipients: cost-settled, cost-settled by invoice, and fee-for-service subawards. • For cost-settled subawards, DCM procedures include making equal advance monthly payments and then reconciling those amounts to the quarterly financial reports submitted by the subrecipient. This procedure does not take into consideration the time elapsing between the payment of Federal funds to the subrecipient and the subrecipient’s actual disbursement for program purposes. • For “cost-settled by invoice” (reimbursement) subawards, DCM procedures do not require subrecipients to include supporting documentation with monthly requests for reimbursement nor do they request supporting documentation at a subsequent date. This procedure does not take into consideration the time elapsing between the payment of Federal funds to the subrecipient and the subrecipient’s actual disbursement for program purposes. • Cash management requirements are not applicable for fee-for-service subawards. Maine Center for Disease Control & Prevention (MeCDC) is responsible for ensuring the Immunization Cooperative Agreement (ICA) program’s subrecipients comply with Federal requirements; however, MeCDC’s subrecipient monitoring procedures do not include review of subrecipient compliance with cash management requirements. The ICA program’s subawards are either cost-settled or cost-settled by invoice. Therefore, DCM and MeCDC procedures do not support that subrecipient cash management is properly monitored as required by Federal regulations. Additionally, MeCDC’s monitoring procedures do not include review of subrecipient invoices to ensure ICA grant funds are used for allowable purposes. Context: In fiscal year 2024, the Department provided $1.9 million to subrecipients from ICA grant funds totaling $31.1 million. Cause: • Lack of adequate subrecipient monitoring procedures • Lack of centralized oversight of subrecipient monitoring Effect: • Noncompliance with Federal regulations • Federal programs may not be effectively and efficiently administered. • The Federal government may require the implementation of more stringent subrecipient cash management procedures. Recommendation: We recommend that MeCDC: • collaborate with DCM to implement monitoring procedures over subrecipient cash management requirements to ensure that the time elapsing between the payment of Federal funds to the subrecipient and the subrecipient’s actual disbursement for program purposes is minimized for the ICA program. • implement monitoring procedures over ICA program subrecipients to ensure that grant funds are used for allowable purposes. Corrective Action Plan: See F-22 Management’s Response: The Department disagrees with this finding. The Department is in compliance with the requirement for minimizing the time between payments to our subrecipients and the disbursement of funds. Payments are made as close as administratively feasible. The Compliance Supplement suggested audit procedures for Cash Management for pass-through entities refers to 200.305(b)(1)...that same paragraph states that the timing and amount of advance payments must be as close as is administratively feasible. Contact: Anthony Madden, Deputy Director, Division of Audit, DHHS, 207-287-2834 Auditor’s Concluding Remarks: The Department’s interpretation of the applicable Federal regulation selectively emphasizes a single sentence from the broader paragraph, omitting critical context that informs the regulation’s full intent. According to the 2024 Compliance Supplement, pass-through entities must monitor cash drawdowns by their subrecipients to ensure that the time elapsing between the transfer of Federal funds to the subrecipient and their disbursement for program purposes is minimized as required by the applicable cash management requirements in the Federal award to the recipient (2 CFR section 200.305(b)(1)). 2 CFR section 200.305(b)(1) states that the recipient or subrecipient must be paid in advance, provided it maintains or demonstrates the willingness to maintain both written procedures that minimize the time elapsing between the transfer of funds and disbursement by the recipient or subrecipient, and financial management systems that meet the standards for fund control and accountability as established in this part. Advance payments to a recipient or subrecipient must be limited to the minimum amounts needed and be timed with actual, immediate cash requirements of the recipient or subrecipient in carrying out the purpose of the approved program or project. The timing and amount of advance payments must be as close as is administratively feasible to the actual disbursements by the recipient or subrecipient for direct program or project costs and the proportionate share of any allowable indirect costs. The recipient or subrecipient must make timely payments to contractors in accordance with the contract provisions. The Department references the phrase “as close as is administratively feasible” to justify their current process; however, this phrase is part of a broader requirement that establishes specific conditions for advance payments. The regulation requires that the timing between when the subrecipient receives Federal funds from the State and when the subrecipient disburses those funds is closely monitored to ensure that disbursements align with actual, immediate cash needs. A full reading of the provision indicates that “administratively feasible” does not negate the obligation to implement effective controls that minimize this gap, nor does it permit delays or inadequate oversight in Federal cash management. The Department could not provide evidence to demonstrate that they adequately monitored subrecipient cash drawdowns to ensure alignment with actual, immediate cash needs. Additionally, the Department does not require subrecipients to submit invoice documentation to substantiate the timing, amount, or nature of expenditures included in the request of Federal funds. As a result, the Department cannot demonstrate an adequate level of monitoring, as there is no evidence that they collect the necessary information to ensure compliance with Federal cash management requirements. Furthermore, the Department did not comment on the lack of monitoring procedures over subrecipient invoices to ensure Federal grant funds are used for allowable purposes. The finding remains as stated. (State Number: 24-1118-01)

(2024-051) Confidential finding, see below for more information Title: ________ over the ________ needs improvement Pursuant to paragraph 6.63 of the U.S. Government Accountability Office’s Government Auditing Standards (also known as the Yellow Book), we omitted details from this finding as they are confidential under the provisions of 5 MRSA 244-C (3). Though the content of this finding has been redacted, we provided the Department(s) with detailed information regarding the specific condition we identified, as well as the related criteria, context, causes, effects, and our specific recommendations for improvement. Prior Year Findings: See schedule of Findings and Questioned costs for chart/table Type of Finding: Significant deficiency Corrective Action Plan: See F-22 Contact: Shirley Browne, Deputy State Controller, Office of the State Controller, 207-626-8423 (State Number: 24-0906-01)

(2024-052) Title: Internal control over payments made to TANF clients needs improvement Prior Year Findings: See schedule of Findings and Questioned costs for chart/table State Department: Health and Human Services State Bureau: Office for Family Independence Federal Agency: U.S. Department of Health and Human Services Assistance Listing Title: Temporary Assistance for Needy Families (TANF) Assistance Listing Number: 93.558 Federal Award Identification Number: See E-77 to E-78 Compliance Area: Activities allowed or unallowed Allowable costs/cost principles Type of Finding: Material weakness Material noncompliance Questioned costs Known Questioned Costs: ALN 93.558 $1,014 Likely Questioned Costs: Undeterminable; incorrectly calculating Temporary Assistance for Needy Families (TANF) benefits may result in overpayments or underpayments to clients. Since there are known overpayments and underpayments in our sample, a projection of questioned costs cannot be reasonably estimated. Criteria: 2 CFR 200.303; 2 CFR 200.403; 45 CFR 263.11 The Department must establish and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. To be allowable under Federal awards, costs must be necessary and reasonable for the performance of the Federal award and be adequately documented. The Department must use Federal TANF funds for expenditures that are reasonably calculated to accomplish the purposes of TANF. Use of funds in violation of this is considered misuse of funds. Condition: The Department issues TANF payments directly to TANF clients for various items and services, and to providers on behalf of TANF clients for services rendered such as child care and transportation. The Office of the State Auditor (OSA) tested 60 payments and found that: • one payment issued in July 2023 overpaid a TANF client a total of $200 for clothing. An advance allowance of $200 was issued to the TANF client; however, the TANF client did not submit a receipt substantiating the purchase as required. OSA is questioning costs totaling $200. • four payments issued for transportation were calculated by the Department using a distance other than the most direct route as required. The payments include: o one payment issued in August 2023 that overpaid a TANF client a total of $87. Upon further review, OSA found an additional $524 that was overpaid to the client during fiscal year 2024. OSA is questioning costs totaling $611. o one payment issued in August 2023 that overpaid a TANF client a total of $8. Upon further review, OSA found an additional $107 was overpaid to the client during fiscal year 2024. OSA is questioning costs totaling $115. o one payment issued in March 2024 that overpaid a TANF client a total of $1. Upon further review, OSA found an additional $15 that was overpaid to the client during fiscal year 2024. OSA is questioning costs totaling $16. o one payment issued in October 2023 that underpaid a TANF client a total of $2. Upon further review, OSA found an additional $17 that was underpaid to the client during fiscal year 2024. • two payments issued in June 2024 overpaid a TANF household a total of $72 for transportation. Two $36 bus passes were paid for two clients in the same household, prior to determining program eligibility. OSA is questioning costs totaling $72. OSA selected a non-statistical random sample. Context: In fiscal year 2024, payments to TANF clients for services other than direct cash benefits totaled $2.3 million. Cause: • Lack of adequate procedures • Lack of supervisory oversight Effect: • Known questioned costs • Potential future questioned costs and disallowances • Noncompliance with Federal regulations Recommendation: We recommend that the Department: • implement additional procedures to ensure that payments made to TANF clients are accurate, allowable, and adequately documented; • increase monitoring procedures over these payments; and • establish recoupments for the identified overpayments. Corrective Action Plan: See F-22 Management’s Response: The Department partially agrees with this finding. The Department agrees with and acknowledges both the Condition Statement and the first two Recommendations contained in this finding as reflected in the Departments corrective action plan. The third Recommendation, establish recoupments for the identified overpayments, is already a business process within the OFI Overpayments Team. For clarity, the TANF team ‘refers’ as per policies established in Rule and the Overpayments Team ‘establishes recoupments’. Contact: Ian Yaffe, Director, Office for Family Independence, DHHS, 207-592-1481 Auditor’s Concluding Remarks: OSA acknowledges the Department’s assertion that the establishment of recoupments for identified overpayments is an existing business process; however, current procedures are not adequate. This is evidenced by the six overpayments identified in the Condition for which recoupments had not yet been established as of audit testing. The finding remains as stated. (State Number: 24-1111-05)

(2024-053) Title: Internal control over Income Eligibility and Verification System procedures needs improvement Prior Year Findings: See schedule of Findings and Questioned costs for chart/table State Department: Health and Human Services State Bureau: Office for Family Independence Federal Agency: U.S. Department of Health and Human Services Assistance Listing Title: Temporary Assistance for Needy Families (TANF) Assistance Listing Number: 93.558 Federal Award Identification Number: See E-77 to E-78 Compliance Area: Eligibility Special tests and provisions Type of Finding: Material weakness Material noncompliance Questioned Costs: None Criteria: 2 CFR 200.303; 45 CFR 205.55 and .56 The Department must establish and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. The Department is required to comply with Federal Income Eligibility and Verification System (IEVS) exchange rules and regulations in accordance with program agreements. The Department is required to request through IEVS: • wage information from the State Wage Information Collection Agency (SWICA) for all applicants at the first opportunity following receipt of the application and for all recipients on a quarterly basis; • unemployment compensation information from the agency administering the State’s unemployment compensation program; • all available information maintained by the Social Security Administration; • unearned income information from the Internal Revenue Service; and • any income or other information affecting eligibility available from agencies in the State or other states. The Department is required to resolve all discrepancies identified through IEVS reports within 45 days of receipt. Condition: IEVS is used to exchange information among State and Federal agencies to verify various information needed to determine eligibility for Federal financial assistance. This information is updated in the Automated Client Eligibility System (ACES) to ensure eligibility determinations are made based on current information. IEVS generates various discrepancy reports on a weekly, monthly, and quarterly basis. The Department is required to resolve all discrepancies identified through IEVS within 45 days of receipt and document the resolution in ACES. Federal guidance over the Temporary Assistance for Needy Families (TANF) program outlines audit procedures to ensure that the State has established and implemented the required IEVS exchange for data matching and verification of such data. These procedures include testing a sample of TANF cases subject to IEVS. The Office of the State Auditor (OSA) requested a list of TANF cases subject to IEVS for testing purposes; in response, the Department provided OSA with all IEVS discrepancy reports run in fiscal year 2024. The reports provided by the Department contained TANF, SNAP, and Medicaid/Medicare cases and did not have specific Federal program indicators for the entirety of fiscal year 2024. The Department began adding specific Federal program indicators in October 2023; therefore, without a population of TANF-specific cases for July through September 2023, OSA is unable to verify that the program is in compliance with Federal IEVS requirements. For the remaining reports provided for fiscal year 2024 where the Federal program indicator was noted, OSA tested 70 TANF-specific IEVS discrepancies and found: • one resolution was not documented in ACES. • four discrepancies were resolved between 26 and 125 days past the 45-day requirement. OSA selected a non-statistical random sample. In addition, the Department disclosed that no reviews of the Quarterly Income Discrepancy Reports were completed during fiscal year 2024. As a result, wage information from SWICA was not utilized to ensure eligibility determinations were made based on current information. Context: 224 IEVS reports are required to be generated annually. Of the 224 reports generated, OSA tested 126 reports and was unable to test 98 reports to ensure compliance with Federal IEVS requirements. The number of TANF discrepancies on each report can vary. Cause: • Lack of resources • Lack of supervisory oversight Effect: • IEVS information may not be updated timely in ACES, which could result in incorrect eligibility determinations. • Failure to maintain documentation to support compliance with required TANF exchange rules may result in the U.S. Department of Health and Human Services penalizing the State up to two percent of the grant award. Recommendation: We recommend that the Department increase oversight to ensure that all discrepancies identified through IEVS are resolved within 45 days of receipt and documented in ACES. Corrective Action Plan: See F-23 Management’s Response: The Department agrees resources need to be dedicated to complete the review of the SWICA reports. Implementation of program indicators on IEVS reports began in October of 2023 for the purpose of assisting OSA in their testing. OSA had received all reports, containing all data necessary to conduct testing. It should be noted this requirement has no utility in current eligibility determinations due to the age of the data. Contact: Ian Yaffe, Director, Office for Family Independence, DHHS, 207-592-1481 Auditor’s Concluding Remarks: As stated in the Condition, program indicators on IEVS reports began in October 2023; therefore, OFI could not provide a population of TANF-specific cases for July through September 2023. As a result, OSA is unable to verify that the program is in compliance with Federal IEVS requirements. Additionally, while the Department agrees “resources need to be dedicated to complete the review of the SWICA reports,” the Department did not comment on the noncompliance identified by OSA in testing the Federal IEVS requirements. 45 CFR 205.56 requires the Department to review and compare information obtained from each data exchange against information contained in case records to determine whether the applicant or recipient’s eligibility or the amount of assistance is affected. If the information is received during the application period, the Department shall use such information, to the extent possible, in making the eligibility determination. Therefore, the extent to which the utility of this requirement is affected by “the age of the data” has a direct correlation to the Department’s ability to process the information contained in each data exchange in a timely manner. The finding remains as stated. (State Number: 24-1111-02)

(2024-054) Title: Internal control over TANF client child support sanction procedures needs improvement Prior Year Findings: See schedule of Findings and Questioned Costs for chart/table State Department: Health and Human Services State Bureau: Office for Family Independence Federal Agency: U.S. Department of Health and Human Services Assistance Listing Title: Temporary Assistance for Needy Families (TANF) Assistance Listing Number: 93.558 Federal Award Identification Number: See E-77 to E-78 Compliance Area: Special tests and provisions Type of Finding: Significant deficiency Questioned Costs: None Criteria: 2 CFR 200.303; 45 CFR 264.30; 42 USC 608(a)(2) The Department must establish and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. If the Department determines that an individual is not cooperating with child support enforcement requirements, the Department is required to sanction the individual by deducting an amount equal to not less than 25 percent from the Temporary Assistance for Needy Families (TANF) assistance that would otherwise be provided to the family of the individual and may deny the family any TANF assistance. Condition: The Division of Support Enforcement and Recovery (DSER) is responsible for enforcing child support requirements for clients receiving benefits from the TANF program, which is administered by the Office for Family Independence (OFI). When individuals not cooperating with child support enforcement requirements are identified, DSER personnel initiate a sanction memo in the Child Support Enforcement of Maine (CSEME) system indicating the date of noncooperation with child support requirements. A sanction request is then emailed, with the memo attached, to TANF personnel. After receiving the emailed sanction request, TANF personnel review the individual’s case and determine if a sanction should be applied. The child support sanction process is documented in DSER policy, which specifies that failing to generate and attach the sanction memo to the emailed request will deem the referral invalid. TANF procedures, however, include processing sanction requests with or without an attached sanction memo. Federal guidance requires the Office of the State Auditor (OSA) to develop audit procedures in order to test a sample of individual sanction requests referred to TANF by DSER. For this reason, OSA requested a list of all fiscal year 2024 sanction requests referred to TANF by DSER. In response, DSER provided a report of all sanction memos initiated in the CSEME system with dates of noncooperation during fiscal year 2024; however, this report does not represent an accurate and complete population for audit testing, as the referral action occurs subsequent to the initiation of a sanction memo and outside of the CSEME system, through email. Additional documentation representative of a complete population could not be provided, as TANF does not have policies and procedures in place to ensure that documentation of all individual sanction requests referred to TANF by DSER is properly maintained. As a result, OSA is unable to test to ensure OFI is in compliance with child support sanction requirements. Context: DSER provided a report of 469 sanction memos initiated for fiscal year 2024. The number of sanction requests that were made but omitted from the DSER list is unknown. Cause: • Lack of adequate policies and procedures • Lack of supervisory oversight Effect: • Noncompliant clients may be paid benefits that they are not entitled to receive. • Failure to maintain appropriate documentation to demonstrate compliance with Federal program sanction requirements may result in the U.S. Department of Health and Human Services penalizing the State up to five percent of the grant award. Recommendation: We recommend that OFI establish procedures to ensure all child support sanction requests can be provided so that audit procedures can be performed in accordance with Federal regulations. We further recommend that OFI increase oversight to ensure compliance with Federal requirements. Corrective Action Plan: See F-23 Management’s Response: The Department disagrees with this finding. The audit objective identified in the Compliance Supplement is to “Determine whether, after notification by the state Title IV-D agency, the TANF agency has taken necessary action to reduce or deny TANF assistance.” One of the two suggested audit procedures is to “Test a sample of cases referred by the Title IV-D agency to the TANF agency to ascertain if benefits were reduced or denied as required.” The Department spent a lot of time and effort attempting to validate for OSA that it had a testable population, and the Department believes that the Office of State Auditor can perform this procedure either with the DSER-provided report of referrals or with that report in conjunction with the additional material (including active sanction activity within the fiscal year as provided by OFI) the Department has pulled and analyzed for OSA. In the absence of that review nothing in the Department’s records, data, or discussions with OSA could reasonably be interpreted to suggest a “significant deficiency” in its Internal Controls over this aspect of the TANF program. There has not been any evidence that referrals made from DSER to OFI are getting lost, ignored, or misapplied. Contact: Ian Yaffe, Director, Office for Family Independence, DHHS, 207-592-1481 Auditor’s Concluding Remarks: The Department is required to establish and maintain effective internal control over Federal awards. The significant deficiency identified within the Condition is not the result of disagreements over the interpretation of Federal regulations or related audit objectives and testing procedures, it is related to internal control. A significant deficiency in internal control over compliance exists when the design or operation of a control does not allow management or employees, in the normal course of performing their assigned functions, to prevent, or detect and correct, noncompliance with requirements of a Federal program on a timely basis. The Department does not have adequate controls in place in order to provide a complete and accurate report of sanction requests referred to TANF by DSER. This report should not only be available for audit testing purposes, but also as documentation to monitor and attest to the Department’s compliance with TANF program sanction requirements. OSA acknowledges that multiple information sources and reports were provided in response to audit requests; however, the suggestion that OSA can perform testing “with the DSER-provided report of referrals” is not valid, as it is a CSEME system report that shows what should have been referred, and not actual referrals. Furthermore, the suggestion that OSA can perform testing “with [the DSER-provided report] in conjunction with the additional material” would result in OSA violating auditor independence as defined in Government Auditing Standards, as auditors cannot create the population subject to testing. Evidenced by the inability to provide a complete and accurate report, the Department is not properly tracking referrals to ensure that they are not “lost, ignored, or misapplied,” and therefore, is not properly overseeing compliance with 45 CFR 264.30. As a result, OSA cannot test that the Department is in compliance with the requirement to sanction individuals not cooperating with child support enforcement. The finding remains as stated. (State Number: 24-1111-01)

(2024-055) Title: Internal control over TANF program subrecipient cash management needs improvement Prior Year Findings: See schedule of Findings and Questioned costs for chart/table State Department: Health and Human Services State Bureau: Division of Contract Management Office for Family Independence Federal Agency: U.S. Department of Health and Human Services Assistance Listing Title: Temporary Assistance for Needy Families (TANF) Assistance Listing Number: 93.558 Federal Award Identification Number: See E-77 to E-78 Compliance Area: Cash management Subrecipient monitoring Type of Finding: Significant deficiency Questioned Costs: None Criteria: 2 CFR 200.303; 2 CFR 200.305; 2 CFR 200.332 The Department must establish and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. The Department is required to monitor cash drawdowns by their subrecipients to ensure that the time elapsing between the payment of Federal funds to the subrecipient and the subrecipient’s actual disbursement for program purposes is minimized. The Department must monitor the activities of the subrecipient as necessary to ensure that subawards are used for authorized purposes and in compliance with Federal statutes, regulations, and the terms and conditions of the subaward. Condition: The Department’s Division of Contract Management (DCM) has three methods for providing payments to subrecipients: cost-settled, cost-settled by invoice, and fee-for-service subawards. • For cost-settled subawards, DCM procedures include making equal advance monthly payments and then reconciling those amounts to the quarterly financial reports submitted by the subrecipient. This procedure does not take into consideration the time elapsing between the payment of Federal funds to the subrecipient and the subrecipient’s actual disbursement for program purposes. • For “cost-settled by invoice” (reimbursement) subawards, DCM procedures do not require subrecipients to include supporting documentation with monthly requests for reimbursement nor do they request supporting documentation at a subsequent date. This procedure does not take into consideration the time elapsing between the payment of Federal funds to the subrecipient and the subrecipient’s actual disbursement for program purposes. • Cash management requirements are not applicable for fee-for-service subawards. The Office for Family Independence (OFI) is responsible for ensuring the Temporary Assistance for Needy Families (TANF) program’s subrecipients comply with Federal requirements; however, OFI’s subrecipient monitoring procedures do not include review of subrecipient compliance with cash management requirements. The TANF program’s subawards are cost-settled, cost-settled by invoice, or fee-for-service. Therefore, DCM and OFI procedures do not support that subrecipient cash management is properly monitored as required by Federal regulations. Additionally, OFI’s monitoring procedures do not include review of subrecipient invoices to ensure TANF grant funds are used for allowable purposes. Context: In fiscal year 2024, the Department provided $34.2 million to subrecipients from TANF grant funds totaling $92.4 million. Cause: • Lack of adequate subrecipient monitoring procedures • Lack of centralized oversight of subrecipient monitoring Effect: • Noncompliance with Federal regulations • Federal programs may not be effectively and efficiently administered. • The Federal government may require the implementation of more stringent subrecipient cash management procedures. Recommendation: We recommend that OFI: • collaborate with DCM to implement monitoring procedures over subrecipient cash management requirements to ensure that the time elapsing between the payment of Federal funds to the subrecipient and the subrecipient’s actual disbursement for program purposes is minimized for the TANF program. • implement monitoring procedures over TANF program subrecipients to ensure that grant funds are used for allowable purposes. Corrective Action Plan: See F-23 Management’s Response: The Department disagrees with this finding. The Department is in compliance with the requirement for minimizing the time between payments to our subrecipients and the disbursement of the funds. Payments are made as close as administratively feasible. The Compliance Supplement suggested audit procedures for Cash Management for pass-through entities refers to 200.305(b)(1)...that same paragraph states that the timing and amount of advance payments must be as close as is administratively feasible. Contact: Anthony Madden, Deputy Director, Division of Audit, DHHS, 207-287-2834 Auditor’s Concluding Remarks: The Department’s interpretation of the applicable Federal regulation selectively emphasizes a single sentence from the broader paragraph, omitting critical context that informs the regulation’s full intent. According to the 2024 Compliance Supplement, pass-through entities must monitor cash drawdowns by their subrecipients to ensure that the time elapsing between the transfer of Federal funds to the subrecipient and their disbursement for program purposes is minimized as required by the applicable cash management requirements in the Federal award to the recipient (2 CFR section 200.305(b)(1)). 2 CFR section 200.305(b)(1) states that the recipient or subrecipient must be paid in advance, provided it maintains or demonstrates the willingness to maintain both written procedures that minimize the time elapsing between the transfer of funds and disbursement by the recipient or subrecipient, and financial management systems that meet the standards for fund control and accountability as established in this part. Advance payments to a recipient or subrecipient must be limited to the minimum amounts needed and be timed with actual, immediate cash requirements of the recipient or subrecipient in carrying out the purpose of the approved program or project. The timing and amount of advance payments must be as close as is administratively feasible to the actual disbursements by the recipient or subrecipient for direct program or project costs and the proportionate share of any allowable indirect costs. The recipient or subrecipient must make timely payments to contractors in accordance with the contract provisions. The Department references the phrase “as close as is administratively feasible” to justify their current process; however, this phrase is part of a broader requirement that establishes specific conditions for advance payments. The regulation requires that the timing between when the subrecipient receives Federal funds from the State and when the subrecipient disburses those funds is closely monitored to ensure that disbursements align with actual, immediate cash needs. A full reading of the provision indicates that “administratively feasible” does not negate the obligation to implement effective controls that minimize this gap, nor does it permit delays or inadequate oversight in Federal cash management. The Department could not provide evidence to demonstrate that they adequately monitored subrecipient cash drawdowns to ensure alignment with actual, immediate cash needs. Additionally, the Department does not require subrecipients to submit invoice documentation to substantiate the timing, amount, or nature of expenditures included in the request of Federal funds. As a result, the Department cannot demonstrate an adequate level of monitoring, as there is no evidence that they collect the necessary information to ensure compliance with Federal cash management requirements. Furthermore, the Department did not comment on the lack of monitoring procedures over subrecipient invoices to ensure Federal grant funds are used for allowable purposes. The finding remains as stated. (State Number: 24-1111-04)

(2024-056) Title: Internal control over TANF subrecipient risk evaluation procedures needs improvement Prior Year Findings: See schedule of Findings and Questioned costs for chart/table State Department: Health and Human Services State Bureau: Office for Family Independence Division of Contract Management Federal Agency: U.S. Department of Health and Human Services Assistance Listing Title: Temporary Assistance for Needy Families (TANF) Assistance Listing Number: 93.558 Federal Award Identification Number: See E-77 to E-78 Compliance Area: Subrecipient monitoring Type of Finding: Significant deficiency Questioned Costs: None Criteria: 2 CFR 200.303; 2 CFR 200.332 The Department must establish and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. The Department is required to evaluate each subrecipient’s risk of noncompliance with Federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate subrecipient monitoring described in 2 CFR 200.332. Condition: The Department determines subrecipient monitoring procedures based on the justification for the selection of the subrecipient and the services provided. If a subaward is competitively bid, the Department’s Division of Contract Management’s (DCM) Competitive Procurement Unit seeks input from the Department of Health and Human Services’ Service Center, the Department’s Division of Audit, and DCM’s Contracts Unit regarding known issues with the provider who submitted the bid. Those responses are collected and provided to the evaluation team, which consists of various program personnel. However, for both competitively bid and non-competitively bid subawards, the level of subrecipient monitoring that the Department performs is based on the services provided and not based on the specific subrecipient. The Office of the State Auditor (OSA) selected six TANF subrecipients, which included 11 subawards that were competitively bid and eight subawards that were not competitively bid and found that for: • seven competitively bid subawards, DCM provided evidence to support that feedback was solicited from other Bureaus for any known issues or prior noncompliance; however, evidence could not be provided to support the level of subrecipient monitoring that was performed based on a risk evaluation. • four competitively bid subawards, DCM could not provide evidence to support that feedback was solicited from other Bureaus for any known issues or prior noncompliance. In addition, evidence could not be provided to support the level of subrecipient monitoring that was performed based on a risk evaluation. • eight non-competitively bid subawards, evidence could not be provided to support the level of subrecipient monitoring that was performed based on a risk evaluation. OSA selected a non-statistical random sample. Context: The Department provided $34.2 million from a total of $92.4 million to TANF subrecipients during fiscal year 2024. Cause: • Lack of policies and procedures • Lack of supervisory oversight Effect: • Noncompliance with Federal regulations • Subrecipients that are deemed higher risk may not be monitored on a more frequent basis. Conversely, subrecipients that are deemed lower risk may not be monitored on a less frequent basis, which would free resources and time to dedicate towards other higher risk subrecipients. Recommendation: We recommend that the Department implement policies and procedures that require evaluation of each subrecipient’s risk of noncompliance specifically for the purposes of determining the appropriate subrecipient monitoring to be performed. This will ensure subrecipients are monitored appropriately based on risk designation. Corrective Action Plan: See F-24 Management’s Response: The Department disagrees with this finding. The Department evaluates risk on its subrecipients for the purpose of determining the appropriate subrecipient monitoring in multiple ways. The first assessment of risk is when a subaward is competitively bid. The second assessment of risk is built into the Maine Uniform Accounting and Auditing Practices for Community Agencies (MAAP) in which higher risk subrecipients undergo a higher level of testing by Independent Public Accountants. Finally, the Social Service Unit of the Division of Audit performs a risk assessment and tests transactions for those subrecipients that have been determined to be higher risk. Contact: Jim Lopatosky, Director, Division of Contract Management, DHHS, 207-287-5075 Auditor’s Concluding Remarks: 2 CFR 200.332(b) states that the Department must evaluate each subrecipient’s risk of noncompliance with Federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate subrecipient monitoring. The Department has indicated in Management’s Response that the criteria set forth in 2 CFR 200.332(b) have been met; however, the following rebuttals illustrate that the Department’s assessments are inconsistent with Federal regulation requirements: • The Department identifies the first assessment of risk: when a subaward is competitively bid. o While OSA acknowledges this does occur, not all subawards are competitively bid. As stated in the Condition, for both competitively bid and non-competitively bid subawards, the level of subrecipient monitoring that the Department performs is based on the services provided, rather than on an evaluation of risk assessed for specific subrecipients. • The Department identifies the second assessment of risk: built into MAAP in which higher risk subrecipients undergo a higher level of testing by independent public accountants. o The Department did not provide documentation to support that the level of subrecipient monitoring performed correlates to MAAP; and o A subrecipient deemed higher risk as the result of a risk evaluation in accordance with 2 CFR 200.332 may not be deemed higher risk in accordance with MAAP standards. • The Department identifies the third assessment of risk: the Social Service Unit of the Division of Audit performs a risk assessment and tests transactions for those subrecipients that have been determined to be higher risk. o The Department did not provide documentation to demonstrate that these procedures are performed as a result of a risk evaluation. The Department’s existing policies and procedures do not require nor provide support for the evaluation of each subrecipient’s risk of noncompliance specifically for the purpose of determining the appropriate subrecipient monitoring to be performed. The finding remains as stated. (State Number: 24-1111-07)

(2024-057) Title: Internal control over TANF performance reporting procedures needs improvement Prior Year Findings: See schedule of Findings and Questioned costs for chart/table State Department: Health and Human Services State Bureau: Office for Family Independence Federal Agency: U. S. Department of Health and Human Services Assistance Listing Title: Temporary Assistance for Needy Families (TANF) Assistance Listing Number: 93.558 Federal Award Identification Number: See E-77 to E-78 Compliance Area: Reporting Type of Finding: Significant deficiency Questioned Costs: None Criteria: 2 CFR 200.303; 45 CFR 261.60 through .62; 45 CFR 265.7 and .8 The Department must establish and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. The Department must maintain adequate documentation, perform adequate verification, and implement other control procedures for Temporary Assistance for Needy Families (TANF) client work participation. Work participation activities include unsubsidized employment, job search and job readiness, job skills training directly related to employment, vocational education, and other work-related programs. The Department must report the actual hours that a work-eligible TANF client participates in these work-related activities, on the ACF-199 TANF Data Report and ACF-209 SSP-MOE Data Report on a quarterly basis. These reports are required by the Federal government. Condition: The Department must maintain adequate documentation, verification, and internal control procedures to ensure the accuracy of information reported to the Federal government and used to calculate work participation rates. The Department utilizes a vendor for case management services and development of individualized training and employment plans for Additional Support for People in Retraining and Employment (ASPIRE) clients. These services directly impact and enforce client work participation requirements. Vendor data is exchanged with the Department on a monthly basis and is utilized in conjunction with client data in the Automated Client Eligibility System (ACES) to comprise client work participation data that is reported on the ACF-199 and ACF-209 reports to the Federal government. The Department reported incorrect work participation information on the ACF-199 and ACF-209 reports. Of the 60 clients tested, 24 inaccurate work participation data elements were reported for 19 clients, including inaccurate: • countable months towards the Federal time limit of 60 months for nine cases; • work participation status for three cases; • unsubsidized employment and vocational education training hours for nine cases; • Federal time limit provision status for one case; • family affiliation status for one case; and • work eligible individual indicator for one case. The Office of the State Auditor selected a non-statistical random sample. Context: In fiscal year 2024, the number of families reported on the ACF-199 report ranged from 10,000 to 11,000 per quarter, and the number of clients reported on the ACF-209 report ranged from 29,000 to 31,000 per quarter. Cause: • Lack of adequate procedures to ensure accurate reporting • Lack of supervisory oversight Effect: Incorrect work participation data reported to the Federal government may affect the Federal requirement for TANF’s State Maintenance of Effort. Recommendation: We recommend that the Department enhance existing procedures to ensure that the information reported on the ACF-199 and ACF-209 reports is accurate and complete prior to submission to the Federal government. Corrective Action Plan: See F-24 Management’s Response: The Department agrees with and acknowledges both the Condition Statement and Recommendation sections contained in this finding. The Department has developed and will implement a corrective action plan to address the Condition. Contact: Ian Yaffe, Director, Office for Family Independence, DHHS, 207-592-1481 (State Number: 24-1111-03)

(2024-058) Title: Internal control over TANF work verification plan procedures needs improvement Prior Year Findings: See schedule of Findings and Questioned costs for chart/table State Department: Health and Human Services State Bureau: Office for Family Independence Federal Agency: U.S. Department of Health and Human Services Assistance Listing Title: Temporary Assistance for Needy Families (TANF) Assistance Listing Number: 93.558 Federal Award Identification Number: See E-77 to E-78 Compliance Area: Special tests and provisions Type of Finding: Significant deficiency Questioned Costs: None Criteria: 2 CFR 200.303; 45 CFR 261.60 through .65; Work Verification Plan for the State of Maine The Department must establish and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. The Department must maintain adequate documentation, perform adequate verification, and implement other control procedures for Temporary Assistance for Needy Families (TANF) client work participation. Work participation activities include unsubsidized employment, job search and job readiness, job skills training directly related to employment, vocational education, and other work-related programs. The Work Verification Plan for the State of Maine requires Additional Support for People in Retraining and Employment (ASPIRE) supervisors to review a minimum of five random cases per regional office per month. ASPIRE Case Review Tool (ACRT) reviews are intended to validate all case data to include (but not limited to) work assessment, appropriateness of the individual work plan, work verification data consistency, documentation and work plan outcomes. Accuracy of all aspects of the individual cases is assessed as part of these reviews, including participation activity/hours documentation. Condition: The ASPIRE program helps TANF recipients move towards financial independence through case management, job training, education, support, and employment services. The Department contracts with a subrecipient service provider to perform outreach and case management services for the ASPIRE program. ASPIRE supervisors perform ACRT reviews of client case activity recorded by its subrecipient service provider to ensure that all case data including, but not limited to, work participation rate data is documented, verified, and reported in accordance with work verification plan requirements. The Office of the State Auditor (OSA) tested 60 ACRT reviews performed during fiscal year 2024 and found: • two reviews did not indicate the date that the review was performed; and • seven reviews did not document that follow up occurred for identified actions required by the subrecipient service provider, or dates that actions were taken and reported. OSA selected a non-statistical random sample. Additionally, a component of work verification plan requirements states that work participation data is required to be accurately reported on the ACF-199 TANF Data Report and ACF-209 SSP-MOE Data Report to the Federal government. OSA identified a significant deficiency as issued in finding 2024-057 for inaccurate work participation data reported on the ACF-199 and ACF-209 reports. Therefore, since work participation rate data was not documented, verified, or reported in accordance with the State’s work verification plan, the Department is not in compliance with Federal work verification plan requirements. Context: The Department must maintain adequate documentation, verification, and internal control procedures to ensure the accuracy of information reported to the Federal government and used to calculate work participation rates. Cause: • Lack of adequate procedures to ensure that ACRT reviews are accurate and complete and work verification plan requirements are met • Lack of supervisory oversight Effect: The Federal government may penalize the State by an amount not less than one percent and not more than five percent of the grant award for violation of work verification plan requirements. Recommendation: We recommend that the Department enhance existing procedures and oversight to ensure that work verification plan requirements are met. This should include confirming that ACRT reviews are accurate and complete which will ensure the reliability of client data used to calculate work participation rates and reported to the Federal government. Corrective Action Plan: See F-24 Management’s Response: The Department agrees with this finding. The Department acknowledges the exceptions found as a result of the non-statistical random sample correctly identified improperly completed reviews: two reviews did not indicate the date that the review was performed; and seven reviews did not document that follow up occurred for identified actions required by the subrecipient service provider, or dates that actions were taken and reported. The Department has developed a Corrective Action Plan to mitigate the risk of such errors from recurring. Contact: Ian Yaffe, Director, Office for Family Independence, DHHS, 207-592-1481 (State Number: 24-1111-06)

(2024-059) Title: Internal control over CCDF financial reporting needs improvement Prior Year Findings: None State Department: Health and Human Services Administrative and Financial Services State Bureau: Office of Child and Family Services Health and Human Services Service Center Federal Agency: U.S. Department of Health and Human Services Assistance Listing Title: CCDF Cluster (COVID-19) Assistance Listing Number: 93.489, 93.575, 93.596 Federal Award Identification Number: See E-77 to E-78 Compliance Area: Matching, level of effort, earmarking Reporting Type of Finding: Material weakness Material noncompliance Questioned costs Known Questioned Costs: ALN 93.575 $3.7 million Likely Questioned Costs: ALN 93.575 $3.7 million Criteria: 2 CFR 200.303; 45 CFR 98.50 and .65; OMB-0970-0510 ACF-696 Report Instructions The Department must establish and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. The Department shall submit financial reports to the Administration for Children & Families (ACF) quarterly for each fiscal year until funds are expended. At a minimum, a State’s quarterly report shall include the following information on expenditures under Child Care and Development Fund (CCDF) grant funds: • Childcare administration; • Quality activities, including any sub-categories of quality activities as required by ACF; • Direct services for both grant or contracted slots and certificates; • Non-direct services, including establishment and maintenance of computerized childcare information systems; certificate program cost/eligibility determination; all other non-direct services; and • Such other information as specified. Pursuant to CCDF regulations at 45 CFR 98.65(g), and as part of the terms and conditions of the grant award, states and territories are required to complete and submit a quarterly financial status report (ACF-696). The direct services category consists solely of expenditures for childcare subsidies to eligible children. The costs of eligibility determination and re-determination are considered a non-direct service activity and should be reported separately. Non-direct services are the costs of providing childcare subsidies or other activities not considered administrative costs. From discretionary amounts provided for a fiscal year, the Department must spend at a minimum 70 percent for direct services after reserving the minimum amount required for quality activities and for administrative costs. Condition: The CCDF program is administered by the Office of Child and Family Services (OCFS) and provides funding to increase the availability, affordability, and quality of childcare services in the State. The program had four ongoing Federal grant award years during fiscal year 2024, for grant years 2021, 2022, 2023, and 2024. For each grant award: • quarterly CCDF ACF-696 financial status reports are required, and • applicable earmarking requirements for direct childcare subsidies, quality activities, and administrative costs must be met. The Department of Health and Human Services’ Service Center (DHHS SC) prepares and submits quarterly ACF-696 reports on behalf of OCFS. DHHS SC utilizes a spreadsheet designed by OCFS to track and summarize expenditure information and related earmarking requirements, and to prepare the ACF-696 reports. DHHS SC also monitors CCDF program earmarking requirements as part of this quarterly reporting process. The Office of the State Auditor (OSA) reviewed three quarterly ACF-696 reports and found that: • in all reports reviewed, the amount reported as direct expenditures included amounts that were not for childcare subsidies. Reported direct expenditures erroneously included non-direct costs related to the establishment of a new computerized childcare information system, costs of eligibility determinations, and costs associated with error rate reporting requirements. • the State did not report any non-direct expenditures during fiscal year 2024. The spreadsheet utilized by DHHS SC during the reporting process did not include detailed expenditure information in order to separately report direct and non-direct expenditures. In addition, although administrative and quality earmarking requirements were tracked on DHHS SC’s spreadsheet and during the reporting process, the direct childcare subsidy earmarking requirement was not tracked. Because expenditures were not accurately tracked and therefore reported inaccurately on the ACF-696 reports, calculations of the administrative and direct spending limits were also not accurate. As a result, the requirement that a minimum of 70 percent of expenditures be used for direct childcare subsidies, after administrative and quality earmarking requirements, was not met for the grant year 2021 and 2022 expenditures, as follows: • For grant year 2021, the Department was required to spend a minimum of $13.4 million in direct childcare expenditures, and thus a maximum of $5.8 million in all other expenditures after administrative and quality earmarking requirements; however, the Department only spent $11.9 million in direct childcare expenditures. Since grant year 2021 funds were fully expended, the direct childcare earmarking requirement was not met by $1.5 million, and all other expenditures were overspent by $1.5 million. Therefore, OSA is reporting $1.5 million in questioned costs. • For grant year 2022, the Department was required to spend a minimum of $9.7 million in direct childcare expenditures, and thus a maximum of $4.2 million in all other expenditures after administrative and quality earmarking requirements; however, the Department only spent $7.5 million. Since grant year 2022 funds were fully expended, the direct childcare earmarking requirement was not met by $2.2 million, and all other expenditures were overspent by $2.2 million. Therefore, OSA is reporting $2.2 million in questioned costs. As a result, OSA is reporting a total of $3.7 million in questioned costs, representative of the direct childcare earmarking discrepancies and resulting amount of all other costs overspent for the 2021 and 2022 grant years. Context: CCDF expenditures reported for: • grant year 2021 totaled $186.5 million, of which $19.2 million was subject to the 70 percent direct childcare spending requirement of $13.4 million. • grant year 2022 totaled $30.9 million, of which $13.9 million was subject to the 70 percent direct childcare spending requirement of $9.7 million. Cause: • Lack of adequate procedures • Lack of supervisory oversight Effect: • Known questioned costs • Potential future questioned costs and disallowances • Noncompliance with Federal regulations for reporting and earmarking Recommendation: We recommend that the Departments enhance existing procedures, including corrections to expenditure tracking processes, and increase supervisory oversight to ensure that all the information reported on quarterly ACF-696 reports is accurate and complete prior to submission to the Federal government. This will also ensure that CCDF earmarking requirements are met. Corrective Action Plan: See F-24 Management’s Response: The Department partially agrees with this finding. The Department and the DHHS Financial Service Center agrees that it could enhance its policies and procedures. The Department disagrees with the questioned costs. The DHHS Financial Service Center will enhance policies and procedures for the CCDF grant by modifying the FSR Reviewer Checklist and add an additional layer of FSR reviewer by April 30, 2025. The DHHS Financial Service Center will collaborate with OCFS to make reporting line determinations by September 1, 2025. Contact: Sarah Gove, Director, DHHS Service Center, DAFS, 207-458-6626 Auditor’s Concluding Remarks: The Department agrees to the internal control deficiencies and to the noncompliance with Federal reporting and earmarking requirements identified in the Condition, yet does not agree to the resulting questioned costs. Furthermore, the Department does not provide a basis for this disagreement. The total of $3.7 million in questioned costs is representative of the direct childcare earmarking discrepancies and resulting amount of all other costs overspent for the 2021 and 2022 grant years. The overspending on all other costs is deemed unallowable in accordance with the terms of the grant awards, as the funds were required to be spent on direct childcare. The finding remains as stated. (State Number: 24-1114-01)

(2024-060) Title: Internal control over CCDF provider health and safety requirements needs improvement Prior Year Findings: See schedule of Findings and Questioned costs for chart/table State Department: Health and Human Services State Bureau: Office of Child and Family Services Federal Agency: U.S. Department of Health and Human Services Assistance Listing Title: CCDF Cluster (COVID-19) Assistance Listing Number: 93.489, 93.575, 93.596 Federal Award Identification Number: See E-77 to E-78 Compliance Area: Special test and provisions Type of Finding: Significant deficiency Questioned Costs: None Criteria: 2 CFR 200.303; 45 CFR 98.33, .41, .42, and .68 The Department must establish and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. The Department is required to disseminate to the general public, through a consumer-friendly and easily accessible website, results of monitoring and inspection reports for all eligible and licensed childcare providers. Full monitoring and inspection reports must be posted timely. The Department is required to design, implement, and enforce health and safety requirements for the protection of children. Unannounced inspections of childcare providers and facilities, performed by licensing inspectors, are required not less than annually to ensure compliance with all childcare licensing and health and safety standards. In the Child Care and Development Fund (CCDF) State Plan, the Department is required to describe effective internal controls that are in place to ensure program integrity and accountability while maintaining continuity of services. Condition: The CCDF program is administered by the Office of Child and Family Services (OCFS) and provides funding to increase the availability, affordability, and quality of childcare services in the State. OCFS completes annual childcare provider site visits or licensing inspections for providers receiving subsidies from the CCDF program. During site visits and licensing inspections, OCFS personnel review Federal program health and safety requirements using a provider compliance checklist. Any deficiencies are noted, corrective action by the provider is required, and the frequency of site visits or licensing inspections is increased until remediation of noted deficiencies is complete. The Office of the State Auditor (OSA) tested 40 providers subject to health and safety site visits or licensing inspections and identified: • two provider facilities’ annual unannounced site visits did not occur within 12 months as required, and were one month and two months late. • two provider facility inspections were noted in the provider file as complete; however, documentation of completed inspection reports was not maintained in the provider file or posted publicly. OSA selected a non-statistical random sample. Context: The Department provided approximately $29 million to CCDF program childcare providers in fiscal year 2024. Cause: • Lack of resources • Lack of supervisory oversight Effect: • Noncompliance with Federal regulations • Providers not meeting CCDF program regulations for health and safety may go undetected. Recommendation: We recommend that OCFS enhance oversight to ensure that required annual childcare provider site visits and licensing inspections, and any resulting corrective action, are documented, monitored, and completed. Corrective Action Plan: See F-25 Management’s Response: The Department agrees with this finding. The Department acknowledges that two facilities annual unannounced inspections did not occur within 12 months. This was related to an unplanned staff resignation and an emergency staff leave of absence. The CLIS management team diligently and conscientiously tracks workloads, engages in regular supervision, team meetings, and has developed tracking systems outside of the antiquated data management system (Macwis) to ensure expectations are met. The Department also agrees with the finding that two facility inspections were not filed properly and were therefore not posted publicly. One staff person was covering two large geographic areas as she transitioned territory and OCFS hired/ trained a new employee. The current process of using paper inspection sheets that are sent to central office for review, scanning, and upload to the consumer education website is cumbersome and presents an opportunity for error. Contact: Janet Whitten, Manager - Children’s Licensing & Investigation, OCFS, DHHS, 207-441-2259 (State Number: 24-1114-02)

(2024-061) Title: Internal control over CCDF period of performance needs improvement Prior Year Findings: None State Department: Health and Human Services Administrative and Financial Services State Bureau: Office of Child and Family Services Health and Human Services Service Center Federal Agency: U.S. Department of Health and Human Services Assistance Listing Title: CCDF Cluster (COVID-19) Assistance Listing Number: 93.489, 93.575, 93.596 Federal Award Identification Number: See E-77 to E-78 Compliance Area: Allowable costs/cost principles Period of performance Type of Finding: Significant deficiency Questioned Costs: None Criteria: 2 CFR 200.303; 2 CFR 200.403; 45 CFR 98.60; American Rescue Plan (ARP) Act, Section 2201(a) The Department must establish and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. To be allowable under Federal awards, costs must be necessary and reasonable for the performance of the Federal award and be adequately documented. Child Care and Development Fund (CCDF) Discretionary liquidation period regulations require the Department to liquidate grant funds within one year of the required obligation date. Section 2201(a) of the ARP Act requires CCDF Discretionary supplemental funds to be obligated in Federal fiscal year 2021 or the succeeding two fiscal years. The Department must obligate supplemental funds by September 30, 2023. Condition: The CCDF program is administered by the Office of Child and Family Services (OCFS) and provides funding to increase the availability, affordability, and quality of childcare services in the State. OCFS utilizes the Department of Health and Human Services’ (DHHS) Service Center to collaboratively process CCDF expenditures, which includes dual review and approval of program grant coding and periods of performance. The Departments are required to ensure expenditures are obligated and liquidated within the required timeframes for each grant. The Office of the State Auditor (OSA) identified 11 significant CCDF expenditure transactions for grants that had obligation and liquidation periods ending during fiscal year 2024. OSA found four payroll transactions charged to CCDF ARP Discretionary supplemental funds totaling $5,321, for payroll costs incurred, and thus obligated, subsequent to the required obligation date; therefore, the costs are deemed unallowable. OSA tested 37 CCDF expenditure adjustments in fiscal year 2024 and found two adjustments totaling $2,952, charged to CCDF ARP Discretionary supplemental funds during the liquidation period that represented expenditures incurred subsequent to the required obligation date; therefore, the costs are deemed unallowable. OSA selected a non-statistical random sample. OSA performed analytical procedures over all fiscal year 2024 expenditure adjustments and found 14 additional adjustments totaling $4,492, all allocated to CCDF ARP Discretionary supplemental funds, for expenditures that were incurred subsequent to the required obligation date; therefore, the costs are deemed unallowable. OCFS’ and DHHS Service Center’s existing review and approval procedures are not adequate, as unallowable costs totaling $12,765 for expenditures outside of the required period of performance were charged to CCDF ARP Discretionary supplemental funds. Context: In fiscal year 2024, the Department expended approximately $52 million in CCDF program funds. Approximately $6 million of total CCDF program expenditures were CCDF ARP Discretionary supplemental funds with a required obligation date of September 30, 2023. Cause: • Lack of adequate policies and procedures • Lack of supervisory oversight Effect: • Potential questioned costs and disallowances • Noncompliance with Federal regulations Recommendation: We recommend that the Departments enhance policies and procedures and increase supervisory oversight to ensure that obligations of grant funds are made within period of performance requirements established in the terms and conditions of Federal grant awards. Corrective Action Plan: See F-25 Management’s Response: The Department and the DHHS Financial Service Center agree with this finding. The DHHS Financial Service Center will enhance policies and procedures for the CCDF grant by modifying the FSR Reviewer Checklist by April 30, 2025. Contact: Sarah Gove, Director, DHHS Service Center, DAFS, 207-458-6626 (State Number: 24-1114-03)

(2024-062) Confidential finding, see below for more information Title: ________ over ________ and ________ needs improvement Pursuant to paragraph 6.63 of the U.S. Government Accountability Office’s Government Auditing Standards (also known as the Yellow Book), we omitted details from this finding as they are confidential under the provisions of 5 MRSA 244-C (3). Though the content of this finding has been redacted, we provided the Department(s) with detailed information regarding the specific condition we identified, as well as the related criteria, context, causes, effects, and our specific recommendations for improvement. Prior Year Findings: See schedule of Findings and Questioned costs for chart/table Type of Finding: Significant deficiency Corrective Action Plan: See F-25 Contact: Shirley Browne, Deputy State Controller, Office of the State Controller, 207-626-8423 (State Number: 24-0906-02)

(2024-063) Title: Internal control over the Foster Care – Title IV-E and Adoption Assistance – Title IV-E eligibility and benefit determination process needs improvement Prior Year Findings: See schedule of Findings and Questioned costs for chart/table State Department: Health and Human Services State Bureau: Office of Child and Family Services Federal Agency: U.S. Department of Health and Human Services Assistance Listing Title: Foster Care – Title IV-E (COVID-19) Adoption Assistance – Title IV-E (COVID-19) Assistance Listing Number: 93.658; 93.659 Federal Award Identification Number: See E-77 to E-78 Compliance Area: Allowable costs/cost principles Eligibility Type of Finding: Material weakness Material noncompliance Questioned costs Known Questioned Costs: ALN 93.658 $4,647 ALN 93.659 $9,367 Likely Questioned Costs: Undeterminable; the Office of the State Auditor (OSA) selected a sample of clients who received Title IV-E benefits during the fiscal year and identified known questioned costs associated with seven clients based on various eligibility attributes. Since each exception is unique to the client, a projection of questioned costs cannot be reasonably estimated. Criteria: 2 CFR 200.303; 2 CFR 200.403; 45 CFR 1356.21 and .40; 42 USC 671 The Department must establish and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. To be allowable under Federal awards, costs must be necessary and reasonable for the performance of the Federal award and be adequately documented. 45 CFR 1356.21 outlines eligibility criteria which, if met, allows the State to pay foster care maintenance payments on behalf of eligible children, in accordance with the Title IV-E agency’s foster care maintenance payment rate schedule, to individuals serving as foster family homes, to childcare institutions, or to public or private child-placement or childcare agencies. 45 CFR 1356.40 outlines eligibility criteria which, if met, allows the State to pay a portion of the Federal Adoption Assistance maintenance payments and claim Federal financial participation for the payment. 42 USC 671 requires that prospective foster parents and any other adult living in the home who has resided in the provider home in the preceding five years satisfactorily meet a child abuse and neglect registry check. The requirement applies to foster care maintenance payments made on behalf of the foster child. Condition: The Office of Child and Family Services (OCFS) administers the Foster Care – Title IV-E (Foster Care) and Adoption Assistance – Title IV-E (Adoption Assistance) programs for the State, outlined below: • The Foster Care program is designed to help states provide safe and stable out-of-home care for children under its jurisdiction until the children are returned home safely, placed with adoptive families, or placed in other planned arrangements for permanency. • The Adoption Assistance program provides Federal funds to states to facilitate the timely placement of children, whose special needs or circumstances would otherwise make them difficult to place, with adoptive families. Funds are available for a one-time payment to assist with the costs of adopting a child as well as for subsidies to adoptive families to assist with the care of the eligible child on an ongoing basis. A financial resources specialist (FRS) determines program eligibility and initiates benefits through completion of a determination checklist. The FRS reviews program eligibility factors, gathers required supporting documentation, and documents the certification decision on the checklist. The FRS enters the information into the child welfare information system for processing. Once the client is determined eligible in the child welfare information system, a level of benefits is assigned. OCFS relies on this information and the related system coding to ensure that benefits are accurately provided to eligible clients. OSA tested 60 client eligibility determinations and found: • three determination checklists did not include a certification decision; • three determination checklists were signed by a FRS who did not perform the eligibility determination; and • one determination checklist did not initially include a certification decision. The determination checklist was signed subsequent to OSA’s request for review by a FRS who did not perform the eligibility determination. Additionally, one client’s prospective foster parent did not satisfactorily meet a child abuse and neglect registry check in accordance with 42 USC 671. A second family was residing in the Resource Family Home (RFH), and child abuse and neglect registry checks were not completed or satisfactorily met for the additional adults. Additionally, the Home Study to evaluate the home and safety environment related to the RFH license for the family was completed without disclosing all individuals residing in the home. Upon further review, OSA determined two additional clients were in custody of the RFH and receiving Foster Care or Adoption Assistance benefits during fiscal year 2024. The RFH received $10,701 in benefits from both Federal programs on behalf of three clients, resulting in questioned costs of the entire amount. OSA tested 60 clients and 60 benefit payments and found: • one client received Foster Care childcare benefits after the date the client was adopted, resulting in questioned costs of $1,338. • one client received Foster Care benefit payments while in an unlicensed placement for one month, resulting in questioned costs of $783. • one client determined to be ineligible continued to receive Foster Care benefit payments during the fiscal year, resulting in questioned costs of $594. • one client changed placements during the fiscal year and two separate Foster Family Homes received benefit payments for the same time period on behalf of the client, resulting in questioned costs of $529. The Department recorded the overpayments in the child welfare information system but did not recoup the funds during the fiscal year. • one client received Foster Care benefit payments during the same time period that they received Adoption Assistance benefit payments, resulting in questioned costs of $69 to the RFH. • benefits for one client were paid with State funds and should have been paid with Federal funds for five months of the fiscal year. • one client’s eligibility record included an incorrect end date for benefits within the child welfare information system, resulting in the client being paid with State funds instead of claiming Federal funds for three months of the fiscal year. OSA selected non-statistical random samples. Context: In fiscal year 2024, the State provided approximately: • 900 Foster Care clients with $5.4 million in Federal benefits; and • 4,200 Adoption Assistance clients with $24.7 million in Federal benefits. Cause: • Lack of appropriate oversight over eligibility and benefit determinations • Lack of adequate policies and procedures and supervisory oversight of the child welfare information system. The system was implemented in fiscal year 2023 and policies and procedures were not designed to properly test system coding for all eligibility change circumstances that could occur. Effect: • Known questioned costs • Potential future questioned costs and disallowances • Benefits were provided to ineligible clients. • Noncompliance with Federal regulations Recommendation: We recommend that the Department: • enhance policies and procedures to ensure that eligibility determination checklists include certification decisions by the FRS completing the determination; • implement additional procedures to ensure that payments made on behalf of clients are accurate and allowable in accordance with program regulations; • establish recoupments for the overpayments identified; and • strengthen licensing practices for background screening of potential and current RFHs. Corrective Action Plan: See F-26 Management’s Response: The Department partially agrees with this finding. OCFS agrees with the finding in that the checklist was not appropriately signed at the time of completion. OCFS would like to note that the checklist is not part of any state or federal policy or requirement. It is our own internal process and was only added to our FRS manual as a plan of correction (POC) because of last year’s finding re: some checklists not being signed. When an FRS worker completes an Initial determination in the system, the determination is printed out for our files and the document includes a timestamp when it was completed as well as the FRS assigned. Due to this POC just being added last year, this would be expected to be an ongoing finding for the foreseeable future since we cannot retroactively sign the completed checklists in the past. OCFS agrees there is a need to formalize the overpayment collection process. We believe that there are both programmatic and technical solutions to be explored. OCFS will develop a workgroup of subject matter experts to explore and understand the challenges of managing overpayments and develop a solution for implementation over the next year. OCFS disagrees with the finding that OCFS needs to strengthen its licensing practices for background screening of Resource Families. The finding is based on additional occupants in the home that were not subject to background checks and were not listed in the renewal home study completed in 2023. The home study referenced above described the home and all occupants as presented by the family. The Community Care Worker completed a safety inspection/walk through of the home and found no evidence of additional occupants. OCFS conducts background checks on the adults in the home in accordance with policy and rules, at initial licensure as well as renewal of licensure every two years. OCFS does not conduct unannounced licensing visits and relies on resource families to report changes in family composition and occupancy. In the event there are not any children in the custody of the state in the home, OCFS would not have reason or cause to inspect who is residing in the home or conduct face-to-face visits with resource families. Because this specific finding does not describe a failure to adhere to policy and rules, no correction action plan will be identified. Contact: Robert Blanchard, Associate Director, OCFS, DHHS, 207-624-7955 Auditor’s Concluding Remarks: For the exceptions identified over the eligibility determination checklists, the use of the checklist was identified to OSA by the Department as the established control to ensure compliance over determinations of Title IV-E eligibility for all clients entering Foster Care. While there is no Federal requirement for a checklist, the Department is required to establish and maintain internal controls over Federal awards in accordance with 2 CFR 200.303. OSA performed testing over the Department’s established internal control. Regarding the need to strengthen its licensing practices for background screening of Resource Families, the child welfare information system listed the additional occupants residing in the home as early as 2020, including within several family investigations and reports of alleged abuse occurring in the home. While OSA recognizes that OCFS does not conduct unannounced licensing visits, the information surrounding resource families is obtainable through review of the child welfare information system. A cross-check of associated intakes, cases, family investigations, or reports of alleged abuse within the child welfare information system would have identified the second family residing in the home. The adults residing in the home did not satisfactorily meet a child abuse and neglect registry check in accordance with 42 USC 671, and the RFH remained licensed and continued to inappropriately receive Title IV-E benefits. Therefore, this finding does describe a failure to adhere to policy and rules, and a corrective action plan is necessary. The finding remains as stated. (State Number: 24-1109-01)

(2024-064) Title: Internal control over the Adoption Assistance – Title IV-E eligibility and benefit determination process needs improvement Prior Year Findings: See schedule of Findings and Questioned costs for chart/table State Department: Health and Human Services State Bureau: Office of Child and Family Services Federal Agency: U.S. Department of Health and Human Services Assistance Listing Title: Adoption Assistance – Title IV-E (COVID-19) Assistance Listing Number: 93.659 Federal Award Identification Number: See E-77 to E-78 Compliance Area: Allowable costs/cost principles Eligibility Type of Finding: Material weakness Material noncompliance Questioned costs Known Questioned Costs: ALN 93.659 $10,860 Likely Questioned Costs: Undeterminable; the Office of the State Auditor (OSA) selected a sample of clients who received Title IV-E benefits during fiscal year 2024 and identified known questioned costs for three clients based on review of Adoption Agreements signed in 2008, 2012, and 2016. Since each Adoption Agreement is unique to the client, a projection of questioned costs cannot be reasonably estimated. Criteria: 2 CFR 200.303; 2 CFR 200.403; 45 CFR 1356.40 The Department must establish and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. To be allowable under Federal awards, costs must be necessary and reasonable for the performance of the Federal award and be adequately documented. The State is allowed to pay a portion of the Federal Adoption Assistance maintenance payments and claim Federal financial participation for Title IV-E eligible clients. Condition: The Adoption Assistance – Title IV-E (Adoption Assistance) program provides Federal funds to states to facilitate the timely placement of children, whose special needs or circumstances would otherwise make them difficult to place, with adoptive families. Funds are available for a one-time payment to assist with the costs of adopting a child as well as for subsidies to adoptive families to assist with the care of the eligible child on an ongoing basis. The Office of Child and Family Services (OCFS) administers the Adoption Assistance program for the State. OCFS financial resource specialists (FRS) are responsible for determining program eligibility and initiating benefits. The FRS uses the Adoption Assistance Checklist to ensure that program eligibility factors, required supporting information, and final determination for Federal Adoption Assistance benefits are obtained and documented. Once the client is determined eligible in the child welfare information system, a daily rate is negotiated by OCFS and the adoptive parents at a rate that does not exceed what the client would qualify for under the Foster Care – Title IV-E program. OSA tested 60 client benefit payments and identified that: • one client received Social Security Administration benefits, and therefore, was not eligible for Adoption Assistance benefits. The client received a daily Adoption Assistance rate of $16.50, resulting in questioned costs of $6,023 during fiscal year 2024. • one client received a higher daily Adoption Assistance rate than what they qualified for under the Foster Care – Title IV-E program. The client received a $26.25 daily rate instead of $16.50, resulting in questioned costs of $3,559 during fiscal year 2024. • one client received a higher daily Adoption Assistance rate than what they qualified for under the Foster Care – Title IV-E program. The client received a $20 daily rate instead of $16.50, resulting in questioned costs of $1,278 during fiscal year 2024. OSA selected a non-statistical random sample. Context: In fiscal year 2024, the State provided approximately 4,200 Adoption Assistance clients with $24.7 million in Federal benefits. Cause: Lack of adequate policies and procedures over verification and accuracy of benefit determinations and associated Adoption Assistance payments Effect: • Known questioned costs • Potential future questioned costs and disallowances • Noncompliance with Federal regulations • Individuals not eligible for services could receive benefits. Recommendation: We recommend that the Department enhance policies and procedures to ensure the accuracy of eligibility and benefit determinations, and verify that benefit payments are made in accordance with Federal regulations. Corrective Action Plan: See F-26 Management’s Response: The Department agrees with this finding. Completion of the Adoption Assistance Checklist has not been universally understood to be used as the internal control for documentation of certification decisions, but as a guide for staff to use in preparing and organizing the Application for Adoption Assistance Packets. We agree that this is an effective tool to ensure certification decisions regarding IVE and consistent documentation in case files. Contact: Karen Benson, Adoption Program Manager, OCFS, DHHS, 207-561-4208 (State Number: 24-1110-01)

(2024-065) Title: Internal control over the Foster Care – Title IV-E and Adoption Assistance – Title IV-E programs FMAP rates needs improvement Prior Year Findings: None State Department: Health and Human Services Administrative and Financial Services State Bureau: Office of Child and Family Services Health and Human Services Service Center Federal Agency: U.S. Department of Health and Human Services Assistance Listing Title: Foster Care – Title IV-E (COVID-19) Adoption Assistance – Title IV-E (COVID-19) Assistance Listing Number: 93.658; 93.659 Federal Award Identification Number: See E-77 to E-78 Compliance Area: Allowable costs/cost principles Matching, level of effort, earmarking Type of Finding: Significant deficiency Questioned Costs: None Criteria: 2 CFR 200.303; 2 CFR 200.403; 45 CFR 1356.21, .40, and .60; Public Law No. 117-328, Section 5131 of Division FF of the Consolidated Appropriations Act, 2023 The Department must establish and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. To be allowable under Federal awards, costs must be necessary and reasonable for the performance of the Federal award and be adequately documented. 45 CFR 1356.21 outlines eligible criteria which, if met, allows the State to pay foster care maintenance payments on behalf of eligible children, in accordance with the Title IV-E agency’s foster care maintenance payment rate schedule, to individuals serving as foster family homes, to childcare institutions, or to public or private child-placement or childcare agencies. 45 CFR 1356.40 outlines eligibility criteria which, if met, allows the State to pay a portion of the Federal Adoption Assistance maintenance payments and claim Federal financial participation for the payment. 45 CFR 1356.60 outlines the matching percentage of Title IV-E funding in Adoption Assistance subsidy payments and is based on the Federal Medical Assistance Program (FMAP) percentage. As a result of the COVID-19 public health emergency, the U.S. Department of Health and Human Services granted a temporary increase to the FMAP rate that is used in determining the Federal share of expenditures for assistance payments under the Title IV-E Foster Care and Adoption Assistance programs. This was permitted for each calendar quarter occurring during the period beginning on January 1, 2020. Under the Consolidated Appropriations Act enacted on December 29, 2022, the enhanced FMAP rate was required to be phased out and end completely on December 31, 2023. Condition: The Office of Child and Family Services (OCFS) administers the Foster Care – Title IV-E (Foster Care) and Adoption Assistance – Title IV-E (Adoption Assistance) programs for the State, outlined below: • The Foster Care program is designed to help states provide safe and stable out-of-home care for children under its jurisdiction until the children are returned home safely, placed with adoptive families, or placed in other planned arrangements for permanency. • The Adoption Assistance program provides Federal funds to states to facilitate the timely placement of children, whose special needs or circumstances would otherwise make them difficult to place, with adoptive families. Funds are available for a one-time payment to assist with the costs of adopting a child as well as for subsidies to adoptive families to assist with the care of the eligible child on an ongoing basis. The State is allowed to pay a portion of the Foster Care and Adoption Assistance maintenance payments and claim Federal financial participation for eligible clients. The FMAP rate is programmed into the child welfare information system by OCFS to apply the correct allocation between Federal and State funds to each transaction for eligible Foster Care and Adoption Assistance eligible clients. The Department of Health and Human Services’ Service Center (DHHS SC) submits quarterly financial reports that detail the allocation between Federal and State funds, based on the FMAP programmed into the report template obtained from the Federal agency. When discrepancies are identified, DHHS SC will correct the fund allocation in the State’s accounting system and report the benefit amounts using the correct FMAP rates. The Office of the State Auditor (OSA) tested 60 Foster Care benefit payments and 60 Adoption Assistance benefit payments and found that OCFS program personnel did not reduce the FMAP rate from January 1, 2024, through May 3, 2024. For 17 Foster Care and 29 Adoption Assistance benefit payments, OCFS continued to claim the enhanced rate of 64.15 percent for both programs, instead of the required 62.65 percent rate. While the incorrect rate was applied to individual client benefit payments, DHHS SC reported the correct FMAP rate and Federal participation amounts in the quarterly financial reports and drew Federal funds based on the correct FMAP rate for that period. DHHS SC and OCFS did not confirm that the correct rates were applied within the child welfare information system. OSA selected non-statistical random samples. Context: In fiscal year 2024, the State provided approximately: • 900 Foster Care clients with $5.4 million in Federal benefits; and • 4,200 Adoption Assistance clients with $24.7 million in Federal benefits. Cause: Lack of central oversight over communication of FMAP rate changes between DHHS SC and OCFS personnel Effect: • Inaccurate Federal and State allocation for client benefit payments within the child welfare information system, resulting in discrepancies between the State’s accounting system and the child welfare information system. • Potential future questioned costs and disallowances • Noncompliance with Federal regulations Recommendation: We recommend that the Departments enhance policies and procedures to ensure the appropriate FMAP rates are communicated and entered into the child welfare information system accurately and timely. This will ensure that client benefit information is accurately reflected in the child welfare information system and agrees to the client benefit amounts in the State’s accounting system. Corrective Action Plan: See F-27 Management’s Response: The Department agrees with this finding. OCFS agrees there was a failure in the timely communication process of the step down FMAP rate to OCFS. OCFS has developed and will implement a corrective action plan to address the issue identified. Contact: Robert Blanchard, Associate Director, OCFS, DHHS, 207-624-7955 (State Number: 24-1110-02)

(2024-066) Confidential finding, see below for more information Title: ________ over ________, ________, and ________ needs improvement Pursuant to paragraph 6.63 of the U.S. Government Accountability Office’s Government Auditing Standards (also known as the Yellow Book), we omitted details from this finding as they are confidential under the provisions of 5 MRSA 244-C (3). Though the content of this finding has been redacted, we provided the Department(s) with detailed information regarding the specific condition we identified, as well as the related criteria, context, causes, effects, and our specific recommendations for improvement. Prior Year Findings: See schedule of Findings and Questioned costs for chart/table Type of Finding: Significant deficiency Corrective Action Plan: See F-27 Contact: Shirley Browne, Deputy State Controller, Office of the State Controller, 207-626-8423 (State Number: 24-0906-03)

(2024-067) Title: Internal control over Medicaid Nursing Facility audits needs improvement Prior Year Findings: See schedule of Findings and Questioned costs for chart/table State Department: Health and Human Services State Bureau: Division of Audit Federal Agency: U.S. Department of Health and Human Services Assistance Listing Title: Medicaid Cluster (COVID-19) Assistance Listing Number: 93.775, 93.777, 93.778 Federal Award Identification Number: See E-77 to E-78 Compliance Area: Special tests and provisions Type of Finding: Material weakness Material noncompliance Questioned Costs: None Criteria: 2 CFR 200.303; 42 CFR 447.253(g); MaineCare Benefits Manual, Chapter III, Section 67 The Department must establish and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. The Department is required to provide for the periodic audits of the financial and statistical records of participating providers. The MaineCare Benefits Manual (MCBM) Chapter III, Section 67 outlines the documentation and support required to be included in a provider’s annual cost report filing submission to the Division of Audit. The Division of Audit’s requirements for reviewing the cost reports and performing uniform desk reviews is also outlined. Section 67 states that the Division of Audit must perform a uniform desk review on each Nursing Facility (NF) cost report submission within 365 days of receipt of an acceptable cost report filing. Condition: For each participating Long Term Care Facility, the Department must provide for the filing of uniform cost reports in order to establish payment rates and must provide for the periodic audits of financial and statistical records. The specific audit requirements will be established by the State plan. The MCBM states uniform desk reviews shall be completed within 365 days after receipt of an acceptable cost report filing, including financial statements and other information requested from the provider except in unusual situations including, but not limited to, delays in obtaining necessary information from a provider. Unless the Division of Audit intends to schedule an on-site audit or an unusual situation referenced above exists, a written summary report of findings and adjustments shall be issued upon completion of the uniform desk review. The Division of Audit did not complete NF audits in accordance with Federal regulations. The population of NF uniform desk reviews due for completion in fiscal year 2024 was 89. Of those 89 uniform desk reviews, none were completed at the time of audit testing in September 2024. Context: The Department: • provided $262.6 million in Federal Medicaid funding and $107.6 million in State Medicaid funding to NFs during fiscal year 2024. • completed 69 NF uniform desk reviews related to prior fiscal years in fiscal year 2024. Cause: Lack of resources Effect: • Noncompliance with Federal and State regulations • The determination of amounts owed to or from NFs is delayed. Recommendation: We recommend that the Department reallocate resources to address the backlog of NF uniform desk reviews. Timely audit issuance will minimize the impact on providers of potential payables and receivables. Corrective Action Plan: See F-27 Management’s Response: The Department agrees with this finding and cause. The lack of resources is the result of high vacancy rates (30%) for the Division of Audit and staff working on reviews of COVID funding. The Division of Audit has completed the reviews required for COVID funding and will be redirecting staff to work on the Medicaid audits. The Division of Audit is working to fill all vacant positions, so resources are available for these audits. Lastly, the Department has implemented a new reimbursement methodology for Nursing Facilities which will reduce the amount of audit testing required. Contact: Herb Downs, Director, Division of Audit, DHHS, 207-287-2778 (State Number: 24-1106-01)

(2024-068) Title: Internal control over Medicare Part B premium payments needs improvement Prior Year Findings: See schedule of Findings and Questioned Costs for chart/table State Department: Health and Human Services State Bureau: Office for Family Independence Federal Agency: U.S. Department of Health and Human Services Assistance Listing Title: Medicaid Cluster (COVID-19) Assistance Listing Number: 93.775, 93.777, 93.778 Federal Award Identification Number: See E-77 to E-78 Compliance Area: Allowable costs/cost principles Type of Finding: Significant deficiency Questioned Costs: None Criteria: 2 CFR 200.303; 42 CFR 431.625 The Department must establish and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. 42 CFR 431.625 outlines eligibility criteria which, if met, allows the State to pay a portion of the Federal Medicare Part B premium on behalf of the client and claim Federal financial participation in the payment. Clients may be deemed eligible by the Federal government as indicated by a Federal Buy-In code, or by the State as indicated by eligibility status in the Automated Client Eligibility System (ACES). Condition: The Department receives monthly invoices from the Centers for Medicare and Medicaid Services (CMS) for Medicare Part B premiums. CMS provides a separate detailed listing of transactions relating to the status of Medicaid clients’ Medicare Part B (Buy-In) eligibility that the Office for Family Independence (OFI) Data Team utilizes to produce the Monthly Buy-In Report. OFI eligibility personnel use the Monthly Buy-In Report to reconcile Buy-In actions taken by and between CMS and ACES to ensure Medicare Part B payments are made only to those deemed eligible. The OFI Data Team produced 12 Monthly Buy-In Reports throughout fiscal year 2024. The Department could not provide documentation that reports were reviewed or corrective action was taken for seven months of potential discrepancies. Context: In fiscal year 2024, approximately $123 million in Federal funds and $70 million in State funds were paid to CMS for Medicare Part B premiums. Cause: • Lack of resources • Lack of supervisory oversight Effect: • Potential Medicare Part B premiums paid by the State for ineligible clients • Potential questioned costs and disallowances • Noncompliance with Federal regulations Recommendation: We recommend that the Department implement oversight procedures to ensure that Monthly Buy-In Reports are reviewed, corrective action is implemented if required, and documentation is retained. Corrective Action Plan: See F-28 Management’s Response: The Department agrees with this finding. There has been marked improvement in our results reviewing and acting on these reports since our MaineCare Program Integrity team became fully staffed in March 2024. We intend to review our processes further and regularly to ensure satisfaction of the requirement. The Department provided documentation to support that review and corrective actions were completed for five of the twelve months. Documentation could not be provided to support full review for seven months. Contact: Ian Yaffe, Director, Office for Family Independence, DHHS, 207-592-1481 (State Number: 24-1106-03)

(2024-069) Title: Internal control over Medicaid cost of care assessments and deductions needs improvement Prior Year Findings: See scheduleof Findings and Questioned Costs for chart/table State Department: Health and Human Services State Bureau: Office for Family Independence Office of MaineCare Services Federal Agency: U.S. Department of Health and Human Services Assistance Listing Title: Medicaid Cluster (COVID-19) Assistance Listing Number: 93.775, 93.777, 93.778 Federal Award Identification Number: See E-77 to E-78 Compliance Area: Allowable costs/cost principles Type of Finding: Significant deficiency Questioned Costs: None Criteria: 2 CFR 200.303; 2 CFR 200.403; 42 CFR 435.725; MaineCare Eligibility Manual, Part 14, Section 6 The Department must establish and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. To be allowable under Federal awards, costs must be necessary and reasonable for the performance of the Federal award and be adequately documented. The Department must reduce its payment to an institution for services provided to an individual by the amount that remains after deducting certain amounts from the member’s total income. This remaining amount is the member’s maximum share of the cost, known as cost of care (COC). Condition: A COC assessment represents the required contribution that a MaineCare recipient must pay toward care in a Long Term Care Facility (LTCF). The Office for Family Independence (OFI) is responsible for COC assessments for all Medicaid members in the State. COC assessments are either calculated by the Automated Client Eligibility System or calculated manually by eligibility specialists. System-generated COC assessments are not subject to secondary review. A COC deduction represents the amount of assessment that was deducted from a paid claim. Members may have an assessment calculated but may never have a claim with a deduction utilizing that assessment. The Office of MaineCare Services (OMS) is responsible for applying assessments to submitted claims prior to payment. The Office of the State Auditor (OSA) tested 60 COC assessments and related deductions from paid claims. OSA identified: • one COC assessment was not calculated correctly or retroactively adjusted. The COC was higher than it should have been by $10. The assessment was $1,099 and should have been $1,089 for six months during the fiscal year. This member had six claims where the incorrect COC was applied. • one COC deduction was not deducted correctly from the paid claim. The COC deducted was lower than it should have been by $22. The assessment was $1,713 for two months during the fiscal year and the amount that was deducted was $1,691. This member had two claims where the incorrect COC deduction was applied. OSA selected a non-statistical random sample. Context: In fiscal year 2024, approximately: • 18,000 COC assessments were calculated by OFI; • 8,500 members had COC assessments; and • $627 million was paid to LTCFs. Cause: • Lack of supervisory oversight • Lack of adequate procedures to ensure COC assessments are calculated correctly • Lack of adequate procedures to ensure system exception reports are complete and accurate Effect: • Inaccurate COC assessments, deductions, and retroactive changes may result in overpayments or underpayments for members or the State. • Potential questioned costs and disallowances Recommendation: We recommend that: • OFI enhance oversight procedures to ensure that COC assessments are calculated and deducted correctly. • OMS collaborate with OFI to ensure that system exception reports capture all COC-related claims which require adjustments. Corrective Action Plan: See F-28 Management’s Response: The Department partially agrees with this finding. The Department agrees with the two exceptions found by the Office of the State Auditor. However, we believe that the Department has reasonable assurance with the controls in place that results in a 97% compliance with the COC calculations, which has not decreased from previous findings. No corrective action is necessary as a result of an error rate of only 3%. The Department will continue to actively manage and monitor the Cost of Care system in compliance with federal regulations. In response to the first of two errors identified by OSA, OMS will request an update to an existing Cost of Care report supplied by a third-party vendor. Changes to cost of care are contained in the Retroactive Cost of Care Report, however if there is a second determination of cost of care in a month and the result is identical to the first change in the month, neither is included in the report. This is an error in the report logic that must be corrected.  A Change Request will be created to modify and correct the report so that the latest change in the month will be reported to be acted on by OMS. Contact: Ian Yaffe, Director, Office for Family Independence, DHHS, 207-592-1481 Auditor’s Concluding Remarks: The Department agrees with the exceptions identified in the Condition. The Department’s disagreement is derived from the three percent sample payment error rate. The Department asserts that the error rate is acceptable and thus, no corrective action is necessary; however, for the two exceptions OSA identified, existing control procedures resulted in inaccurate claim payments. While OSA recognizes that achieving 100 percent accuracy in calculating COC assessments and applying COC deductions would likely not be feasible, the identified control deficiencies indicate that a review of operating procedures and implementation of improvements is necessary. The finding remains as stated. (State Number: 24-1106-05)

(2024-070) Title: Internal control over Medicaid drug rebates needs improvement Prior Year Findings: See schedule of Findings and Questioned Costs for chart/table State Department: Health and Human Services State Bureau: Office of MaineCare Services Federal Agency: U.S. Department of Health and Human Services Assistance Listing Title: Medicaid Cluster (COVID-19) Assistance Listing Number: 93.775, 93.777, 93.778 Federal Award Identification Number: See E-77 to E-78 Compliance Area: Allowable costs/cost principles Type of Finding: Significant deficiency Questioned Costs: None Criteria: 2 CFR 200.303; Section 1927 of the Social Security Act (42 USC 1396r-8) The Department must establish and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. Section 1927 of the Social Security Act requires manufacturers that wish to have their outpatient drugs covered by Medicaid to enter into an agreement with the Centers for Medicare & Medicaid Services (CMS) under which the manufacturers agree to pay rebates for drugs dispensed and paid for by the State Medicaid agencies under the State plan. Drug rebates are shared between the State and Federal government. Condition: Drug manufacturers are required to submit a list of all covered outpatient drugs, along with each drug’s average manufacturer price and “best price” to CMS. Utilizing this information, CMS calculates a unit rebate amount (URA) for each covered outpatient drug and provides the amounts to the State on a quarterly basis. The Department is required to maintain drug utilization data that identifies, by National Drug Code (NDC), the number of units of each covered outpatient drug for which the Department has paid pharmacy providers. The utilization data is provided to CMS and the manufacturers. The number of dispensed units is applied to the URA to determine the rebate amount due from each manufacturer. The State contracts with a vendor to calculate the drug rebate amounts and invoice manufacturers for drug rebates. The Office of the State Auditor (OSA) identified that the Department does not have procedures in place to ensure the accuracy and completeness of the drug rebate amounts invoiced by the vendor. Though the Department validates that only rebatable drugs are invoiced and all rebatable drugs are included for invoicing, this review is performed after the invoicing cycle. In addition, the Department does not compare drug utilization data to the number of dispensed units invoiced, or corroborate that the correct URA is applied to each NDC to ensure that the vendor has calculated the rebate correctly. Context: In fiscal year 2024, the State invoiced approximately $300 million for rebatable drugs and received approximately $216 million in rebates. Of the $216 million in rebates, approximately $144 million was returned to the Federal government. Due to the amount of time rebate negotiations may take, discrepancies will exist between the invoiced total and the total amount of rebates received. Cause: • Lack of adequate procedures • Lack of supervisory oversight Effect: • Inaccurate or incomplete invoicing of drug rebates would result in overpayments or underpayments to the State and Federal government. • Noncompliance with Federal regulations Recommendation: We recommend that the Department implement procedures to confirm the drug rebate amounts calculated and invoiced by the vendor are accurate and complete, including: • validating that only rebatable drugs are invoiced and all rebatable drugs are included for invoicing; • comparing drug utilization data to the number of dispensed units invoiced; and • corroborating the correct URA is applied to each NDC. This will ensure that correct drug rebate amounts are returned to the State and Federal government. Corrective Action Plan: See F-28 Management’s Response: The Department disagrees with this finding. PRIMS (Pharmacy Rebate Information Management System), provided to the State of Maine by a third-party vendor, is a proven system in production in many locations and PRIMS has passed a wide variety of Federal and State audits. The drug rebate program is complex and there are numerous steps in the process which have already been demonstrated and/or provided to the Office of State Auditor. The controls described to the State Auditor previously (Pre-invoicing controls, pharmacy claims controls and medical claims controls) address all three of the Auditors’ Recommendations. Contact: Michelle Probert, Director, Office of MaineCare Services, DHHS, 207-287-2093 Auditor’s Concluding Remarks: 2 CFR 200.303 requires the State to establish and maintain effective internal controls. The Department’s Management Response stating that the vendor’s drug rebate information system “is a proven system in production in many locations” that “has passed a wide variety of Federal and State audits” only further validates that the Department is fully relying on the vendor to ensure the accuracy and completeness of drug rebate invoices. As stated in Management’s Response “the drug rebate program is complex” which further emphasizes the need for proper oversight. Existing reliance on the vendor demonstrates that the Department does not have adequate oversight procedures in place. In addition, the Department asserts controls are in place to address OSA’s Recommendation; however, the controls referenced in Management’s Response do not adequately address the risk associated with the issues noted in the Condition. The pre-invoicing controls referenced by the Department are performed at a summary level and the pharmacy and medical claims controls are not directly tied to the drug rebate invoicing process. The finding remains as stated. (State Number: 24-1106-07)

(2024-071) Title: Internal control over Medicaid paid medical claims needs improvement Prior Year Findings: None State Department: Health and Human Services State Bureau: Office of MaineCare Services Federal Agency: U.S. Department of Health and Human Services Assistance Listing Title: Medicaid Cluster (COVID-19) Assistance Listing Number: 93.775, 93.777, 93.778 Federal Award Identification Number: See E-77 to E-78 Compliance Area: Allowable costs/cost principles Type of Finding: Significant deficiency Questioned Costs: None Criteria: 2 CFR 200.303; 2 CFR 200.403; MaineCare Benefits Manual, Chapter 101, Section 90 The Department must establish and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. To be allowable under Federal awards, costs must be necessary and reasonable for the performance of the Federal award and be adequately documented. The MaineCare Benefits Manual states that the Medicaid program will reimburse at the lowest applicable rate for covered physician services. Condition: The Department’s Office of MaineCare Services (OMS) is billed by medical providers for services provided to Medicaid members. Provider reimbursement rates for certain medical services increased January 1, 2024; however, providers continued to bill OMS utilizing outdated rates until a retroactive adjustment was processed by OMS in March 2024 for certain medical services reimbursed in January and February. The Office of the State Auditor (OSA) tested 60 paid medical claims and identified one claim that was reimbursed at a higher than authorized rate. As a result, OMS overpaid the provider by $5. To determine the pervasiveness of the error, OSA reviewed all claims for the same medical service paid between January 1 and the March 2024 retroactive adjustment and found 510 claims that were never retroactively adjusted. A total of $3,300 was identified as overpaid to providers. OSA selected a non-statistical random sample. Context: In fiscal year 2024, $2.2 billion was paid to providers for medical claims. Cause: • Lack of supervisory oversight • Lack of adequate procedures to ensure all medical claims are paid correctly Effect: • Inaccurate paid claims resulted in overpayments and may also result in underpayments to providers. • Potential questioned costs and disallowances Recommendation: We recommend that the Department enhance oversight procedures to ensure that authorized provider reimbursement rates are utilized, and any retroactive adjustments are applied to all affected paid claims accurately and completely. This will ensure that Medicaid claims are not overpaid or underpaid to providers. Corrective Action Plan: See F-29 Management’s Response: The Department agrees with this finding. OMS has determined that there is an issue with the manual intervention taken by the third-party vendor to prepare this report. This caused some claims that required adjustment to be excluded from the report. Through discussion with the vendor, OMS has determined that the vendor does not have a standardized procedure to prepare this report for OMS. Maine will require the vendor to prepare a Desk Level Procedure (DLP) for the preparation of this report. This DLP will be reviewed by the State and the report will go through testing and validation, as necessary, before the report is used again. Contact: Michelle Probert, Director, Office of MaineCare Services, DHHS, 207-287-2093 (State Number: 24-1106-06)

(2024-072) Confidential finding, see below for more information Title: ________ over the ________ and ________ needs improvement Pursuant to paragraph 6.63 of the U.S. Government Accountability Office’s Government Auditing Standards (also known as the Yellow Book), we omitted details from this finding as they are confidential under the provisions of 5 MRSA 244-C (3). Though the content of this finding has been redacted, we provided the Department(s) with detailed information regarding the specific condition we identified, as well as the related criteria, context, causes, effects, and our specific recommendations for improvement. Prior Year Findings: None Type of Finding: Significant deficiency Corrective Action Plan: See F-29 Contact: Shirley Browne, Deputy State Controller, Office of the State Controller, 207-626-8423 (State Number: 24-0902-04)

(2024-073) Title: Internal control over DG – PA program special reporting needs improvement Prior Year Findings: See schedule of Findings and Questioned Costs for chart/table State Department: Defense, Veterans and Emergency Management State Bureau: Maine Emergency Management Agency Federal Agency: U.S. Department of Homeland Security Assistance Listing Title: Disaster Grants – Public Assistance (Presidentially Declared Disasters) (COVID-19) Assistance Listing Number: 97.036 Federal Award Identification Number: See E-77 to E-78 Compliance Area: Reporting Type of Finding: Material weakness Material noncompliance Questioned Costs: None Criteria: 2 CFR 200.303; 2 CFR 170 The Department must establish and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. Agencies must report each subaward that equals or exceeds the first-tier subaward threshold of $30,000 in Federal funds in the public-facing Federal Funding Accountability and Transparency Act (FFATA) Subawards Reporting System (FSRS). Condition: When an amount exceeding the first-tier subaward threshold is awarded to a subrecipient of the Disaster Grants – Public Assistance (DG – PA) program, Maine Emergency Management Agency (MEMA) must collect and enter data into FSRS. The Office of the State Auditor (OSA) tested 33 DG – PA subawards totaling $8,864,828 that exceeded the first-tier subaward threshold. Federal regulations require the following information for identified noncompliance to be included in FFATA findings: • two subawards totaling $364,133 were not reported; • 27 subawards totaling $8,246,776 were not reported timely; • no subaward amounts were reported incorrectly; and • 21 subawards reported incorrect key data elements. OSA selected a non-statistical random sample. Context: In fiscal year 2024, MEMA was required to report 280 first-tier subawards totaling approximately $57 million under the DG – PA program. First-tier subawards account for 83 percent of the program’s fiscal year 2024 expenditures. Cause: • Lack of adequate policies and procedures • Lack of resources Effect: • Noncompliance with Federal regulations • Accurate first-tier subaward information for the DG – PA program was not reported to the Federal government timely and included inaccurate or incomplete information. This information may be used for programmatic, policy, or statistical purposes. Recommendation: We recommend that the Department enhance policies and procedures to ensure that first-tier subawards are reported accurately, timely, and in accordance with Federal regulations. Corrective Action Plan: See F-29 Management’s Response: The Department agrees with this finding. MEMA’s procedure for Federal Financial Reporting already includes a standardized workbook template to compile Federal and State financial data for each grant award and facilitate accurate completion of the SF-425 form. The workbook is prepared by one MEMA staff member, and the resulting draft SF-425 form is reviewed by another MEMA staff member prior to finalization and signature by MEMA’s Authorized Representative. MEMA engaged with Federal funding partners in FY2024 to understand the appropriate data validation processes for financial reporting within the Public Assistance Grants Portal and Payment Management System (PMS), including participation in a training workshop and receiving data validation feedback from reviewers at the Federal level. These reporting process refinements will be reflected in updates to the existing SOP, and an additional review tab will be incorporated into the existing SF-425 preparatory workbooks to document review and data validation steps in detail. Contact: Sunny Cyr, Business Office Director, MEMA, DVEM, 207-707-2507 (State Number: 24-1502-03)

(2024-074) Title: Internal control over DG – PA program cash management needs improvement Prior Year Findings: See schedule of Findings and Questioned Costs for chart/table State Department: Defense, Veterans and Emergency Management Administrative and Financial Services State Bureau: Maine Emergency Management Agency Security and Employment Service Center Federal Agency: U.S. Department of Homeland Security Assistance Listing Title: Disaster Grants – Public Assistance (Presidentially Declared Disasters) (COVID-19) Assistance Listing Number: 97.036 Federal Award Identification Number: See E-77 to E-78 Compliance Area: Cash management Type of Finding: Significant deficiency Questioned Costs: None Criteria: 2 CFR 200.303; 31 CFR 205(A); 2024 Treasury-State Agreement (Maine) The Department must establish and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. A Treasury-State Agreement (TSA) documents the accepted funding techniques and methods for calculating interest agreed upon by the U.S. Department of the Treasury and the State. The funding technique agreed upon in the State’s TSA for the Disaster Grants – Public Assistance (DG – PA) program is the “actual drawdown – weekly” method. This method specifies that the State shall make weekly drawdowns based on actual expenditures which occurred in the past weekly period. Condition: The Maine Emergency Management Agency (MEMA) administers the DG – PA program for the State. The Department of Administrative and Financial Services’ Security and Employment Service Center (SESC) is responsible for requesting drawdowns of Federal funds in order to pay DG – PA program expenditures on behalf of MEMA. MEMA reviews, authorizes, and submits approved invoices to SESC for payment. SESC then requests Federal funds based on the approved invoices and processes the authorized payment once Federal funds are received. SESC completed 69 Federal grant drawdowns for the DG – PA program in fiscal year 2024, which is not consistent with the TSA requirements that only allow for weekly drawdowns. The Office of the State Auditor (OSA) performed analytical procedures and identified a drawdown that was drawn in advance of actual disbursement. OSA reviewed additional drawdowns and identified other drawdowns during fiscal year 2024 that were also drawn in advance of actual disbursement. This process is not consistent with TSA requirements. As a result, MEMA had excess cash on hand during fiscal year 2024 and is not in compliance with cash management requirements. Context: In fiscal year 2024, there were 69 Federal grant drawdowns totaling approximately $69 million for the DG – PA program. Cause: • Lack of adequate policies and procedures • Lack of supervisory oversight Effect: • Noncompliance with Federal regulations • The Federal government may improve more stringent program-specific cash management requirements based on noncompliance. Recommendation: We recommend that the Department implement policies and procedures to ensure compliance with the funding techniques specified in the TSA when requesting Federal funds. Corrective Action Plan: See F-29 Management’s Response: The Department agrees with this finding. Corrective action was already implemented mid-way through State Fiscal Year 2024 as polices and procedures were updated, and a weekly draw process has been since been used. The Security and Employment Service Center began reconciling draw requests as part of these updated procedures. A majority of the cash on hand was due to contract modifications as the cash was drawn but the payments could not be made until the contract modifications were completed in the accounting system. MEMA made subsequent updates to the cash management process to avoid drawing for payments that might be impacted by unanticipated delays in the final two weeks of each quarter. In addition, the department discussed modifying the Treasury-State Agreement (TSA) with the Office of the State Treasurer. The 2025 TSA lists a Weekly Drawdown - Actual & Estimate funding technique for this major program as some of these payments are too substantial for the State to process and have to wait for reimbursement. Contact: Sunny Cyr, Business Office Director, MEMA, DVEM, 207-707-2507 (State Number: 24-1502-04)

(2024-075) Title: Internal control over DG – PA program financial reporting needs improvement Prior Year Findings: None State Department: Defense, Veterans and Emergency Management State Bureau: Maine Emergency Management Agency Federal Agency: U.S. Department of Homeland Security Assistance Listing Title: Disaster Grants – Public Assistance (Presidentially Declared Disasters) (COVID-19) Assistance Listing Number: 97.036 Federal Award Identification Number: See E-77 to E-78 Compliance Area: Reporting Type of Finding: Significant deficiency Questioned Costs: None Criteria: 2 CFR 200.303; 2 CFR 200.302 The Department must establish and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. The Department must maintain accurate, current, and complete disclosure of the financial results of each Federal award or program in accordance with reporting requirements. Condition: The Maine Emergency Management Agency (MEMA) administers the Disaster Grants – Public Assistance (DG – PA) program for the State. MEMA is required to submit quarterly DG – PA Federal Financial Reports (FFRs) to the Federal Emergency Management Agency (FEMA) Regional Office. FFRs provide FEMA with the status of funds for the award, Federal expenditures, and cost-sharing requirements. The Office of the State Auditor (OSA) tested four FFRs due in fiscal year 2024 and found: • one FFR inaccurately reported total Federal funds authorized as $889,510 when the correct total was $617,318; • one FFR inaccurately reported the recipient share of expenditures as $712,412 when the correct share was $159,382; and • one FFR inaccurately reported total Federal funds authorized as $640,654 when the correct total was $1,469,390, and the recipient share of expenditures as $842,604 when the correct share was $434,484. OSA selected a non-statistical random sample. Context: During fiscal year 2024, 33 FFRs were required to be filed by MEMA for the DG – PA program. Cause: • Lack of adequate policies and procedures to ensure data used for financial reporting is complete and accurate • Lack of supervisory oversight Effect: • Noncompliance with Federal reporting requirements • Inaccurate tracking of subawards may result in noncompliance with Federal matching requirements. Recommendation: We recommend that MEMA enhance policies and procedures to ensure that FFRs are accurate and include all required information for compliance with Federal reporting requirements. Corrective Action Plan: See F-30 Management’s Response: The Department agrees with this finding. Corrective action was implemented at the end of State Fiscal Year 2024. Untimely reports were primarily due to a backlog of required reporting that was brought up to date over the fiscal year as a corrective action to the prior year finding. In the current monthly reporting process, award data is provided by grant program experts to avoid incorrect data elements, and reporting is reviewed for completeness by a staff member not involved in report submission. In the third quarter of FY2025, the FFATA reporting system was retired from FSRS.gov and transferred to SAM.gov, further minimizing the possibility of incorrect data elements being reported. MEMA will update the existing SOP for FFATA reporting to address specifics related to the new reporting process within SAM.gov Contact: Sunny Cyr, Business Office Director, MEMA, DVEM, 207-707-2507 (State Number: 24-1502-02)

(2024-076) Title: Internal control over the submission of DG – PA program Schedule of Expenditures of Federal Awards information needs improvement Prior Year Findings: None State Department: Defense, Veterans and Emergency Management State Bureau: Maine Emergency Management Agency Federal Agency: U.S. Department of Homeland Security Assistance Listing Title: Disaster Grants – Public Assistance (Presidentially Declared Disasters) (COVID-19) Assistance Listing Number: 97.036 Federal Award Identification Number: See E-77 to E-78 Compliance Area: Reporting Type of Finding: Significant deficiency Questioned Costs: None Criteria: 2 CFR 200.303; 2 CFR 200.510 The Department must establish and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. The Department must prepare a Schedule of Expenditures of Federal Awards (SEFA) for the period covered by the State’s financial statements which must include the total Federal awards expended. At a minimum, the SEFA must include the total amount provided to subrecipients from each Federal program. Condition: The Maine Emergency Management Agency (MEMA) must complete and submit exhibits and related schedules to the Office of the State Controller (OSC) at the close of each fiscal year to report Federal award information for inclusion on the State’s SEFA. OSC is responsible for compiling this information on behalf of the State. MEMA submitted schedules to OSC that incorrectly reported $91,471 of expenditures under ALN 97.050 Presidential Declared Disaster Assistance to Individuals and Households – Other Needs that should have been reported under ALN 97.036 Disaster Grants – Public Assistance (DG – PA) (Presidentially Declared Disasters). MEMA procedures do not require review of schedules prior to submission to OSC. Context: In fiscal year 2024, DG – PA expenditures totaled approximately $68 million. Cause: • Lack of adequate policies and procedures • Lack of supervisory oversight Effect: Inaccurate reporting of expenditure amounts on the SEFA, which is submitted to the Federal government, may result in incorrect information used for programmatic, policy, or statistical purposes. Recommendation: We recommend that MEMA implement policies and procedures that require a comprehensive review of SEFA schedules prior to submission to OSC. Corrective Action Plan: See F-30 Management’s Response: The Department agrees with this finding. MEMA will work with Defense, Veterans and Emergency Management staff to develop an agency-specific procedure for comprehensive review of the agency’s Federal expenditures at an appropriate point in the department’s annual SEFA reporting process. Contact: Sunny Cyr, Business Office Director, MEMA, DVEM, 207-707-2507 (State Number: 24-1502-01)

(2023-022) Confidential finding, see below for more information Title: ________ over ________ and ________ needs improvement Pursuant to paragraph 6.63 of the U.S. Government Accountability Office’s Government Auditing Standards (also known as the Yellow Book), we omitted details from this finding as they are confidential under the provisions of 5 MRSA 244-C (3). Though the content of this finding has been redacted, we provided the Department(s) with detailed information regarding the specific condition we identified, as well as the related criteria, context, causes, effects, and our specific recommendations for improvement. Prior Year Findings: See schedule of Findings and Questioned Costs for chart/table Type of Finding: Material weakness Corrective Action Plan: See F-15 Contact: Shirley Browne, Deputy State Controller, Office of the State Controller, 207-626-8423 (State Number: 23-0905-01)

(2023-023) Confidential finding, see below for more information Title: ________ over the ________ needs improvement Pursuant to paragraph 6.63 of the U.S. Government Accountability Office’s Government Auditing Standards (also known as the Yellow Book), we omitted details from this finding as they are confidential under the provisions of 5 MRSA 244-C (3). Though the content of this finding has been redacted, we provided the Department(s) with detailed information regarding the specific condition we identified, as well as the related criteria, context, causes, effects, and our specific recommendations for improvement. Prior Year Findings: See schedule of Findings and Questioned Costs for chart/table Type of Finding: Material weakness Corrective Action Plan: See F-15 Contact: Shirley Browne, Deputy State Controller, Office of the State Controller, 207-626-8423 (State Number: 23-0907-01)

(2023-024) Confidential finding, see below for more information Title: ________ over ________ needs improvement Pursuant to paragraph 6.63 of the U.S. Government Accountability Office’s Government Auditing Standards (also known as the Yellow Book), we omitted details from this finding as they are confidential under the provisions of 5 MRSA 244-C (3). Though the content of this finding has been redacted, we provided the Department(s) with detailed information regarding the specific condition we identified, as well as the related criteria, context, causes, effects, and our specific recommendations for improvement. Prior Year Findings: See schedule of Findings and Questioned Costs for chart/table Type of Finding: Material weakness Corrective Action Plan: See F-15 Contact: Shirley Browne, Deputy State Controller, Office of the State Controller, 207-626-8423 (State Number: 23-0908-01)

(2023-026) Confidential finding, see below for more information Title: ________ over the ________ needs improvement Pursuant to paragraph 6.63 of the U.S. Government Accountability Office’s Government Auditing Standards (also known as the Yellow Book), we omitted details from this finding as they are confidential under the provisions of 5 MRSA 244-C (3). Though the content of this finding has been redacted, we provided the Department(s) with detailed information regarding the specific condition we identified, as well as the related criteria, context, causes, effects, and our specific recommendations for improvement. Prior Year Findings: None Type of Finding: Significant deficiency Corrective Action Plan: See F-16 Contact: Shirley Browne, Deputy State Controller, Office of the State Controller, 207-626-8423 (State Number: 23-0902-02)

(2023-027) Confidential finding, see below for more information Title: ________ over ________ needs improvement Pursuant to paragraph 6.63 of the U.S. Government Accountability Office’s Government Auditing Standards (also known as the Yellow Book), we omitted details from this finding as they are confidential under the provisions of 5 MRSA 244-C (3). Though the content of this finding has been redacted, we provided the Department(s) with detailed information regarding the specific condition we identified, as well as the related criteria, context, causes, effects, and our specific recommendations for improvement. Prior Year Findings: See schedule of Findings and Questioned Costs for chart/table Type of Finding: Significant deficiency Corrective Action Plan: See F-16 Contact: Shirley Browne, Deputy State Controller, Office of the State Controller, 207-626-8423 (State Number: 23-0900-01)

(2023-028) Confidential finding, see below for more information Title: ________ over the ________ needs improvement Pursuant to paragraph 6.63 of the U.S. Government Accountability Office’s Government Auditing Standards (also known as the Yellow Book), we omitted details from this finding as they are confidential under the provisions of 5 MRSA 244-C (3). Though the content of this finding has been redacted, we provided the Department(s) with detailed information regarding the specific condition we identified, as well as the related criteria, context, causes, effects, and our specific recommendations for improvement. Prior Year Findings: See schedule of Findings and Questioned Costs for chart/table Type of Finding: Significant deficiency Corrective Action Plan: See F-17 Contact: Shirley Browne, Deputy State Controller, Office of the State Controller, 207-626-8423 (State Number: 23-0900-02)

(2023-029) Confidential finding, see below for more information Title: ________ over ________ needs improvement Pursuant to paragraph 6.63 of the U.S. Government Accountability Office’s Government Auditing Standards (also known as the Yellow Book), we omitted details from this finding as they are confidential under the provisions of 5 MRSA 244-C (3). Though the content of this finding has been redacted, we provided the Department(s) with detailed information regarding the specific condition we identified, as well as the related criteria, context, causes, effects, and our specific recommendations for improvement. Prior Year Findings: See schedule of Findings and Questioned Costs for chart/table Type of Finding: Significant deficiency Corrective Action Plan: See F-17 Contact: Shirley Browne, Deputy State Controller, Office of the State Controller, 207-626-8423 (State Number: 23-0905-02)

(2023-030) Title: Internal control over P-EBT Food Benefits needs improvement Prior Year Findings: See schedule of Findings and Questioned Costs for chart/table State Department: Health and Human Services State Bureau: Office for Family Independence Federal Agency: U.S. Department of Agriculture Assistance Listing Title: Pandemic EBT Food Benefits (P-EBT) (COVID-19) Assistance Listing Number: 10.542 Federal Award Identification Number: See E-93 to E-94 Compliance Area: Activities allowed or unallowed Allowable costs/cost principles Eligibility Type of Finding: Material weakness Material noncompliance Questioned costs Known Questioned Costs: $4,271 Likely Questioned Costs: $4,862,998; likely questioned costs were projected by dividing the known questioned costs in the sample by total Pandemic Electronic Benefit Transfer (P-EBT) benefits tested to establish an error rate, then applying that error rate to total P-EBT benefits issued in fiscal year 2023. Criteria: 2 CFR 200.303; 2 CFR 200.403; 7 CFR 274.5; Families First Coronavirus Response Act (Public Law 116-127), Section 1101; State Plan for Pandemic EBT: Children in School/Child Care 2021-2022; State Plan for Pandemic EBT: Children in School and Child Care, Summer 2022 The Department must establish and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. To be allowable under Federal awards, costs must be necessary and reasonable for the performance of the Federal award and be adequately documented. The State is required to maintain EBT issuance, inventory, reconciliation, and other accountability records for a period of three years. The State agency shall control all issuance documents which establish household eligibility while the documents are transferred and processed within the State. The State agency shall use numbers, batching, inventory control logs, or similar controls from the point of initial receipt through the issuance and reconciliation process. The Department must carry out the P-EBT program, authorized by the Families First Coronavirus Response Act (FFCRA), in accordance with the State agency plans approved by the U.S. Department of Agriculture (USDA). FFCRA allows the Department of Education (DOE) to release necessary student information to the Office for Family Independence (OFI) regarding participation in the National School Lunch Program and School Breakfast Program for purposes of administering the P-EBT program. The State was required to submit plans to USDA as a precondition for participation in the P-EBT program. The plans outline the proposed framework for operating the program including details on how benefits will be issued, estimates for the total amount of P-EBT benefits and the number of children participating, tentative issuance schedules, and how the State will identify eligible school children and children in child care. Two separate plans were approved by USDA for P-EBT benefit issuances during fiscal year 2023: School Year 2021-2022 and Summer 2022. Condition: FFCRA authorized the establishment of the P-EBT Food Benefits program in response to the COVID-19 public health emergency. The P-EBT program is administered by OFI, with support from DOE, and provides nutrition assistance for school-age children who would have received free or reduced price school meals under the National School Lunch Program and School Breakfast Program, and children in child care whose child-care facility was closed or had reduced attendance or hours due to COVID-19. As outlined in the State’s USDA-approved plans, OFI established an agreement with DOE to provide information required for issuance of P-EBT benefits to eligible children. DOE provided student data as a starting point for eligibility determinations under the P-EBT program. OFI utilized this information to apply additional eligibility criteria, add information for children under six, calculate appropriate P-EBT benefits, and build benefit issuance files for processing. The State plans and underlying agreement between OFI and DOE establish OFI as the responsible party for the maintenance of data used for determining client eligibility and distributing benefits. Federal guidance over the P-EBT program outlines that audit procedures provide assurance that the Department has established and implemented processes to properly determine program eligibility and benefit levels. The Office of the State Auditor (OSA) reviewed policies and procedures related to OFI’s issuance of P-EBT benefits, and identified the following: • OFI does not have policies and procedures in place to require performance of an independent review, reconciliation, or verification of data provided by DOE to ensure all eligibility criteria are met prior to issuance of P-EBT benefits. A reliance is placed on algorithms within DOE’s data extracts to ensure compliance with eligibility requirements outlined in the State’s approved plan. • OFI does not have documented policies and procedures in place for the data cleaning process applied to files received from DOE. OFI conducts data cleaning on all data files provided by DOE before issuing P-EBT benefits. The cleaning process includes changes such as reformatting zip codes or invalid field lengths, and modifications for inconsistent dates, invalid characters, duplicated data, and invalid address data. Documentation of changes made as a result of the cleaning process is not retained by the Department. • OFI does not have documented policies and procedures in place for system integration testing (SIT) and user acceptance testing (UAT) of P-EBT issuance files. The files built by OFI undergo SIT and UAT prior to transmission for benefit issuance, which includes running a test upload of benefit issuance files and comparing the data input to the resulting output and reviewing a sample of individual benefit issuances. Because documented policies and procedures do not exist, the format, documentation, and results of these testing processes are inconsistent. OSA requested original data files containing client and benefit issuance information utilized by OFI during fiscal year 2023 for all P-EBT issuances that occurred to verify consistency with the State’s USDA-approved plans and compliance with Federal requirements. OSA tested P-EBT benefits provided to 60 households during the fiscal year; however, some households had multiple students receiving benefits. This resulted in a test of 76 P-EBT benefit issuances which identified the following: • For 22 students that received school year P-EBT benefits, OSA was unable to verify eligibility criteria relating to school status, resulting in overpayments totaling $1,534. • For four students that received school year P-EBT benefits, OSA was unable to verify eligibility criteria for free or reduced-price school meals, resulting in overpayments totaling $1,564. • For three students that received summer P-EBT benefits, OSA was unable to confirm the students’ enrollment in school in June 2022, resulting in overpayments totaling $1,173. OFI did not maintain adequate documentation in support of these P-EBT benefit payments totaling $4,271, as required by the agreement between OFI and DOE, and as outlined in the approved State plans. OSA selected a non-statistical random sample. In addition, it was noted through audit testing that OFI does not consistently utilize identification numbers for benefit issuance tracking. P-EBT benefits were issued to existing household EBT cards, under pandemic-related identification numbers, and under child identification numbers; however, the documentation maintained for P-EBT benefit issuances is only tracked by child identification number. This results in an inability to properly monitor benefit issuances to ensure that P-EBT benefits are not duplicated. Context: In fiscal year 2023, the State provided approximately 104,000 P-EBT clients with $37.9 million in Federal benefits. OSA identified 29 unsupported P-EBT benefit issuances out of 76 benefit issuances tested, which represents an error rate of approximately 38 percent. Cause: • Lack of supervisory oversight • Lack of adequate policies and procedures Effect: • Known questioned costs • Potential future questioned costs and disallowances • Noncompliance with Federal regulations Recommendation: We recommend that the Department establish policies and procedures to ensure that: • OFI reviews and reconciles data received from DOE to support eligibility determinations prior to P-EBT benefit issuance; • the data cleaning, SIT, and UAT processes are documented and consistent; and • all documentation in support of P-EBT eligibility determinations and allowability of resulting benefit issuances can be provided in accordance with Federal regulations. In addition, we recommend that the Department review all benefit issuances noted in the Condition of this finding to ensure that unallowable costs are identified and reported to USDA. Corrective Action Plan: See F-17 Management’s Response: The Department partially agrees with this finding. The Department agrees three students that received summer P-EBT benefits were overpaid $391 each. The Department disagrees with the following Conditions: For 22 students, MDOE was not able to identify the specific student whose continuous absence established those students’ schools’ eligibility date. The P-EBT state plan required at least one student to be absent or remote for at least five consecutive days to establish a school eligibility date and MDOE in fact applied this test and established a school eligibility start date at the time the eligibility files were generated. While the school eligibility start date was captured and preserved in the original files provided to OSA, no student was named. The name of the student was not relevant to other students’ eligibility, and creating or preserving a record of the particular student whose absence conferred eligibility was not a requirement of Maine’s P-EBT plan with FNS, the Department’s MOU with MDOE, or federal P-EBT policy. Further attaching that kind of Personal Identifying Information (PII) to other students’ records would not be appropriate. Additionally, since local educational agencies (LEAs) update the core database throughout the school year and beyond, the results could not be replicated in the course of this audit to retrospectively identify the particular students whose absences conferred eligibility. Neither the omission of the students’ names in the original file nor DOE’s inability to identify such students during the audit establishes that it was improper to issue P-EBT benefits in connection with those students. These students were found eligible based on the best data available to MDOE at the time. Likewise, the Department acknowledges that for four students, MDOE was unable – when requested to do so by the OSA – to locate their economically disadvantaged status in the database updated by LEAs throughout the school year. That does not mean, however, that it was improper to issue P-EBT benefits in connection with those students. These students’ economically disadvantaged status was verified by MDOE and captured in the files at the time of issuance. The Department disagrees that tracking benefit issuance by child identification number is inadequate to monitor benefit issuances and ensure benefits are not duplicated. Child identification numbers are the most reliable way to track and deduplicate issuance. As pointed out in this finding, many households had more than one child. Additionally, some children may have moved from one household to another during the period in question. The Department disagrees with the Context and Likely Questioned Costs: For the reasons detailed above, only three – not 29 – of the students sampled were established to have been issued benefits in error. OSA’s calculations should be adjusted accordingly. The Department disagrees with the Causes: OSA is incorrect to conclude that OFI should have reviewed, reconciled, and verified data provided by MDOE prior to issuance for at least two reasons. First, contrary to OSA’s characterization of the partnership, the Department and MDOE were jointly responsible for administering the P-EBT program, with delegated duties defined in the state plan. That federally approved plan considered MDOE data to be accurate and actionable, and it did not contemplate OFI independently validating such data. Second, the Department is not permitted access to the local educational agency data that would have been necessary for the type of review and reconciliation proposed. The Department disagrees with the Recommendations: The three bulleted recommendations cannot be implemented. The P-EBT program ended December 31, 2023. It will not be possible to take corrective action in the implementation of a program that no longer exists. The State is confident that all issuances in the audit period, including those raised by OSA, were issued correctly based on the best information available at the time by the Departments responsible for implementing the P-EBT program. As such and following FNS guidance that no benefits are to be recouped unless the household applied for them directly, OFI will not revisit prior P-EBT decisions as suggested in OSA’s additional recommendation. Contact: Ian Yaffe, Director, Office for Family Independence, DHHS, 207-592-1481 Auditor’s Concluding Remarks: The relationship between OFI and DOE in administering the P-EBT program is outlined in the USDA-approved State plans and the documented agreement in place between the Departments. The agreement states that its purpose is to document the terms and conditions under which DOE will disclose to OFI the education records containing student data. It does not place burden on DOE for administration of the P-EBT program. OFI agreed to “establish procedures and systems to ensure that all confidential data processed, stored, and/or transmitted […] will be maintained in a secure manner” and agreed to “maintain this data as other data used for determining client eligibility and distribution of benefits.” OSA provides the following responses to OFI’s disagreements with the exceptions noted in the Condition of the finding: • For the 22 students where eligibility criteria relating to school status could not be verified, OSA recognizes that DOE data is continually updated throughout the year; however, as outlined in the agreement with DOE, OFI is responsible for maintaining data provided by DOE as P-EBT program data used for determining client eligibility and distribution of benefits. • For the four students where eligibility criteria for free or reduced-price school meals could not be verified, documentation in support of program eligibility and allowability was not maintained by OFI as agreed to by both Departments. Furthermore, 2 CFR 200.403 requires Federal program costs to be adequately documented, including maintenance of records sufficient to determine that such funds have been used in accordance with Federal statutes, regulations, and the terms and conditions of the Federal award. OFI did not maintain sufficient documentation to support P-EBT program eligibility and allowability. Contrary to OFI’s contention, it is not DOE’s inability to regenerate and provide data that results in a 38 percent error rate and questioned costs. Rather, it is the negligence of OFI, as the administering agency, to maintain and provide original documentation in support of P-EBT eligibility and benefit issuances. OFI confirms in their response that they failed to maintain such documentation. Without documentation and evidence to substantiate that the P-EBT benefits issued in connection with those students are in line with P-EBT program eligibility requirements, OSA cannot determine that the benefits are allowable; therefore, OSA continues to question the allowability of these costs. In response to OFI’s disagreement surrounding tracking benefit issuance by child identification number, OFI is misconstruing the reported Condition. OSA agrees with OFI’s statement that child identification numbers are the most reliable way to track and deduplicate benefit issuance; however, as stated in the Condition, OFI issued benefits under a variety of identification numbers. As a result, OFI does not have the ability to properly monitor benefit issuances to ensure that P-EBT benefits are not duplicated. In response to OFI’s disagreement that review, reconciliation, and verification of DOE data should be performed prior to benefit issuance, including OFI’s assertion that access to data that would have been necessary for the type of review and reconciliation proposed is not permitted, the USDA-approved State plan for school year P-EBT benefits outlines that: • DOE will provide OFI with every student’s specific daily learning model and absence status that is eligible for free or reduced-price school meals. OFI will identify students that have excused absences for five consecutive days or more and issue the appropriate P-EBT benefit. • DOE will provide OFI with a list of all students eligible for free or reduced-price school meals for use in a reconciliation process. • Utilizing the data provided by DOE, OFI will verify that students were eligible for free or reduced-price school meals and the absence status the school reported for the child and resolve any discrepancies when processing reconciliation applications. The State plan, FFCRA, and the Departments’ agreement in place allows OFI to receive and access the data that would have been necessary for review, reconciliation, and verification of DOE data and resulting P-EBT eligibility. Existing policies and procedures do not adhere to the terms of the State plan as submitted to and approved by USDA. While OFI is confident that all issuances in the audit period were issued correctly based on the best information available at the time, documentation in support of this assertion was not maintained. The State plan further outlines that OFI “commits to reporting all identified over issuances […] including the number of children affected, the dollar value and the nature of the error. Maine will have the ability to track any detected over issuance of P-EBT benefits. This data will be available in report form for analysis to determine if a claim will be established and pursued.” FNS guidance that states no benefits are to be recouped unless the household applied for them directly does not preclude OFI from taking action to identify and report over issuances to Federal oversight. The finding remains as stated. (State Number: 23-1108-05)

(2023-031) Title: Internal control over SNAP eligibility determinations and benefit calculations needs improvement Prior Year Findings: See schedule of Findings and Questioned Costs for chart/table State Department: Health and Human Services State Bureau: Office for Family Independence Federal Agency: U.S. Department of Agriculture Assistance Listing Title: SNAP Cluster (COVID-19) Assistance Listing Number: 10.551, 10.561 Federal Award Identification Number: See E-93 to E-94 Compliance Area: Allowable costs/cost principles Eligibility Special tests and provisions Type of Finding: Material weakness Material noncompliance Questioned costs Known Questioned Costs: $7,491 Likely Questioned Costs: Undeterminable; incorrectly calculated Supplemental Nutrition Assistance Program (SNAP) benefits may result in overpayments or underpayments to clients. Since there are known overpayments and underpayments in our sample, a projection of questioned costs cannot be reasonably estimated. Criteria: 2 CFR 200.303; 2 CFR 200.403; 7 CFR 272.10; 7 CFR 273.1 and .10; Families First Coronavirus Response Act (Public Law 116-127), Section 2302 The Department must establish and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. To be allowable under Federal awards, costs must be necessary and reasonable for the performance of the Federal award and be adequately documented. All State agencies must sufficiently automate their SNAP operations and computerize their systems for obtaining, maintaining, utilizing and transmitting information concerning SNAP. Individuals or a group of individuals paying a reasonable amount for meals or meals and lodging must be considered boarders and are not eligible to participate in SNAP independently of the household providing the board. State agencies must calculate a household’s expenses based on the expenses the household expects to be billed for during the certification period (12 months). The Families First Coronavirus Response Act (FFCRA) established emergency allotments for households participating in SNAP to provide temporary food needs at the applicable maximum allotment for the household size. Condition: SNAP is administered by the Office for Family Independence (OFI) and provides monthly benefits to eligible households to purchase nutritious foods. OFI is required by Federal program regulations to utilize an automated information system for SNAP. The information system must maintain all casefile information necessary to properly process eligibility determinations and benefit calculations. The Automated Client Eligibility System (ACES) is the information system used by OFI to automate SNAP operations. ACES relies on the maintenance of a complex framework of system rules to make eligibility determinations and related benefit calculations. The Office of the State Auditor (OSA) tested 60 household monthly benefit payments to verify the accuracy of SNAP operations utilizing ACES, and identified the following: • Three underpayments of monthly SNAP benefits totaling $1,242 due to errors by Department personnel while processing manual ACES case file modifications to income information • Four overpayments of monthly SNAP benefits, including: o one benefit overpayment totaling $918 due to income information not updated by the Department in the ACES case file in a timely manner o two benefit overpayments totaling $2,974; an income data exchange with ACES appropriately adjusted income information to the correct prior date in each case file; however, previously issued monthly benefit payments were not recalculated and recovered from households accordingly. o one benefit overpayment totaling $3,599; the client should have been classified as a “boarder” within the household, and therefore, ineligible to participate in SNAP independently of the household providing the board. • One case was identified where household expenses from which benefit amounts were calculated had not been updated since 2018. The Department did not calculate the household’s benefit allotment based on expected annual expenses, in line with the 12-month redetermination period required by SNAP program regulations. The client was paid an accurate total monthly benefit due to the emergency allotment from FFCRA, which provided the maximum benefit amount for this case. OSA selected a non-statistical random sample. The Department does not have adequate policies and procedures in place to ensure that ACES case file modifications, whether manual or system interfaced, that result in adjustments to previously issued monthly SNAP benefits are appropriately processed. This includes a recalculation of previously issued benefits when case file modifications are processed, establishment of corresponding overpayments or underpayments, and related follow-up actions with households. Context: In fiscal year 2023, the State provided approximately 127,000 SNAP clients with $484.8 million in Federal benefits. Cause: • Lack of adequate policies and procedures • Lack of supervisory oversight Effect: • Known questioned costs • Potential future questioned costs and disallowances • Benefits may be incorrectly calculated, resulting in households being underpaid and/or overpaid. • Noncompliance with Federal regulations Recommendation: We recommend that the Department implement additional policies and procedures to ensure that: • case information entered into ACES is accurate; • automated eligibility determinations and benefit calculations are processed in accordance with Federal regulations; and • recalculations of previously issued benefits and related follow-up actions occur when case file modifications are retroactive. Corrective Action Plan: See F-19 Management’s Response: The Department partially agrees with the exceptions noted; however, the Office for Family Independence has policies in place to ensure that information that is entered into ACES is accurate, that automated client eligibility determinations are processed in accordance with federal law and that recalculations of file modifications are retroactive, as applicable. The Department will continue to review its operating procedures to identify opportunities for improvement. Regarding the one case identified where household expenses had not been updated since 2018: The Head of Household (HH) has been receiving the full standard (FSUA) which means the expense deduction has been changing. The client & Department have been updating the medical expense deduction with timely verifications from the client. On the signed Review, the client checked that the above listed expenses were correct and checked the HH had no other shelter expenses other than the ones listed above. These actions are in compliance with 7 CFR 273.10(d)(4). The Department asserts that adequate safeguards are in place. The cost of implementing the recommendations would exceed the benefit realized in achieving 100 percent accuracy in determining eligibility. Contact: Ian Yaffe, Director, Office for Family Independence, DHHS, 207-592-1481 Auditor’s Concluding Remarks: Regarding the one case noted in Management’s Response, the ACES case file does note changes in household medical expenses and Full Standard Utility Allowance (FSUA) values, including confirmation that the expenses were accurate during the household’s most recent annual recertification; however, the household’s monthly rent expense has been documented as “anticipated” and has not changed since 2018. The expenses have never been verified. 7 CFR 273.10 requires anticipated expenses to be based on the most recent month’s bills. At the time of audit testing, the expense information remained unchanged and unverified for approximately five years. For the seven exceptions identified which were not addressed in Management’s Response, existing policies and procedures resulted in inaccurate benefit payments. OSA recognizes that achieving 100 percent accuracy in determining eligibility and calculating benefit payments would likely not be feasible; however, a sample payment error rate of approximately 12 percent indicates that a review of operating procedures and implementation of improvements is necessary. The finding remains as stated. (State Number: 23-1108-02)

(2023-032) Title: Internal control over Medicaid and SNAP deceased client cases needs improvement Prior Year Findings: See schedule of Findings and Questioned Costs for chart/table State Department: Health and Human Services State Bureau: Office for Family Independence Federal Agency: U.S. Department of Agriculture U.S. Department of Health and Human Services Assistance Listing Title: SNAP Cluster (COVID-19) Medicaid Cluster (COVID-19) Assistance Listing Number: 10.551, 10.561; 93.775, 93.777, 93.778 Federal Award Identification Number: See E-93 to E-94 Compliance Area: Allowable costs/cost principles Eligibility Type of Finding: Material weakness Material noncompliance Questioned costs Known Questioned Costs: $8,329 (ALN 10.551) Likely Questioned Costs: Undeterminable; the Office of the State Auditor (OSA) tested a sample of cases where Supplemental Nutrition Assistance Program (SNAP) benefits were issued after the client’s date of death (DOD). Issuance of benefits to a deceased client does not necessarily result in unallowable program costs, as the issued benefits may not be expended; therefore, an error rate cannot be applied to the population and a projection of questioned costs cannot be reasonably estimated. Criteria: 2 CFR 200.303; 2 CFR 200.403; 7 CFR 272.8 and .14 The Department must establish and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. To be allowable under Federal awards, costs must be necessary and reasonable for the performance of the Federal award and be adequately documented. State agency action on information items about recipient households shall include review of information and comparison of it to case record information. State agencies must initiate and pursue actions on recipient households within 45 days of the receipt of the information items. States shall establish a system to verify and ensure that benefits are not issued to individuals who are deceased. States shall use the Social Security Administration’s (SSA) Death Master File, obtained through the State Verification and Exchange System. Condition: The Office for Family Independence (OFI) manages the Automated Client Eligibility System (ACES) that is used to determine eligibility for Federal assistance programs, including Medicaid and SNAP. Information maintained in ACES is relied upon by OFI for determining monthly SNAP benefits issued to client Electronic Benefit Transaction (EBT) cards, and by the Office of MaineCare Services for processing Medicaid claims. OFI relies on numerous data sources for identifying and providing client DOD information for input into ACES, including monthly data exchanges with the Maine Center for Disease Control & Prevention (MeCDC) Vital Records and weekly data reports from the SSA’s Death Master File. Federal program regulations require OFI to act on client cases within 45 days of receipt of DOD information. This includes review and comparison of DOD information to ACES case file information, and suspension of program participation and related benefits as warranted. OFI policies for SNAP require deactivation of the client’s EBT card as well as expungement of authorized benefits from the EBT card. If activity occurred on the client’s EBT card subsequent to the DOD, the case must be reported as potential fraud and referred for investigation. The Office of the State Auditor (OSA) obtained DOD information from MeCDC Vital Records and compared it to clients who received Medicaid and SNAP benefits during fiscal year 2023. OSA identified 95 Medicaid claims with service dates after DOD in fiscal year 2023 and reviewed 30 clients with the largest paid claim amounts. Because certain Medicaid claims with service dates after DOD are considered allowable, claims paid on behalf of the deceased clients noted below are not reported as questioned costs: • Two clients had a DOD recorded in ACES that did not agree to the DOD provided by MeCDC Vital Records. • Two clients did not have a DOD recorded in ACES but were reported as deceased by MeCDC Vital Records. Furthermore, four Medicaid clients with an incorrect DOD identified by OSA during the fiscal year 2022 audit were still not corrected in ACES. OSA identified 671 cases where SNAP benefits were issued more than 52 days following the client’s DOD; this benchmark was applied to denote the 45-day Federal program regulation related to weekly receipt of DOD information. OSA tested 60 of these SNAP cases and identified the following: • 18 single member household clients had EBT card purchase activity after DOD. Of these 18 clients: o 14 clients had transaction activity after DOD that occurred in fiscal year 2023, resulting in unallowable costs totaling $8,329, as follows: • For 13 of the 14 clients, unauthorized transaction activity totaling $7,297 occurred between the actual DOD and the Department’s receipt and processing of the DOD information in ACES. • One of the 14 clients did not have a DOD recorded in their ACES case file at the time of audit testing but was reported as deceased by MeCDC Vital Records; this resulted in $1,032 of unauthorized transaction activity. o Four clients’ DOD occurred in fiscal year 2023 and benefits continued to be authorized and issued; however, the unallowable purchase activity began subsequent to fiscal year 2023. o Four clients were not identified as potential fraud in the ACES case file. As a result, they were not referred for investigation as required by OFI policies. • Five clients had a DOD recorded in ACES that did not agree to the DOD provided by MeCDC Vital Records. This resulted from the Department’s practice of entering DODs as the last day of the month or an alternative date from public information sources in order to suspend benefits in cases where DOD information is not immediately available; however, the Department had MeCDC Vital Records information at the time of DOD input for all five clients and should have entered DODs based on those records. • One client did not have a DOD recorded in their ACES case file but was reported as deceased by MeCDC Vital Records; benefits were authorized during fiscal year 2023, but no unauthorized transaction activity occurred. • 10 clients’ benefits were not expunged upon receipt of DOD information as required by OFI policies; benefits were only expunged by the system-automated process based on inactivity after 274 days. For 2 of the 10 clients, the EBT card was never deactivated; therefore, benefits remained open and available for use 274 days after DOD. • One client’s case remained open two months after OFI was notified of the client’s DOD, resulting in two months of unauthorized SNAP benefit issuances. • Two clients’ ACES case file information partially matched DOD information from MeCDC Vital Records, including names and dates of birth; however, the client social security numbers did not match. The Department did not review the cases to determine appropriate follow-up action. OSA selected a non-statistical random sample. Context: In fiscal year 2023, the State provided approximately: • 575,000 Medicaid clients with $2.5 billion in Federal benefits. Of the 575,000 Medicaid clients, 9,826 had a DOD in fiscal year 2023. • 127,000 SNAP clients with $484.8 million in Federal benefits. Of the 127,000 SNAP clients, 2,021 had a DOD in fiscal year 2023. Cause: • Lack of adequate policies and procedures • Lack of supervisory oversight Effect: • Medicaid claims paid on behalf of deceased clients may go undetected. • SNAP benefits issued to deceased clients may result in unauthorized EBT card purchase activity. • Known questioned costs for SNAP • Potential future questioned costs and disallowances • Noncompliance with Federal regulations Recommendation: We recommend that the Department enhance policies and procedures to ensure that DOD information is received, reviewed, and updated in ACES on a more frequent basis to prevent unallowable Medicaid claim payments, and unauthorized SNAP benefit issuances and EBT card purchase activity. In addition, we recommend that the Department review all client cases noted in the Condition of this finding to ensure that: • ACES case file DOD information is accurate; • SNAP benefits are expunged and EBT cards are deactivated in accordance with existing policies; • cases are identified as potential fraud and referred for investigation as warranted; and • unallowable costs are identified and reported to Federal oversight agencies, and required recoupment activities are pursued. Corrective Action Plan: See F-19 Management’s Response: The Department agrees with this finding and will review the current SOP governing DOD procedures and will implement enhancements to ensure DOD is updated and that related required actions are taken within allowable timeframes. Contact: Ian Yaffe, Director, Office for Family Independence, DHHS, 207-592-1481 (State Number: 23-1108-04)

(2023-033) Title: Internal control over automated SNAP eligibility certification periods needs improvement Prior Year Findings: None State Department: Health and Human Services State Bureau: Office for Family Independence Federal Agency: U.S. Department of Agriculture Assistance Listing Title: SNAP Cluster (COVID-19) Assistance Listing Number: 10.551, 10.561 Federal Award Identification Number: See E-93 to E-94 Compliance Area: Allowable costs/cost principles Eligibility Special tests and provisions Type of Finding: Material weakness Material noncompliance Questioned costs Known Questioned Costs: $18,090 Likely Questioned Costs: Undeterminable; incorrectly suspending Supplemental Nutrition Assistance Program (SNAP) benefits may result in overpayments or underpayments to households. Since there are known overpayments and underpayments in our sample, a projection of questioned costs cannot be reasonably estimated. Criteria: 2 CFR 200.303; 2 CFR 200.403; 7 CFR 272.10; 7 CFR 273.10 and .12 The Department must establish and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. To be allowable under Federal awards, costs must be necessary and reasonable for the performance of the Federal award and be adequately documented. All State agencies must sufficiently automate their SNAP operations and computerize their systems for obtaining, maintaining, utilizing and transmitting information concerning SNAP, which includes automatic cutoff of participation for households which have not been recertified at the end of their certification period. SNAP households must be assigned eligibility certification periods of at least six months unless the household is classified as exempt based on program regulations. The State agency must have at least one contact with each SNAP household every 12 months. Submission of periodic eligibility reports is required by non-exempt households. Non-exempt households that are certified for longer than six months must file a periodic report between four months and six months, as required by the State agency. In addition, the State agency must not require the submission of periodic reports by households certified for 12 months or less in which all adult members are elderly or have a disability and no earned income. Condition: SNAP is administered by the Office for Family Independence (OFI) and provides monthly benefits to eligible households to purchase nutritious foods. OFI is required by Federal program regulations to utilize an automated information system for SNAP. The information system must maintain all case file information necessary to properly process eligibility determinations and benefit computations. The Automated Client Eligibility System (ACES) is the information system used by OFI to automate SNAP operations. ACES relies on the maintenance of a complex framework of system rules to make eligibility determinations, including notification letters to clients when 6-month reports and 12-month redeterminations of eligibility are required. All SNAP households, except for elderly and disabled cases with no earned income, are required to submit 6-month reports. In addition, all SNAP households must undergo an annual redetermination of eligibility. Each household’s recertification requirements are indicated by date fields in the ACES case file. If a required report or redetermination is not completed by the date indicated in the applicable field, the case’s monthly SNAP benefit is automatically suspended by the system. The Office of the State Auditor (OSA) tested a sample of 60 cases automatically suspended for failure to complete a required review in fiscal year 2023 to verify the accuracy of automated SNAP operations utilizing ACES. In 23 of the 60 cases tested, OSA identified that ACES incorrectly suspended benefits, as follows: • 20 cases were suspended due to inaccurate information in the applicable ACES date field. The Department identified the issue within ACES and implemented a system reconfiguration to correct review dates; however, the reconfiguration did not account for SNAP 6-month report and annual redetermination requirements. Of the 20 suspensions: o seven cases continued to receive SNAP benefits after a failure to complete required 6-month reports. This resulted in the following benefit overpayments, none of which were identified by the Department: • Two cases were suspended three months after the 6-month reporting requirement, resulting in known overpayments of $959 and $2,410. • Two cases were suspended four months after the 6-month reporting requirement, resulting in known overpayments of $1,597 and $525. • Three cases were suspended five months after the 6-month reporting requirement, resulting in known overpayments of $2,941, $2,376, and $1,818. o six cases were underpaid SNAP benefits totaling $5,941 because of incorrect benefit suspensions, ranging from one to five months prior to the applicable 6-month reporting requirement. o five cases were underpaid SNAP benefits totaling $2,194 because of incorrect benefit suspensions, ranging from 2 to 11 months prior to the annual redetermination requirement. o two cases were never required to submit 6-month reports or annual redeterminations since commencement of SNAP benefits in May 2021 and August 2021. This resulted in overpayments for the entirety of fiscal year 2023 totaling $2,539 and $2,925, respectively. • Three cases were suspended due to inaccurate information in the ACES case file indicating that required reviews were not completed. One case never received an automated ACES notification letter alerting them to complete the required 6-month report because of the system reconfiguration previously noted, and as a result, benefits were suspended. Two cases required annual redetermination information, which was submitted to the Department prior to the benefit suspension date, but benefits ended or lapsed due to untimely or incomplete review by the Department. OSA selected a non-statistical random sample. Context: In fiscal year 2023, the State provided approximately 127,000 SNAP clients with $484.8 million in Federal benefits. 469 clients were automatically suspended by ACES during fiscal year 2023 due to recertification or redetermination requirements. Cause: • Lack of adequate policies and procedures • Lack of supervisory oversight • Automated SNAP eligibility system recertification and suspension criteria was not configured in accordance with Federal regulations. Effect: • Known questioned costs • Potential future questioned costs and disallowances • Noncompliance with Federal regulations • Benefits may be incorrectly suspended, resulting in households being underpaid or overpaid. Recommendation: We recommend that the Department enhance policies and procedures to ensure that automated SNAP eligibility certification periods and related ACES case file fields are properly configured to process benefits in accordance with Federal regulations. In addition, we recommend that the Department identify underpayments and/or overpayments resulting from recertification period errors and take action as warranted. Corrective Action Plan: See F-19 Management’s Response: The Department agrees with the exceptions as noted and has previously taken the necessary steps to eliminate these issues. Contact: Ian Yaffe, Director, Office for Family Independence, DHHS, 207-592-1481 (State Number: 23-1108-03)

(2023-034) Confidential finding, see below for more information Title: ________ over ________ and ________ needs improvement Pursuant to paragraph 6.63 of the U.S. Government Accountability Office’s Government Auditing Standards (also known as the Yellow Book), we omitted details from this finding as they are confidential under the provisions of 5 MRSA 244-C (3). Though the content of this finding has been redacted, we provided the Department(s) with detailed information regarding the specific condition we identified, as well as the related criteria, context, causes, effects, and our specific recommendations for improvement. Prior Year Findings: See schedule of Findings and Questioned Costs for chart/table Type of Finding: Significant deficiency Questioned costs Corrective Action Plan: See F-19 Contact: Shirley Browne, Deputy State Controller, Office of the State Controller, 207-626-8423 (State Number: 23-0905-05)

(2023-035) Title: Internal control over SNAP EBT card security needs improvement Prior Year Findings: See schedule of Findings and Questioned Costs for chart/table State Department: Health and Human Services State Bureau: Office for Family Independence Federal Agency: U.S. Department of Agriculture Assistance Listing Title: SNAP Cluster (COVID-19) Assistance Listing Number: 10.551, 10.561 Federal Award Identification Number: See E-93 to E-94 Compliance Area: Special tests and provisions Type of Finding: Significant deficiency Questioned Costs: None Criteria: 2 CFR 200.303; 7 CFR 274.5 The Department must establish and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. The State is required to provide the following minimum security and control procedures for EBT cards: secure storage; access limited to authorized personnel; inventory control records; and a periodic review and validation of inventory controls and records by parties not otherwise involved in maintaining control records. Issuance, inventory, reconciliation, and other accountability records must be maintained for a period of three years. Condition: The Supplemental Nutrition Assistance Program (SNAP) provides monthly benefits to eligible households to purchase nutritious foods. The program utilizes Electronic Benefit Transfer (EBT) cards as the mechanism to provide benefits. SNAP benefit information is transmitted to the Electronic Payment Processing and Information Control (EPPIC) system used for EBT. An EBT card is issued using the EPPIC system and mailed to the client’s mailing address. EBT cards that are undeliverable are returned to the regional Department of Health and Human Services office for processing. Upon receipt of a returned EBT card, the Automated Client Eligibility System (ACES) is used to verify a client’s personal information, determine what action to take based on case file information, and document the action through electronic case notes. The Department has assigned responsibility for processing returned EBT cards to one employee. This process includes receipt of returned cards, maintenance of inventory control records including supporting documentation in ACES and EPPIC, and destruction or retransmission of the card. Proper segregation of duties does not exist within the current process, as recordkeeping, custody of EBT cards, and authorization of processing activity should be assigned to different employees. In addition, the State is required to maintain accurate and complete inventory records for returned EBT cards. Returned cards are either destroyed or retransmitted, and are tracked using spreadsheets and related documentation through client case notes in ACES and EBT card activity in the EPPIC system. The Office of the State Auditor (OSA) tested a sample of 60 returned EBT cards to verify the accuracy and completeness of the activity recorded on the inventory tracking spreadsheets, and identified: • one returned EBT card that should have been retransmitted to an updated address was erroneously processed for destruction; • one returned EBT card with a case note documenting an unknown card location and an assumption that the card was erroneously destroyed, so a new card was retransmitted without confirmation of the destruction; • one returned EBT card where processing activity was not documented in a case note until eight months after retransmission; and • one returned EBT card which was recorded on the tracking spreadsheet as retransmitted to an updated address, but no documentation was maintained in the client case file to support that a new address was obtained. OSA selected a non-statistical random sample. A data analysis and cross-match of the inventory tracking spreadsheets identified: • one returned EBT card was erroneously recorded on the destruction spreadsheet twice; and • eight returned EBT cards were processed utilizing inaccurate client information; multiple client names were tied to the same client identification number on the spreadsheets. Quarterly, management monitors the inventory tracking spreadsheets by selecting a sample of returned EBT cards for review; however, this oversight procedure does not detect and correct processing errors on a timely basis. Furthermore, the State is required to maintain secure storage of, and limited access to, EBT cards. The current process does not require proper physical security over returned EBT cards as the returned cards are placed in an open mailbox during processing. While the mailbox is in a secure area of the facility, any employee working within the regional office has access to this mailbox. Existing policies and procedures in place do not provide adequate security over returned EBT cards, including proper segregation of duties, maintenance of accurate and complete inventory control records, and appropriate physical security controls over EBT cards. Context: In fiscal year 2023, the State provided approximately 127,000 SNAP clients with $484.8 million in Federal benefits. The Department processed 2,447 returned EBT cards; 1,013 were recorded as retransmitted and 1,434 were recorded as destroyed. Cause: • Lack of segregation of duties • Lack of adequate policies and procedures relating to the security and oversight of returned EBT cards Effect: • Potential unauthorized use of EBT cards, which may lead to unallowable costs • Noncompliance with Federal regulations Recommendation: We recommend that the Department enhance policies and procedures to require adequate security and oversight of returned EBT cards, including proper segregation of duties within the process, maintenance of accurate and complete inventory control records, and increased physical security controls. Corrective Action Plan: See F-20 Management’s Response: Although the Department agrees that errors were identified, these data entry errors were clerical in nature, and do not impact the security of our returned EBT cards. The Standard Operating Procedure for processing returned EBT cards does segregate duties sufficiently. First, all returned cards are received by District Operations in the Lewiston Regional Office, and they are distributed to a separate resource for processing. Second, a clerical resource in the Lewiston office reviews the case to determine the appropriate course of action, and then subsequently takes and logs that action (in spreadsheets and in ACES). Third, the EBT manager performs quality checks on the logs to ensure the proper handling of the cards/cases. Contact: Ian Yaffe, Director, Office for Family Independence, DHHS, 207-592-1481 Auditor’s Concluding Remarks: While OSA recognizes that some of the exceptions noted in the Condition are clerical in nature, instances of unknown card locations, inaccurate processing activity, and untimely or incomplete documentation were also identified. The current procedure does not segregate duties sufficiently. First, inventory control records are not initiated upon receipt by District Operations prior to placement in an unsecured mailbox for processing. Second, as identified in Management’s Response as the clerical resource, the same employee maintains custody of returned EBT cards, determines and authorizes the course of action, has responsibility for inventory control records, and proceeds with physical destruction or retransmission of cards; therefore, there is no segregation between recordkeeping, custody, and authorization of processing activity. The subsequent performance of quality checks by the EBT manager only covers a sample of returned cards and occurs on a quarterly basis. This does not provide segregation of duties within the process. The finding remains as stated. (State Number: 23-1108-01)

(2023-036) Confidential finding, see below for more information Title: ________ over the ________ needs improvement Pursuant to paragraph 6.63 of the U.S. Government Accountability Office’s Government Auditing Standards (also known as the Yellow Book), we omitted details from this finding as they are confidential under the provisions of 5 MRSA 244-C (3). Though the content of this finding has been redacted, we provided the Department(s) with detailed information regarding the specific condition we identified, as well as the related criteria, context, causes, effects, and our specific recommendations for improvement. Prior Year Findings: See schedule of Findings and Questioned Costs for chart/table Type of Finding: Significant deficiency Corrective Action Plan: See F-20 Contact: Shirley Browne, Deputy State Controller, Office of the State Controller, 207-626-8423 (State Number: 23-0905-04)

(2023-037) Title: Internal control over CNC special reporting needs improvement Prior Year Findings: See schedule of Findings and Questioned Costs for chart/table State Department: Education State Bureau: Commissioner’s Office Child Nutrition Services Federal Agency: U.S. Department of Agriculture Assistance Listing Title: Child Nutrition Cluster Assistance Listing Number: 10.553, 10.555, 10.556, 10.559, 10.582 Federal Award Identification Number: See E-93 to E-94 Compliance Area: Reporting Type of Finding: Material weakness Material noncompliance Questioned Costs: None Criteria: 2 CFR 200.303; 2 CFR 170 The Department must establish and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. Agencies must report each subaward that equals or exceeds the first-tier subaward threshold of $30,000 in Federal funds in the public-facing Federal Funding Accountability and Transparency Act (FFATA) Subaward Reporting System (FSRS). Condition: When an amount exceeding the first-tier subaward threshold is awarded to a subrecipient, the Department must collect and enter data into FSRS. The Department did not report any of its first-tier subawards under the Child Nutrition Cluster (CNC) in FSRS for fiscal year 2023. Context: In fiscal year 2023, the Department was required to report first-tier subawards totaling approximately $70 million under CNC. First-tier subawards account for 88 percent of the program’s fiscal year 2023 expenditures. Cause: Lack of policies and procedures Effect: • Noncompliance with Federal regulations • First-tier subaward information for CNC was not reported to the Federal government. This information may be used for programmatic, policy, or statistical purposes. Recommendation: The Department developed and implemented policies and procedures beginning July 1, 2023; therefore, we recommend that the Department monitor these newly established policies and procedures to ensure that they have been properly implemented. This will ensure subawards meeting or exceeding the first-tier threshold are reported accurately, timely, and in accordance with Federal regulations. Corrective Action Plan: See F-20 Management’s Response: The Department agrees with this finding. The existing procedure for monitoring FFATA reporting now includes Child Nutrition Awards as of 7/1/23. Contact: Nicole Denis, Director of Finance, DOE, 207-530-2161 (State Number: 23-1203-01)

(2023-038) Title: Internal control over CNC claim reimbursements needs improvement Prior Year Findings: See schedule of Findings and Questioned Costs for chart/table State Department: Education State Bureau: Child Nutrition Services Federal Agency: U.S. Department of Agriculture Assistance Listing Title: Child Nutrition Cluster Assistance Listing Number: 10.553, 10.555, 10.556, 10.559, 10.582 Federal Award Identification Number: See E-93 to E-94 Compliance Area: Allowable costs/cost principles Type of Finding: Material weakness Questioned Costs: None Criteria: 2 CFR 200.303; 2 CFR 200.403; 7 CFR 210.7 and .8; 7 CFR 225.15; Richard B. Russell National School Lunch Act Sec. 19; U.S. Department of Agriculture Fresh Fruit and Vegetable Program Handbook; Policy Memo: COVID-19: Child Nutrition Response #114 The Department must establish and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. To be allowable under Federal awards, costs must be necessary and reasonable for the performance of the Federal award and adequately documented. Claims for reimbursement must be based on lunch counts taken daily at the point of service, which correctly identify the number of free, reduced price, and paid lunches served to eligible children. The Department is required to review each School Food Authority’s (SFA) claim for reimbursement, on a monthly basis, to ensure that monthly claims are limited to the number of lunches served to eligible children. The Department then reimburses the SFA for actual meals served, based on the SFA’s claim for reimbursement utilizing rates that are programmed in the system. In accordance with 7 CFR 225.15, second meals must be served only after all participating children at the site's congregate meal service have been served a meal. Section 19 of the Richard B. Russell National School Lunch Act (NSLA) states that the per-student grant provided to a school under the Fresh Fruit and Vegetable Program (FFVP) shall not be less than $50, nor more than $75. U.S. Department of Agriculture’s (USDA) FFVP Handbook, referenced as guidance in Policy Memo SP 12-2022, states that all nonfood costs must be carefully reviewed and deemed reasonable. Policy Memo: Child Nutrition Response 114 for the Summer Food Service Program (SFSP) states that sponsors may only claim reimbursement for meals served retroactive to the date that a complete and correct application was received at the State agency, including meals that were served prior to their written approval to operate SFSP. This waiver from 7 CFR 225.9 states that all reimbursements shall be in accordance with the terms of this agreement. Reimbursements shall not be paid for meals served at a site before the sponsor has received written notification that the site has been approved for participation in the program. Condition: The Child Nutrition Cluster (CNC) includes the School Breakfast Program, National School Lunch Program (NSLP), Special Milk Program for Children, SFSP and FFVP. The objectives of the programs are to provide nutritious meals to eligible children in schools, residential childcare institutions, and summer food programs; to foster healthy eating habits by providing fresh fruits and vegetables to children attending elementary schools; and to encourage the consumption of nutritious agriculture commodities. The Department of Education (DOE) is responsible for the administration of child nutrition programs for the State. DOE provides benefits to each SFA or sponsor on a reimbursement basis. SFAs and sponsors must submit claims for reimbursement based on actual meals served for the month and permissible fresh fruits and vegetables, utilizing the Child Nutrition Program (CNPWeb) system. The Department is required to review each SFA or sponsor’s claim for reimbursement to ensure that monthly claims are limited to the number of meals served to eligible children and that the cost of the fresh fruits and vegetables are allowable. Once the claims are approved, claims are reimbursed based on the rates that are programmed in the CNPWeb system. The Office of the State Auditor (OSA) tested claims for reimbursement (CFR) for CNC and found instances that did not align with program regulations for NSLP, FFVP, and SFSP, as follows: National School Lunch Program If there are revisions to claims after 60 days which increase the Federal reimbursement, Child Nutrition Services (CNS) is permitted to grant an exception once every 36 months. OSA tested 60 paid CFRs in NSLP and found one SFA’s CFR included two revisions that were more than 60 days after the last day of the claim month. The first revision submitted was not documented as an exception; as a result, the second revision submitted in excess of 60 days was erroneously processed. Fresh Fruit and Vegetable Program USDA guidance included in the FFVP Handbook states that most of a SFA’s FFVP funds must be used for purchasing fresh fruits and vegetables, all nonfood costs must be carefully reviewed and deemed reasonable, and that labor costs must be minimal. FFVP allocations must be determined at the State agency and result in a per-pupil allocation between $50 and $75 for participating SFAs. OSA tested 60 FFVP CFRs and found: • claims from 11 SFAs totaling $51,927 had sites with significant nonfood costs. o Six SFA’s CFRs included costs totaling $12,506; of this amount, fresh fruits and vegetables were less than 50 percent of the entire claim. o One SFA’s CFR included labor costs of $1,599 for two sites where no fresh fruits or vegetables were claimed. • CNS adjusted allocations to two SFAs, but after the adjustment, the SFAs exceeded the $75 maximum per-pupil allocation. OSA tested 20 SFAs that participated in FFVP and found that three exceeded their original allocation: • Two SFAs were provided additional funds as a result of a reallocation by CNS; however, the additional allocation resulted in per-pupil amounts that exceeded the maximum amount of $75. • One SFA overspent by $893 due to a claim system processing error. Summer Food Service Program SFSP allows sponsors to claim a percentage of second meals served after first meals have been served. SFSP reimbursement for second meals is dependent upon a sponsor’s total first meals claimed. In July 2022, USDA issued Child Nutrition Response 114 to waive certain application requirements to accommodate for changes made once the program year had begun. The policy memo states that sponsors may only claim reimbursement for meals served retroactively to the date that a complete and correct application was received by the State agency. Applications from sponsors include individual site sheets that specify mealtimes and operating days as part of the sponsor’s application; revisions to the site sheet affect both the completeness and accuracy of the application. OSA tested 44 SFSP CFRs and found: • one site claimed only second meals; no first meals had been claimed. • seven sponsors had approved site sheet revisions and retroactive adjustments; however, CNS did not document the date the revisions were initiated. The revisions included addition of meal types, new sites and days of operation. CNS did not document the reason for the revisions or the date of receipt. OSA selected non-statistical random samples. Context: CNC processed $69.9 million in CFRs in fiscal year 2023. Cause: • Lack of adequate policies and procedures • Lack of supervisory oversight Effect: • Potential questioned costs and disallowances • Noncompliance with Federal regulations Recommendation: We recommend that the Department enhance policies and procedures to ensure: • CFRs revised after 60 days and granted a one-time exception are tracked; • CFRs for all SFAs participating in the FFVP are reviewed to confirm that the amounts claimed for nonfood costs are reasonable and labor costs are minimal; • SFAs that are provided additional FFVP funds are reviewed prior to reallocation to verify that SFAs will not be in excess of the allowed per-pupil limit; and • revisions to SFSP applications, including site sheets, are properly documented. Corrective Action Plan: See F-20 Management’s Response: The Department agrees to the one-time exception and application documentation elements of this finding. We have created new procedures to ensure these areas are corrected. The Department disagrees with the recommendation to increase oversight in the FFVP as it aligns with USDA and Department of Education policies and procedures. CFRs for all SFAs participating in FFVP are reviewed to confirm that the amounts claimed for non-food costs are reasonable and labor costs are minimal. The USDA Fresh Fruit and Vegetable Program (FFVP) is a program that is monitored at the same time as the other Child Nutrition Programs, including NSLP and SBP. The administrative review process is conducted on an approved timeline set by the USDA, who administers all of the Child Nutrition Programs. Reviewing one month's claim for reimbursement (referred to as the "Review Period") follows federal requirements and is the NSLP review teams procedure for each review. This includes verifying meal counts for breakfast, lunch, and snack (if applicable) as well as FFVP expenses, if applicable. FFVP claims are reviewed to ensure that only allowable costs are being claimed. This includes food, labor and other costs, which non-food cost is a part of. There is also an edit check in the CNP web reimbursement system so that schools do not exceed the 10% administrative labor amount per grant award. Child Nutrition staff does not verify the meal counts for every claim for reimbursement that is submitted to us on a monthly basis for over 200 SFA's; therefore, having to do this for FFVP is unreasonable and would create a hardship for staff overseeing this program. The monitoring and edit check systems we have in place for FFVP allow for sufficient oversight of the program, including non-food and labor costs, and align with USDA and Department of Education policies and procedures. SFAs that are provided additional FFVP funds are reviewed prior to reallocation to verify that SFAs will not be in excess of the allowed per-pupil limit. Based on the NSLA Sec. 19, (f) Per-Student Grant- the per student grant provided to a school under this section shall be (2) not less than $50.00, nor more than $75.00; however under (i)Funding (7) Reallocation, (B) Within States- A State that receives a grant under this section may reallocate any amounts made available under the grant that are not obligated or expended by a date determined by the Secretary. Our interpretation is that any amounts can be reallocated after the initial grant award is given. Allocating above the $75.00/student would allow us to maximize use of federal funds and is in line with the language of the NSLA Sec. 19. We have schools each year that spend more than they were awarded and some that underspend their funds. Imposing this restriction would negatively impact schools that are using their funds as they may have to decrease the number of serving days or stop the program altogether prior to the end of the school year, thus negatively impacting students who benefit from this program. Contact: Adriane Ackroyd, Assistant Director Child Nutrition, DOE, 207-592-1722 Auditor’s Concluding Remarks: The USDA FFVP handbook outlines requirements for program oversight. These oversight procedures require states to review FFVP CFRs submitted by participating schools to ensure that expenditures are appropriate prior to providing reimbursement. The review process should ensure that the “majority of funds are used to purchase fresh produce” and “labor costs and all other non-food costs are minimal.” OSA’s testing of FFVP claims for reimbursement identified SFAs that had significant nonfood costs. The SFAs selected for testing submitted and were reimbursed for 31 different sites with nonfood costs ranging from 22 to 100 percent of the CFR. The Department did not provide justification to document the nonfood costs, including the site that claimed 100 percent for nonfood. Furthermore, the Department cites the annual monitoring review process as a mechanism to ensure CFRs for non-food costs are reasonable and labor costs are minimal; however, this process occurs after reimbursement is provided, not prior to reimbursement as required. In addition, OSA audit procedures over subrecipient monitoring reported finding 2023-043 Internal control over CNC subrecipient monitoring procedures needs improvement which identified an exception related to the documentation of FFVP program receipts. Accordingly, OSA recommends that the Department increase oversight over the program to ensure that CFRs are reviewed prior to reimbursement to confirm that the amounts claimed for nonfood costs are reasonable and labor costs are minimal as required by USDA. While NSLA Section 19(i)(7)(b) does outline that the State “may reallocate any amounts made available under the grant that are not obligated or expended by a date determined by the Secretary,” it does not override NSLA Section 19(f)(2) that specifies that the “per-student grant provided to a school under this section shall be not less than $50, nor more than $75.” The use of “under this section” in NSLA Section 19(f)(2) pertains to all of Section 19, including reallocations. As a result, OSA continues to recommend that the Department enhance policies and procedures to ensure SFAs that are provided additional FFVP funds are reviewed prior to reallocation to verify that SFAs will not be in excess of the allowed per-pupil limit. The finding remains as stated. (State Number: 23-1203-04)

(2023-039) Confidential finding, see below for more information Title: ________ over ________, ________, and ________ needs improvement Pursuant to paragraph 6.63 of the U.S. Government Accountability Office’s Government Auditing Standards (also known as the Yellow Book), we omitted details from this finding as they are confidential under the provisions of 5 MRSA 244-C (3). Though the content of this finding has been redacted, we provided the Department(s) with detailed information regarding the specific condition we identified, as well as the related criteria, context, causes, effects, and our specific recommendations for improvement. Prior Year Findings: See schedule of Findings and Questioned Costs for chart/table Type of Finding: Material weakness Corrective Action Plan: See F-21 Contact: Shirley Browne, Deputy State Controller, Office of the State Controller, 207-626-8423 (State Number: 23-0909-04)

(2023-040) Confidential finding, see below for more information Title: ________ over ________ and ________ needs improvement Pursuant to paragraph 6.63 of the U.S. Government Accountability Office’s Government Auditing Standards (also known as the Yellow Book), we omitted details from this finding as they are confidential under the provisions of 5 MRSA 244-C (3). Though the content of this finding has been redacted, we provided the Department(s) with detailed information regarding the specific condition we identified, as well as the related criteria, context, causes, effects, and our specific recommendations for improvement. Prior Year Findings: See schedule of Findings and Questioned Costs for chart/table Type of Finding: Material weakness Corrective Action Plan: See F-21 Contact: Shirley Browne, Deputy State Controller, Office of the State Controller, 207-626-8423 (State Number: 23-0909-07)

(2023-041) Title: Internal control over the submission of CNC Schedule of Expenditures of Federal Awards information needs improvement Prior Year Findings: See schedule of Findings and Questioned Costs for chart/table State Department: Education State Bureau: Child Nutrition Services Federal Agency: U.S. Department of Agriculture Assistance Listing Title: Child Nutrition Cluster Assistance Listing Number: 10.553, 10.555, 10.556, 10.559, 10.582 Federal Award Identification Number: See E-93 to E-94 Compliance Area: Reporting Type of Finding: Significant deficiency Questioned Costs: None Criteria: 2 CFR 200.303; 2 CFR 200.502 and .510; 7 CFR 250.58(e); U.S. Department of Agriculture Policy No. FD-104 The Department must establish and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. The Department must prepare a Schedule of Expenditures of Federal Awards (SEFA) for the period covered by the State’s financial statements which must include the total Federal awards expended, including distribution or use of food commodities. Federal non-cash assistance, such as food commodities must be valued at fair market value at the time of receipt or the assessed value provided by the Federal agency. For a cluster of programs, the SEFA must list individual Federal programs within the cluster. In meeting the commodity offer value of donated foods for the school food authority, the distributing agency must use the cost-per-pound donated food price posted annually by the U.S. Department of Agriculture (USDA), the most recently published cost-per-pound price in the USDA donated foods catalog, and/or a rolling average of the USDA prices. Each distributing or recipient agency must choose a method of valuing USDA donated foods for audit purposes. In most cases, it is recommended that a distributing or recipient agency use one of the options listed in 7 CFR 250.58(e). Once a method of assigning value to USDA donated foods is selected, it must be used consistently in all its audit activities and the State must maintain a record of the means of valuing donated foods for such purposes. Condition: The Department must complete and submit exhibits and related schedules to the Office of the State Controller (OSC) at the close of each fiscal year to report Federal award information for inclusion on the State’s SEFA. OSC is responsible for compiling this information on behalf of the State. The Department submitted exhibits to OSC that: • incorrectly excluded $2.4 million of fresh food distributed to subrecipients and additional commodity items received. • incorrectly reported $1,417 of expenditures under ALN 10.555 National School Lunch Program that should have been reported under ALN 10.556 Special Milk Program. Context: In fiscal year 2023, noncash assistance totaling $2.4 million was not reported to OSC by the Department for inclusion on the SEFA. Noncash assistance for the Child Nutrition Cluster totaled $8.5 million in fiscal year 2023. Cause: • Lack of adequate policies and procedures • Lack of supervisory oversight Effect: Inaccurate reporting of expenditure amounts on the SEFA, which is submitted to the Federal government, may result in incorrect information used for programmatic, policy, or statistical purposes. Recommendation: We recommend that the Department implement policies and procedures that: • outline the method of valuing USDA donated foods in accordance with Federal regulations. • require a comprehensive review of SEFA schedules prior to submission to OSC. In addition, we recommend enhanced oversight over policies and procedures to ensure they are consistently applied and the SEFA is accurate and complete. Corrective Action Plan: See F-21 Management’s Response: The Department agrees with this finding. The child nutrition department will create a procedure for reporting the SEFA numbers to DOE Finance. Contact: Jane McLucas, Director of Child Nutrition, DOE, 207-624-6880 (State Number: 23-1203-02)

(2023-042) Title: Internal control over CNC donated food inventory needs improvement Prior Year Findings: See schedule of Findings and Questioned Costs for chart/table State Department: Education State Bureau: Child Nutrition Services Federal Agency: U.S. Department of Agriculture Assistance Listing Title: Child Nutrition Cluster Assistance Listing Number: 10.553, 10.555, 10.556, 10.559, 10.582 Federal Award Identification Number: See E-93 to E-94 Compliance Area: Special tests and provisions Type of Finding: Significant deficiency Questioned Costs: None Criteria: 2 CFR 200.303; 7 CFR 250.12 and .19 The Department must establish and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. On an annual basis, the distributing agency must conduct a physical review of donated food inventories at all storage facilities used by the distributing agency and must reconcile physical and book inventories of donated foods. The distributing agency must ensure that a separate inventory record of donated foods is maintained. The distributing agency’s system of inventory management must ensure that donated foods are distributed in a timely manner and in optimal condition. Condition: The Child Nutrition Cluster includes the School Breakfast Program, National School Lunch Program, Special Milk Program for Children, Summer Food Service Program for Children, and the Fresh Fruit and Vegetable Program. The objectives of the programs are to provide nutritious meals to eligible children in schools and summer food programs, to foster healthy eating habits by providing fresh fruits and vegetables to children attending elementary schools, and to encourage consumption of nutritious agriculture commodities. The Department receives donated foods from the U.S. Department of Agriculture (USDA) for distribution to School Food Authorities (SFAs). In fiscal year 2022, the Department implemented a new inventory system for tracking donated foods. The Office of the State Auditor (OSA) tested 10 donated food items to ensure that the Department had properly tracked the items. OSA reviewed USDA food requests, inventory receipts, and distributions made to SFAs to verify that the documentation corresponded to information in the inventory system and physical inventory counts. OSA identified the following two instances where the records did not agree: • For one food item, system inventory records identified 52 cases more than OSA calculated, and the physical inventory count indicated 41 cases less than the system inventory records. • For the other food item, system inventory records identified nine cases less than OSA calculated, and the physical inventory count indicated 17 cases more than the system inventory records. In addition, for nine of the food items tested, system inventory records did not align with the physical inventory count; variances ranged from 2 to 41 cases. The Department did not document justification for the inventory discrepancies. OSA selected a non-statistical random sample. OSA performed a physical inventory inspection of all items that remained in inventory on the inspection date and identified that discrepancies existed between the system inventory items and the physical items on hand for 37 of the 41 food items tested. The Department did not document justification for the inventory discrepancies. Context: In fiscal year 2023, the Department distributed approximately $8.5 million of USDA donated foods to SFAs. Cause: Lack of oversight to ensure that: • the newly implemented inventory system is properly configured; and • review, remediation and justification of inventory discrepancies is documented Effect: • Noncompliance with Federal regulations • Inaccurate reporting of noncash Federal awards on the Schedule of Expenditures of Federal Awards • Theft, loss, or damage of inventory may go undetected. Recommendation: We recommend that the Department: • review the configuration of the inventory system to remediate variances, • regularly reconcile system inventory records to physical inventory counts, and • document the justification of any inventory discrepancies. Corrective Action Plan: See F-22 Management’s Response: The Department agrees with this finding. The error was found to be a ticketing issue in CNPWeb, and a ticket was issued to remediate the problem. Staff will continue to provide paper back-up until the computer system is found to be reliable. Contact: Jane McLucas, Director of Child Nutrition, DOE, 207-624-6880 (State Number: 23-1203-05)

(2023-043) Title: Internal control over CNC subrecipient monitoring procedures needs improvement Prior Year Findings: None State Department: Education State Bureau: Child Nutrition Services Federal Agency: U.S. Department of Agriculture Assistance Listing Title: Child Nutrition Cluster Assistance Listing Number: 10.553, 10.555, 10.556, 10.559, 10.582 Federal Award Identification Number: See E-93 to E-94 Compliance Area: Subrecipient monitoring Type of Finding: Significant deficiency Questioned Costs: None Criteria: 2 CFR 200.303; 2 CFR 200.332; 7 CFR 210.18; 7 CFR 225.7; U.S. Department of Agriculture Policy Memo SP 46-2015 The Department must establish and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. The Department must monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. The Department must conduct administrative reviews of School Food Authorities (SFAs) participating in the National School Lunch Program (NSLP) and the School Breakfast Program (SBP). These procedures must also be followed, as applicable, to conduct administrative reviews of the afterschool snacks, Special Milk Program (SMP) and the Fresh Fruit and Vegetable Program (FFVP). The Department must review sponsors to ensure compliance with Summer Food Service Program (SFSP) regulations. The Department is required to conduct a review of base year certification and benefit issuance documentation for any SFA requesting approval to participate in NSLP or SBP using U.S. Department of Agriculture (USDA) Special Provision 2, which is a provision established to reduce application burdens and simplify claim procedures. The review must occur at some point during the base year. If errors are identified as a result of the review, the Department must adjust all of the SFA’s closed claims that occurred in the current school year. Condition: The Child Nutrition Cluster (CNC) includes the NSLP, SBP, SMP for Children, SFSP and FFVP. The objectives of the programs are to provide nutritious meals to eligible children in schools and summer food programs; to foster healthy eating habits by providing fresh fruits and vegetables to children attending elementary schools; and to encourage consumption of nutritious agriculture commodities. The Department of Education (DOE) is responsible for the administration of child nutrition programs for the State. DOE partners with local SFAs to provide benefits to school-aged children. DOE has assigned subrecipient monitoring responsibilities, which include administrative reviews and other reviews as needed, to the Child Nutrition Services (CNS) division. Administrative reviews of all SFAs are required at least once every five years. CNS utilizes a spreadsheet to track and facilitate the reviews and a USDA questionnaire to document the completion of the review. CNS is required to retain documentation to support all elements of the administrative reviews and to demonstrate the SFA’s compliance with the program. The Office of the State Auditor (OSA) tested 15 NSLP and SFSP administrative reviews and found: • the review tracking spreadsheet was not fully completed for two reviews; • questionnaires were not fully completed for three reviews; and • information on the USDA questionnaire was inaccurate for four reviews. Therefore, documentation does not support that all required areas were reviewed in accordance with Federal regulations; however, the Final Review Report issued and corrective action taken suggests that a full onsite review was completed. OSA selected a non-statistical random sample. In addition, CNS must perform reviews for all SFAs that have applied to participate in USDA Special Provision 2. These base reviews provide the required information necessary to determine the level of claims the SFA may submit in the subsequent year. After completion of the base year review, a letter detailing the results, including any adjustments to previously submitted claims, is provided to the SFA. The SFA is required to adjust claims and enrollment data through the claim revision process and CNS is responsible for verifying that the appropriate revisions have been completed. In fiscal year 2023, CNS identified 99 SFAs that required a base year review. OSA tested 15 base year reviews and identified nine SFAs that did not properly revise claims, and CNS did not verify that the appropriate revisions had been completed. OSA selected a non-statistical random sample. Context: In fiscal year 2023, CNC expenditures totaled approximately $79 million, of which approximately $69 million was provided to 247 SFAs. Cause: • Lack of policies and procedures • Lack of supervisory oversight Effect: • Noncompliance with Federal regulations • Subrecipients may not be complying with Federal statues, regulations, or the terms and conditions of the subaward. • Potential questioned costs and disallowances. Base year reviews provide authorization for the level of allowable claims the SFA can claim in subsequent periods. Without a base year review and necessary revisions, SFAs could be underclaiming or overclaiming costs. Recommendation: We recommend that the Department implement policies and procedures and increase oversight to ensure that: • reviews are completed as required and supporting documentation is retained; • SFAs revise claims appropriately after a base year review; and • CNS verifies that claim adjustments occur as necessary. Corrective Action Plan: See F-22 Management’s Response: The Department agrees with this finding. Policies and procedures will be implemented, and training will be provided to ensure that reviews are completed and documentation is retained, SFA claims are revised appropriately, and verifications of claim adjustments occur as necessary. Contact: Adriane Ackroyd, Assistant Director Child Nutrition, DOE, 207-592-1722 (State Number: 23-1203-03)

(2023-044) Title: Internal control over WIC subrecipient monitoring needs improvement Prior Year Findings: See schedule of Findings and Questioned Costs for chart/table State Department: Health and Human Services State Bureau: Manie Center for Disease Control & Prevention Federal Agency: U.S. Department of Agriculture Assistance Listing Title: Special Supplemental Nutrition Program for Women, Infants, and Children (WIC) (COVID-19) Assistance Listing Number: 10.557 Federal Award Identification Number: See E-93 to E-94 Compliance Area: Subrecipient monitoring Type of Finding: Material weakness Material noncompliance Questioned Costs: None Criteria: 2 CFR 200.303; 7 CFR 246.19 The Department must establish and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. The Department shall establish an ongoing management evaluation system which includes the monitoring of local agency operations, the review of local agency financial and participation reports, the development of corrective action plans to resolve program deficiencies, the monitoring of implementation of the corrective action plans, and on-site visits. The results of such actions must be documented. Monitoring of local agencies must encompass evaluation of management, certification, nutrition education, breastfeeding promotion and support, participant services, civil rights compliance, accountability, financial management systems, and food delivery systems. The Department must conduct monitoring reviews of each local agency at least once every two years. Monitoring must include on-site reviews of a minimum of 20 percent of the clinics in each local agency, or one clinic, whichever is greater. Condition: The State contracts with eight local agencies to administer the WIC program. The Department is required to perform management evaluation reviews (MERs) for each of the eight local agencies at least once every two years. MERs must include all components identified in 7 CFR 246.19. Performing ongoing monitoring activities ensures that the local agency is using funds for authorized purposes and in compliance with Federal regulations. Since the Department had not completed the financial management system portion of the review for any of the local agencies in the previous year, the Office of the State Auditor (OSA) selected the eight local agencies for review and found that evaluation of the financial management systems portion of the MERs remained outstanding for all local agencies. OSA then reviewed the other components of the MER separately and identified four local agencies that were due for completion in fiscal year 2023 and found: • one MER originally due in November 2021 was performed in August 2022. • one MER due in April 2023 was performed in May 2023. • one MER due in May 2023 was not performed during the fiscal year. Context: The Department provided approximately $6 million in WIC program funds to eight local agencies in fiscal year 2023. Cause: Lack of resources Effect: • Noncompliance with Federal regulations • Federal programs may not be effectively and efficiently administered. Recommendation: We recommend that the Department review its staffing needs and allocate resources to ensure MERs are completed in a timely manner. Corrective Action Plan: See F-22 Management’s Response: The Department agrees with this finding. WIC completed three (3) MERs for FY23. One (1) MER was not completed within the fiscal year, however, has since been completed. WIC is now current with the MERs in this fiscal year. WIC continues to work with DHHS Internal Audit to assist in completing the MERs financial component. All Local Agencies were monitored for FY23. Contact: Ginger Roberts-Scott, Senior Health Program Manager, DHHS, 207-287-5342 (State Number: 23-1113-02)

(2023-045) Title: Internal control over WIC cash balances needs improvement Prior Year Findings: See schedule of Findings and Questioned Costs for chart/table State Department: Health and Human Services Administrative and Financial Services State Bureau: Maine Center for Disease Control & Prevention Health and Human Services Service Center Federal Agency: U.S. Department of Agriculture Assistance Listing Title: Special Supplemental Nutrition Program for Women, Infants, and Children (WIC) (COVID-19) Assistance Listing Number: 10.557 Federal Award Identification Number: See E-93 to E-94 Compliance Area: Cash management Type of Finding: Significant deficiency Questioned Costs: None Criteria: 2 CFR 200.303; 2 CFR 200.302 The Department must establish and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and terms and conditions of the awards. Financial records must adequately identify the source and application of funds and provide accountability for all funds, property, and other assets related to the Federally-funded activities. Condition: The Office of the State Auditor (OSA) issued finding 2019-021 as a result of procedures performed for the fiscal year 2019 audit. This finding identified that “Program personnel did not take the existing cash balance into consideration when requesting Federal funds for the Food portion of the WIC grant.” This resulted in an excess cash balance for the Food grant. The finding was repeated as finding 2020-021 for the fiscal year 2020 audit, finding 2021-018 for the fiscal year 2021 audit, and finding 2022-040 for the fiscal year 2022 audit. In response to these findings, the Department performed a reconciliation of all prior grant awards to determine the cause of the excess cash balance. This reconciliation identified a $1,059,186 discrepancy between the State’s accounting system, WIC reporting, and Federal draws from the 2013 and 2018 WIC Food grants. Context: The Department calculated a $1,055,088 residual cash balance from the 2013 WIC Food grant and a $4,098 residual cash balance from the 2018 WIC Food grant. Cause: Lack of adequate recordkeeping and account reconciliation in prior years Effect: The State may be required to return $1,059,186 to the Federal awarding agency. Recommendation: We recommend that the Department contact the Federal awarding agency to resolve this matter. Corrective Action Plan: See F-23 Management’s Response: The DHHS and DHHS Financial Service Center agree with this finding. The Department will work with the Federal Agency on steps needed to resolve the cash discrepancy. Contact: Sarah Gove, Director, DHHS Service Center, DAFS, 207-458-6626 (State Number: 23-1113-01)

(2023-046) Title: Internal control over CACFP eligibility determination and claim reimbursement procedures needs improvement Prior Year Findings: See schedule of Findings and Questioned Costs for chart/table State Department: Education State Bureau: Child Nutrition Services Federal Agency: U.S. Department of Agriculture Assistance Listing Title: Child and Adult Care Food Program (CACFP) Assistance Listing Number: 10.558 Federal Award Identification Number: See E-93 to E-94 Compliance Area: Allowable costs/cost principles Eligibility Type of Finding: Material weakness Material noncompliance Questioned costs Known Questioned Costs: $19,362 Likely Questioned Costs: Undeterminable; due to the variety of institution types in the test population and varied meal claim counts, the projection of questioned costs utilizing the error rate related to the known exceptions would not provide a reasonable estimate of likely questioned costs. Criteria: 2 CFR 200.303; 2 CFR 200.403; 7 CFR 226; Child and Adult Care Food Program Memorandum #1-94 The Department must establish and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. To be allowable under Federal awards, costs must be necessary and reasonable for the performance of the Federal award and be adequately documented. Day care homes (DCHs) are defined as an organized nonresidential childcare program for children enrolled in a private home, licensed or approved as a family or group DCH and under the auspices of a Sponsoring Organization (SO). Each State agency shall establish procedures for institutions to properly submit claims for reimbursement (CFRs). Such procedures must include State agency edit checks, including but not limited to ensuring that payments are made only for approved meal types and that the number of meals for which reimbursement is provided does not exceed the product of the total enrollment, operating days, and approved meal types. The CFR must report information in accordance with the financial management system established by the State agency, and in sufficient detail to justify the reimbursement claimed. In submitting a CFR, each institution must certify that the claim is correct and that records are available to support that claim. Prior to submitting its consolidated monthly claim to the State agency, each SO must conduct reasonable edit checks on the sponsored centers’ meal claims. Each SO shall accept final administrative and financial responsibility for food service operations in all facilities under its jurisdiction. Reimbursement may not be claimed for meals served to children who are not enrolled, or for meals served at any one time to children in excess of the home’s authorized capacity. Child and Adult Care Food Program (CACFP) Memorandum #1-94 states that CACFP regulations define a DCH as a private residence, and that commercial properties including churches and schools are not private residences and are not eligible to participate in CACFP as a family DCH. Condition: CACFP provides nutritious foods that contribute to the wellness, healthy growth, and development of eligible children and adults receiving care in day care centers, DCHs operating under SOs, and at-risk after school snack programs. Child Nutrition Services (CNS) within the Department of Education administers CACFP. Eligibility Determinations CNS utilizes Federal certifications or State licenses to determine eligibility for participation in the program. The Office of the State Auditor (OSA) tested eligibility determinations for 23 facilities and found: • one SO provided expired Federal certifications to support eligibility applications for two childcare facilities (CCFs). The certifications expired in February of 2022; however, the application was approved in September 2022, and the provider was reimbursed for all claims in fiscal year 2023. OSA verified the facility was certified. • two DCH providers had capacities reduced as a result of Department of Health and Human Services inspections; however, the reduced capacities were not documented on the revised applications. The DCH providers continued to claim at a higher capacity, resulting in questioned costs totaling $1,383. • for 10 providers that were licensed as CCFs, CNS could not provide documentation to verify that providers were operating in a private residence and not a commercial or academic property. OSA verified that 8 of the 10 CCFs were private residences. OSA selected a non-statistical random sample. Claims for Reimbursement Each adult and childcare institution including DCHs, at-risk facilities, and childcare centers must submit a monthly CFR to the State. Independent centers and at-risk centers submit claims directly to CNS. CFRs from DCHs are first submitted to SOs, who are responsible for reviewing and consolidating claims into one comprehensive CFR for submission to CNS. CNS reimburses the SOs and centers for meals served based on information documented in the CFR. CNS utilizes the Child Nutrition Program (CNPWeb) system to process monthly claims. Providers enter information such as operating days, meal types, enrollment, attendance, and licensure into the system. This information is processed through system edit checks to ensure CFRs are allowable. CNS relies on the system edits; however, the edits were not properly implemented and operating as intended during fiscal year 2023. OSA tested meals claimed on 60 CFRs submitted by sponsors or SOs and found: • 23 CFRs included meals claimed which exceeded allowable licensed capacity for the facility. CNS approved and paid the claims without requesting documentation to support the allowability of the meals claimed. Of the 23 CFRs: o 21 providers indicated shift feeding. Shift feeding allows providers to serve meals over licensed capacity if children are not all in care at the same time. The submitted claims did not include documentation to support that capacity was not exceeded at any one time. o three providers did not indicate shift feeding; however, the average daily meals and attendance exceeded capacity. o 15 CFRs included nine providers that were allowed to claim in excess of licensed capacity; CNS erroneously allowed the providers’ children in determination of allowable capacity. Questioned costs related to undocumented shift feeding or meals claimed in excess of licensed capacity totaled $16,421 in fiscal year 2023. • one CFR had meals claimed that exceeded the maximum number of meals per child in attendance, resulting in questioned costs of $8. • two CFRs had meals claimed where attendance exceeded enrollment, resulting in questioned costs totaling $534. • 11 CFRs included claims for evening snacks served; however, application records indicate the facility was closed, resulting in questioned costs totaling $1,016. OSA selected consolidated CFRs submitted by one SO for all 12 months; a risk-based approach was used to select DCH claims from those consolidated CFRs. OSA selected a non-statistical random sample of all other CFRs. Context: In fiscal year 2023, CACFP expenditures totaled $9.8 million, of which $9.7 million in CACFP funds was provided to 104 sponsors. Cause: • Lack of adequate policies and procedures • Lack of supervisory oversight Effect: • Known questioned costs • Potential future questioned costs and disallowances • Noncompliance with Federal regulations • CCFs currently eligible to operate as DCHs may not be eligible to continue participating as DCHs if it is determined that the properties are commercial properties. Recommendation: We recommend that the Department enhance policies and procedures to require: • a review of licensing status, property type and capacity for all providers during each fiscal year; • documentation to support claims made in excess of licensed capacity or enrollment; and • a secondary review of monthly CFRs for accuracy prior to approval. We further recommend that the Department follow up with sponsors and SOs to identify unallowable costs and recoup costs if warranted. Corrective Action Plan: See F-23 Management’s Response: The Department partially agrees with this finding. The Department disagrees with the finding in relation to the property type, according to Federal Guidelines, submitted to OSA directly from the USDA, the State Agency is in compliance with Small Facility Approvals. Due to the state interpretation, we will develop a property form for new small facilities to confirm their residential status prior to approval for participation into the CACFP Program. The Department will update procedures to support claims made in excess of licensed capacity or enrollment and will require a secondary review of CFRs. Contact: Jane McLucas, Director of Child Nutrition, DOE, 207-624-6880 Auditor’s Concluding Remarks: CACFP Memorandum #1-94 provided by the U.S. Department of Agriculture specifically states that CACFP regulations define a DCH as a private residence, and that commercial properties, including churches and schools, are not private residences and are not eligible to participate in CACFP as a family DCH. CNS could not provide verification that providers were operating in a private residence and not a commercial or academic property. The finding remains as stated. (State Number: 23-1115-02)

(2023-047) Title: Internal control over CACFP subrecipient monitoring procedures needs improvement Prior Year Findings: See schedule of Findings and Questioned Costs for chart/table State Department: Education State Bureau: Child Nutrition Services Federal Agency: U.S Department of Agriculture Assistance Listing Title: Child and Adult Care Food Program (CACFP) Assistance Listing Number: 10.558 Federal Award Identification Number: See E-93 to E-94 Compliance Area: Subrecipient monitoring Type of Finding: Significant deficiency Questioned Costs: None Criteria: 2 CFR 200.303; 2 CFR 200.332; 7 CFR 226.6 The Department must establish and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. The Department must: • evaluate each subrecipient’s risk of noncompliance with Federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate subrecipient monitoring procedures. • verify that the subrecipient is audited as required when a subrecipient’s Federal award expenditures are expected to equal or exceed $750,000 during the fiscal year. • monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. 7 CFR 226.6 outlines specific scheduling requirements for monitoring by the Department including: • reviewing at least 33.3 percent of all institutions annually; • reviewing Sponsoring Organizations (SOs) that operate 1 to 100 facilities at least once every three years; and • reviewing SOs that operate more than 100 facilities, which conduct activities other than the Child and Adult Care Food Program (CACFP), that have been identified during a recent review as having serious management problems, or that are at risk of having serious management problems, at least once every two years. Condition: CACFP provides nutritious foods that contribute to the wellness, healthy growth, and development of eligible children and adults receiving care in day care centers, day care homes, and at-risk after school snack programs. Child Nutrition Services (CNS) is responsible for monitoring approximately 104 subrecipients that administer these services. The level of monitoring required by Federal regulations must be determined using a risk-based approach. Subrecipient risk evaluation procedures should include considerations of: • the subrecipient’s experience with the program, • the results of subrecipient audits, • changes in personnel or systems, and • the extent of Federal awarding agency monitoring procedures. Subrecipient risk evaluation The level of subrecipient monitoring procedures performed in fiscal year 2023 were based on CACFP regulations rather than a risk-based approach as required by Federal regulations. In response to this repeat finding, CNS developed a documented risk evaluation process which will be utilized to plan monitoring activities for fiscal year 2024. Subrecipient audit verification CNS identified 22 non-profit and for-profit subrecipients which expended over $750,000 in fiscal year 2023, therefore requiring verification of subrecipient audits. The Office of the State Auditor (OSA) identified one additional subrecipient that required a Single Audit that CNS did not identify. OSA was able to confirm that the subrecipient did have a Single Audit as required. Additionally, CNS did not obtain documentation from subrecipients to support extensions for audits that had not been completed. Subrecipient monitoring As noted above, in accordance with CACFP regulations, CNS utilizes a three-year administrative review cycle to monitor subrecipients. Reviews are required to be completed by the end of the cycle ending September 30 of each fiscal year and include both on-site and desk reviews. CNS schedules and conducts the reviews, holds exit meetings, provides the subrecipient with a report, and if applicable, requires the subrecipient to document corrective action plans, which CNS follows up on as needed. Once corrective action is completed, CNS issues a final review closeout letter. OSA tested a sample of eight scheduled administrative reviews that were required for completion in fiscal year 2023 and identified two reviews that were started within the cycle but not yet completed. The on-site reviews were conducted April 4, 2023, and May 23, 2023, respectively, but the desk portion of the reviews had not been completed as of February 2024; therefore, the exit meeting and reports have not been issued. OSA selected a non-statistical random sample. Context: In fiscal year 2023, CACFP expenditures totaled $9.8 million, of which $9.7 million in CACFP funds was provided to 104 subrecipients. Cause: • Lack of adequate policies and procedures • Lack of staff resources available to complete the administrative reviews timely Effect: • Noncompliance with Federal regulations • Subrecipients that are deemed higher risk may not be monitored on a more frequent basis. Conversely, subrecipients that are deemed lower risk may not be monitored on a less frequent basis, which would free resources and time to dedicate towards other higher risk subrecipients. • Subrecipients may not be complying with Federal statutes, regulations, or the terms and conditions of the subaward. Recommendation: We recommend that the Department: • utilize and evaluate the effectiveness of the newly established risk evaluation process; • enhance policies and procedures to ensure that audit reports for all subrecipients receiving over $750,000 in Federal awards requiring audits are properly identified, tracked, received, and reviewed; • enhance documentation to support reasons for late or missing audit reports; and • implement a process to ensure that the backlog of reviews is completed and allocate resources to ensure all portions of the administrative reviews are fully completed. Corrective Action Plan: See F-23 Management’s Response: The Department agrees with this finding. The CACFP Team in Child Nutrition has made significant improvements since the prior year single audit. This finding is due to the timing of the single audit and the time it takes to implement corrective action, the Department responding to a Federal Audit, the withdrawal of a subrecipient, and the process to hire additional staff. Contact: Jane McLucas, Director of Child Nutrition, DOE, 207-624-6880 (State Number: 23-1115-01)

(2023-048) Confidential finding, see below for more information Title: Internal control over UI claim payments needs improvement Prior Year Findings: See schedule of Findings and Questioned Costs for chart/table State Department: Labor State Bureau: Unemployment Compensation Federal Agency: U.S. Department of Labor Assistance Listing Title: Unemployment Insurance (UI) (COVID-19) Assistance Listing Number: 17.225 Federal Award Identification Number: See E-93 to E-94 Compliance Area: Allowable costs/cost principles Eligibility Type of Finding: Material weakness Questioned Costs: None Criteria: 2 CFR 200.303; 2 CFR 200.403; 20 CFR 615.8; Middle Class Tax Relief and Job Creation Act of 2012; Social Security Act Title III, Section 303; Unemployment Insurance Program Letter No. 5-13; 26 MRSA 1190 through 1199 The Department must establish and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. To be allowable under Federal awards, costs must be necessary and reasonable for the performance of the Federal award and be adequately documented. A State administering Unemployment Insurance (UI) must have State laws and policies in place that are consistent with Federal provisions and required by 20 CFR 615.8; the Middle Class Tax Relief and Job Creation Act of 2012; Social Security Act Title III, Section 303; and Unemployment Insurance Program Letter No. 5-13, as follows: • Standards for claim filing and processing including appeals and reviews, communication with claimants and employers, eligibility standards and disqualifications, and Interstate Benefit Payments and agreements • Standards for reasonable work search criteria and policies requiring performance of internal audits of work search activity • Standards for program integrity outlining procedures for identification and recovery of overpayments and penalties, including recovery through offset of future benefit payments The State of Maine’s statutory requirements for UI program benefits are outlined in 26 MRSA 1190 through 1199. Condition: Pursuant to paragraph 6.63 of the U.S. Government Accountability Office’s Government Auditing Standards (also known as the Yellow Book), we omitted details from this finding as they are confidential under the provisions of 5 MRSA 244-C (3). Though the content of this finding has been redacted, we provided the Department(s) with detailed information regarding the specific condition we identified, as well as the related criteria, context, causes, effects, and our specific recommendations for improvement. Department controls The Department has complementary controls in place over claimant eligibility, including: • performance of internal work search audits by MDOL personnel for one percent of weekly claims, and • establishment of a Benefits Quality Control Unit tasked with investigating a prescribed number of UI paid claims and denied claims each week. Audit testing results As part of the continuing eligibility determination process, State UI law requires a weekly claim to be filed and work search activities to be reported. In OSA’s test of 60 regular UI claimants’ continuing eligibility, one claimant did not report work search activities for the weeks claimed. Despite not meeting continuing eligibility requirements, the claimant was issued State UI benefits totaling $220. OSA selected a non-statistical random sample. Data analytics Data analytic procedures surrounding continuing eligibility requirements for weekly claim submission and work search activity entered by claimants identified that: • 18 claimants reported repetitive work search activities indicative of program abuse for consecutive benefit weeks and throughout the majority of their claims; • one claimant reported new return to work dates in 19 consecutive weekly claim submissions, which generated new temporary unemployment waivers that allowed the claimant to file all 19 weekly claims without reporting work search activities; • one claimant was granted a waiver with no end date, allowing the claimant to file 24 weekly claims without reporting work search activities; and • five claimants filed a total of eight claims with no work search activities reported. Context: The UI program provided $96.8 million in State UI benefits and $1.3 million in Federal UI benefits during fiscal year 2023. Cause: • Lack of adequate policies and procedures over initial and continuing claimant eligibility determinations • Lack of adequate supervisory oversight of information system application controls Effect: • Claimants may be incorrectly determined eligible for UI benefits without meeting Federal program requirements, which may result in unallowable issuances of benefit payments that could remain undetected. • Potential questioned costs and disallowances Recommendation: We recommend that the Department enhance policies and procedures to require: • that eligibility requirements are met and adequately supported prior to issuance of benefit payments. • implementation of additional information system application controls. • incorporation of data analytics and data cross-matching procedures to prevent or detect payments to ineligible claimants. This will provide assurance that payments to ineligible claimants are prevented, or detected and corrected, in a timely manner. Corrective Action Plan: See F-24 Management’s Response: In a general sense the state has added significant controls around benefit eligibility, especially in the vital statistics area and work search. We continue to monitor all eligibility controls and work collaboratively with the state and federal government to enhance controls and strengthen program integrity. Specific to the findings: The agency agrees with the 18 claimants who provided repetitive work search efforts on their weekly claims. This subset of claimants used CareerCenter activities as their work search for numerous subsequent weeks. Per the Commission Rules, Chapter 10, subsection B (1) and (2), certain CareerCenter activities may count as a work search for the week claimed. However, due to recent OSA audits, additional controls were defined and implemented to avoid this exact scenario. The change was implemented with our 06/28/2023 build. As of that time in cases where a claimant reports a CareerCenter related activity on more than two weekly benefit claims, the claimant will be scheduled for a fact-finding to discuss their work search efforts. We anticipate seeing a significant improvement in this area for SFY 24. We agree with the finding on the single claimant who was granted consecutive work search waivers by reporting they were scheduled to start new employment within the next two weeks on their weekly claim. Additional controls in this area will be formulated and a change request filed to address this finding. We agree with the remaining six claimants’ control findings which were due to a variety of staff training issues. Some of these are in process of being addressed through refresher training, some of which had already been detected prior to OSA’s finding. One case will require additional review but was possibly due to a staff data entry error. We are encouraged by the continued collaboration with OSA, which has resulted in meaningful change and added controls in this area. We appreciate the opportunity provided and look forward to continued improvement. Contact: Laura Boyett, Director, Bureau of Unemployment Compensation, DOL, 207-621-5156 (State Number: 23-1302-01)

(2023-049) Confidential finding, see below for more information Title: ________ over ________ needs improvement Pursuant to paragraph 6.63 of the U.S. Government Accountability Office’s Government Auditing Standards (also known as the Yellow Book), we omitted details from this finding as they are confidential under the provisions of 5 MRSA 244-C (3). Though the content of this finding has been redacted, we provided the Department(s) with detailed information regarding the specific condition we identified, as well as the related criteria, context, causes, effects, and our specific recommendations for improvement. Prior Year Findings: None Type of Finding: Significant deficiency Corrective Action Plan: See F-24 Contact: Shirley Browne, Deputy State Controller, Office of the State Controller, 207-626-8423 (State Number: 23-0907-02)

(2023-050) Title: Internal control over monitoring of employee classification and compensation needs improvement Prior Year Findings: See schedule of Findings and Questioned Costs for chart/table State Department: Administrative and Financial Services State Bureau: Human Resources Federal Agency: U.S. Department of Labor U.S. Department of Transportation U.S. Department of Education Assistance Listing Title: Unemployment Insurance (UI) (COVID-19) Highway Planning and Construction (Federal-Aid Highway Program) Special Education Cluster (IDEA) (COVID-19) Assistance Listing Number: 17.225; 20.205; 84.027, 84.173 Federal Award Identification Number: See E-93 to E-94 Compliance Area: Allowable costs/cost principles Type of Finding: Significant deficiency Questioned Costs: None Criteria: 2 CFR 200.303; 2 CFR 200.430; 5 MRSA 7061 The Department must establish and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. Costs of compensation are allowable to the extent that personal services are rendered during the period of performance under the Federal award, total compensation is reasonable for the services rendered and conforms to the established written policy of the non-Federal entity, and follows an appointment made in accordance with a non-Federal entity’s laws and/or rules or written policies. 5 MRSA 7061 states that the (Bureau of Human Resources (BHR)) director shall record the duties and responsibilities of all positions in State service and establish classes for these positions. The procedure shall provide for periodic updating of job descriptions at least every five years to accurately reflect current duties and responsibilities of each job classification. Condition: BHR maintains the job classification specifications and related compensation plan of State employees. A specific salary specification and grade is assigned based on the duties and responsibilities referenced in the job classification specification; this represents reasonable compensation for the services rendered for all positions that inhabit a given job classification specification. The assigned salary grade provides a basis for the allowability of compensation costs charged to Federal awards by documenting the reasonableness of compensation for services rendered by State employees, and that the position appointments under the job classification specification were made and maintained in accordance with State statute. While BHR relies on data collected from State agencies to implement procedures regarding the classification plan, BHR retains ultimate oversight responsibility. BHR is the only agency with the authority to modify the classification plan. According to 5 MRSA 7061, BHR shall provide for periodic updating of job descriptions at least every five years to accurately reflect current duties and responsibilities of each job classification. On BHR’s website, job classification specifications, along with the date the job class was last reviewed and updated, are published. The Office of the State Auditor (OSA) tested 24 job classification specifications and information reported on BHR’s website for compliance with 5 MRSA 7061. For 12 of the 24 job classification specifications tested, OSA identified that the date the job class was last updated was beyond five years. Prior to March 2023, BHR only updated the date on a job classification if a change was made. Although BHR began recording review dates regardless of whether a change was made in April 2023, there is no tracking mechanism in place to effectively identify the dates of the last review and next scheduled review, thus hindering compliance with the statutory five-year cycle. OSA selected a non-statistical random sample. Context: • During fiscal year 2023, $125 million of payroll expenditures were charged to Federal grants. This represents approximately 10 percent of fiscal year 2023 Statewide payroll expenditures, which totaled $1.2 billion. • BHR was responsible for managing approximately 1,200 job classification specifications in fiscal year 2023. Cause: • Competing priorities • Lack of resources • Lack of adequate policies and procedures Effect: State employee job classification and compensation may not accurately reflect the current duties and responsibilities of each position. Without documented evidence that review activities are occurring, BHR cannot ensure that the decisions involving the classification and compensation plan of all State employee positions are properly supported by documentation that accurately reflects the current duties and responsibilities of each position. As a result, this may lead to noncompliance with Federal and State regulations. Recommendation: We recommend that the Department: • allocate resources to ensure proper oversight and monitoring of agency-level activities related to the maintenance of the State classification and compensation plan in accordance with State statute; • continue implementation of policies and procedures to ensure updates or reviews of the State classification and compensation plan are adequately documented; and • implement a tracking mechanism to accurately monitor the dates of past reviews and schedule forthcoming reviews to aid in adherence to the statutory requirement. Corrective Action Plan: See F-24 Management’s Response: The Department partially agrees with this finding. The Department disagrees with the statement “The assigned salary grade provides a basis for the allowability of compensation costs charged to Federal awards by documenting the reasonableness of compensation for services rendered by State employees...”. The focus is on 5 MRSA 7061 Classification Plan which “records the duties and responsibilities of all positions” rather than on the statute for the Compensation Plan, 5 MRSA 7065, which relates to compensation in that it establishes “minimum and maximum salary rates and such intermediate rates as the director considers desirable.” Consistent with 5 MRSA 7065, salary schedules were established and remain in place, changing through bargained and legislatively approved adjustments. To determine the basis for appropriate compensation, one must review these salary schedules along with any recruitment and retention adjustments (permitted by 5 MRSA 7065; paid in addition to and outside of the salary schedule), any agreements for market pay adjustments, laws which provide for additional pay components, and all negotiated pay items contained in the associated collective bargaining agreements. The Compensation Plan has been reviewed and adjusted during the period of this audit (July 2022 through June 2023), as evidenced by the on-line publication of new salary schedules effective July 3, 2022. In the 5-year period of July 2018 through June 2023 (the period the audit looked at class specs), the published salary schedules have been adjusted eight (8) times. The Department also disagrees with the recommendation’s reference “classification and compensation plan” as a singular plan. These are two separate plans in statute, and the recommendations are directed toward the classification plan. The Department agrees with the recommendations in that they provide for improved processes. It is worth noting the new language now in place by statute under the Classification Plan states: “Beginning in 2024, the procedure must provide for a comprehensive review of the classification plan every 10 years to make modifications and improvements as determined necessary.” Contact: Breena Bissell, Director, Bureau of Human Resources, DAFS, 207-624-7368 Auditor’s Concluding Remarks: The classification plan (5 MRSA 7061) and the compensation plan (5 MRSA 7065) are inherently linked. A well-maintained classification plan that accurately reflects the current duties and responsibilities of each job classification is essential for determining the correct salary rates in the compensation plan. Without regular reviews of the duties and responsibilities of each job classification, the data used to establish salary rates may be outdated and inaccurate. This can lead to discrepancies between the work performed by employees and the compensation they receive. The procedural nature and link between the classification plan and the compensation plan is further evidenced in the portion of the statute that BHR omitted in Management’s Response. BHR references “minimum and maximum salary rates and such intermediate rates as the director considers desirable.” The full reference states, “The officer shall, as soon as practicable after the adoption of the classification plan, submit to the Legislature a proposed plan of compensation developed by the officer showing for each class or position in the classified service minimum and maximum salary rates and such intermediate rates as the officer considers desirable.” The italicized portion of the statute emphasizes the importance of the classification plan as the foundation for developing the compensation plan. Therefore, it is critical that the classification plan is regularly reviewed and updated, and documentation of the process is maintained, to ensure the integrity of the compensation plan. The finding remains as stated. (State Number: 23-0111-01)

(2023-051) Confidential finding, see below for more information Title: ________ over ________ and ________ needs improvement Pursuant to paragraph 6.63 of the U.S. Government Accountability Office’s Government Auditing Standards (also known as the Yellow Book), we omitted details from this finding as they are confidential under the provisions of 5 MRSA 244-C (3). Though the content of this finding has been redacted, we provided the Department(s) with detailed information regarding the specific condition we identified, as well as the related criteria, context, causes, effects, and our specific recommendations for improvement. Prior Year Findings: See schedule of Findings and Questioned Costs for chart/table Type of Finding: Significant deficiency Corrective Action Plan: See F-25 Contact: Shirley Browne, Deputy State Controller, Office of the State Controller, 207-626-8423 (State Number: 23-0902-06)

(2023-052) Confidential finding, see below for more information Title: ________ over the ________ needs improvement Pursuant to paragraph 6.63 of the U.S. Government Accountability Office’s Government Auditing Standards (also known as the Yellow Book), we omitted details from this finding as they are confidential under the provisions of 5 MRSA 244-C (3). Though the content of this finding has been redacted, we provided the Department(s) with detailed information regarding the specific condition we identified, as well as the related criteria, context, causes, effects, and our specific recommendations for improvement. Prior Year Findings: None Type of Finding: Significant deficiency Corrective Action Plan: See F-25 Contact: Shirley Browne, Deputy State Controller, Office of the State Controller, 207-626-8423 (State Number: 23-0900-06)

(2023-053) Confidential finding, see below for more information Title: ________ over ________ needs improvement Pursuant to paragraph 6.63 of the U.S. Government Accountability Office’s Government Auditing Standards (also known as the Yellow Book), we omitted details from this finding as they are confidential under the provisions of 5 MRSA 244-C (3). Though the content of this finding has been redacted, we provided the Department(s) with detailed information regarding the specific condition we identified, as well as the related criteria, context, causes, effects, and our specific recommendations for improvement. Prior Year Findings: See schedule of Findings and Questioned Costs for chart/table Type of Finding: Significant deficiency Corrective Action Plan: See F-25 Contact: Shirley Browne, Deputy State Controller, Office of the State Controller, 207-626-8423 (State Number: 23-0908-02)

(2023-054) Title: Internal control over DOT subrecipient and contractor determinations needs improvement Prior Year Findings: None State Department: Transportation State Bureau: Finance and Administration Planning Federal Agency: U.S. Department of Transportation Assistance Listing Title: Formula Grants for Rural Areas and Tribal Transit Program (COVID-19) Assistance Listing Number: 20.509 Federal Award Identification Number: See E-93 to E-94 Compliance Area: Reporting Subrecipient monitoring Type of Finding: Significant deficiency Questioned Costs: None Criteria: 2 CFR 200.303; 2 CFR 200.331; 2 CFR 200.510 The Department must establish and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. The Department must make case-by-case determinations whether each agreement it makes for the disbursement of Federal program funds casts the party receiving the funds in the role of a subrecipient or a contractor. The Department must prepare a Schedule of Expenditures of Federal Awards (SEFA) for the period covered by the State’s financial statements which must include the total Federal awards expended. At a minimum, the SEFA must provide total Federal awards expended for each individual Federal program and the Assistance Listing Number (ALN) and include the total amount provided to subrecipients from each Federal program. Condition: The Department must complete and submit exhibits and related schedules to the Office of the State Controller (OSC) at the close of each fiscal year to report Federal award information for inclusion on the State’s SEFA. OSC is responsible for compiling this information on behalf of the State. The Office of the State Auditor reviewed SEFA amounts reported to OSC by the Department and identified $3,064,233 of Federal expenditures incorrectly reported as amounts provided to subrecipients that should have been reported as direct expenditures. The Department did not properly document the role of the parties receiving the funds as vendors and contractors or subrecipients. As a result, vendor and contractor payments were incorrectly included in the initial amount reported on the SEFA as amounts provided to subrecipients. Context: The Department erroneously reported amounts provided to subrecipients totaling $16.3 million and direct expenditures totaling $5.6 million. The correct amounts provided to subrecipients totaled $13.3 million and direct expenditures totaled $8.7 million for fiscal year 2023. Cause: • Lack of adequate procedures • Lack of supervisory oversight Effect: • Inaccurate classifications of subrecipients versus vendors could lead to monitoring the activities of vendors, thus utilizing resources that could be allocated to other program needs. • Incomplete or inaccurate reporting of expenditures on the SEFA, which is submitted to the Federal government, may result in incorrect information used for programmatic, policy or statistical purposes. Recommendation: We recommend that the Department enhance procedures to: • document the subrecipient determination process to properly classify vendors and contractors versus subrecipients; and • improve preparation, review, and submission of SEFA information to OSC. Corrective Action Plan: See F-25 Management’s Response: The Department agrees with this finding. The Department will update procedures to ensure the classification of subrecipients versus contractors is documented and to improve the SEFA information that is submitted. Contact: Kathleen Malcolm, Financial Processing Director, MDOT, 207-624-3292 (State Number: 23-1402-01)

(2023-055) Title: Internal control over ERA Program subrecipient monitoring needs improvement Prior Year Findings: See schedule of Findings and Questioned Costs for chart/table State Department: Economic and Community Development State Bureau: Commissioner’s Office Federal Agency: U.S. Department of the Treasury Assistance Listing Title: Emergency Rental Assistance Program (COVID-19) Assistance Listing Number: 21.023 Federal Award Identification Number: See E-93 to E-94 Compliance Area: Subrecipient monitoring Type of Finding: Material weakness Material noncompliance Questioned Costs: None Criteria: 2 CFR 200.303; 2 CFR 200.332 The Department must establish and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. The Department must monitor the activities of the subrecipient as necessary to ensure that subawards are used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward, and that subaward performance goals are achieved. Condition: In fiscal year 2023, the Department passed through Emergency Rental Assistance (ERA) Program funds to one subrecipient responsible for administering the program. Subrecipient monitoring procedures included providing Federal award information in grant award agreements and frequent communication with the subrecipient; however, the Department did not adequately design and document ongoing monitoring activities to ensure that the subaward was used for authorized purposes and in compliance with Federal regulations. During fiscal year 2023, the Department contracted with a vendor to perform all subrecipient monitoring for the ERA Program, but all monitoring activities occurred subsequent to the final disbursement of ERA Program funds in January 2023. In addition, the Department did not require submission of detailed expenditure information with the subrecipient’s requests for reimbursement of ERA Program funds. A summary spreadsheet outlining actual and projected expenditures for second-tier subrecipients was the only support provided to the Department with each reimbursement request. Context: In fiscal year 2023, the Department expended $39.5 million in ERA Program funds; the entire amount was passed through to the subrecipient. Cause: • Lack of supervisory oversight • Lack of adequate policies and procedures Effect: • Noncompliance with Federal regulations • Lack of ongoing subrecipient monitoring procedures could result in subrecipient noncompliance that is not discovered timely. Recommendation: The Office of the State Auditor (OSA) acknowledges that the ERA Program has concluded; however, we recommend that the Department develop and implement policies and procedures to ensure that: • all Federal award program subrecipients of the Department are subject to ongoing monitoring activities during the grant award term. • detailed documentation in support of subrecipient reimbursement requests is received prior to payment approval. In addition, we recommend that the Department monitor subrecipient corrective action related to the results of the retroactive monitoring activities performed by the vendor in order to properly close out the ERA Program. Corrective Action Plan: See F-26 Management’s Response: Although management agrees with this finding, the ERA program was one-time funding that the department was required to award to the subrecipient. The Department determined that because the subrecipient is a quasi-state agency that administers millions of federal dollars for rental assistance under the Section 8 and HOME programs, they did not require the level of oversight cited in the finding. The ERA 1 program is already closed-out with Treasury. If there is any additional funding under that program the department will implement our subrecipient monitoring policies and procedures. Contact: Deborah Johnson, Director, Office of Community Development, DECD, 207-624-9817 Auditor’s Concluding Remarks: OSA again acknowledges that the ERA Program has concluded; however, the deficiencies noted in the Condition and the related recommendations address Department policies and procedures for all Federal award program subrecipients. As stated in Management’s Response, the subrecipient administers a significant amount of Federal funding. This reinforces the need to monitor corrective action related to the results of retroactive monitoring activities performed by the vendor and properly close out the ERA Program. Subrecipient monitoring activities for future subrecipient awards should be adjusted accordingly. The finding remains as stated. (State Number: 23-1695-02)

(2023-056) Title: Internal control over ERA Program performance reporting needs improvement Prior Year Findings: See schedule of Findings and Questioned Costs for chart/table State Department: Economic and Community Development State Bureau: Commissioner’s Office Federal Agency: U.S. Department of the Treasury Assistance Listing Title: Emergency Rental Assistance Program (COVID-19) Assistance Listing Number: 21.023 Federal Award Identification Number: See E-93 to E-94 Compliance Area: Reporting Type of Finding: Material weakness Material noncompliance Questioned Costs: None Criteria: 2 CFR 200.303; Consolidated Appropriations Act, 2021, Section 501(g) The Department must establish and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. The Department must submit and certify quarterly compliance reports providing financial and performance data regarding grantee administration of their Emergency Rental Assistance (ERA) Program projects and capture program design in addition to program status data elements. Condition: The Department contracts with a subrecipient to administer the ERA Program. A Memorandum of Understanding between the Department and the subrecipient outlines the following: • The subrecipient is responsible for preparation of all required reporting under the ERA Program. • The Department is responsible for certification and submission of all reports prepared by the subrecipient. The subrecipient prepared five quarterly performance reports during fiscal year 2023, which were certified by the Department during the submission process. The Department provided the Office of the State Auditor with all five quarterly reports; however, the Department could not provide: • documentation to support amounts reported on the State’s fiscal year 2023 ERA Program performance reports, as it was not maintained by the Department. • documentation of review of each performance report prepared by the subrecipient before certification by the Department. As a result, the Department has no assurance that ERA Program information for each quarterly report prepared by the subrecipient and submitted to the Federal government on behalf of the State is accurate or properly supported. Context: In fiscal year 2023, the Department expended $39.5 million in ERA Program funds; the entire amount was passed through to the subrecipient. Cause: • Lack of supervisory oversight • Lack of adequate policies and procedures Effect: The Department did not properly oversee the ERA Program as required by Federal regulations. ERA Program reports submitted to the Federal government are not properly supported and may not be accurate as documentation is not reviewed or maintained by the Department. Recommendation: We recognize that all ERA Program funds have been disbursed by the Department to the subrecipient; however, reporting requirements are ongoing. For this reason, we recommend that the Department promptly implement policies and procedures to require a documented review and approval of all ERA Program reports prepared by the subrecipient prior to Department certification and submission. This will ensure that information reported to the Federal government is accurate and complete. Corrective Action Plan: See F-26 Management’s Response: The Department agrees with this finding. DECD will take corrective action as advised. Prior to each quarterly report submission deadline, staff will meet with the subrecipient on site and review the data collected for uploading into the report to ensure the content of the submission is accurate. Contact: Deborah Johnson, Director, Office of Community Development, DECD, 207-624-9817 (State Number: 23-1695-01)

(2023-057) Title: Internal control over the submission of HAF Program Schedule of Expenditures of Federal Awards reporting needs improvement Prior Year Findings: None State Department: Administrative and Financial Services State Bureau: Security and Employment Service Center Federal Agency: U.S. Department of the Treasury Assistance Listing Title: Homeowner Assistance Fund Program (COVID-19) Assistance Listing Number: 21.026 Federal Award Identification Number: See E-93 to E-94 Compliance Area: Reporting Type of Finding: Material weakness Material noncompliance Questioned Costs: None Criteria: 2 CFR 200.303; 2 CFR 200.510 The Department must establish and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. The Department must prepare a Schedule of Expenditures of Federal Awards (SEFA) for the period covered by the State’s financial statements which must include the total Federal awards expended. At a minimum, the SEFA must include the total amount provided to subrecipients from each Federal program. Condition: The Department must complete and submit exhibits and related schedules to the Office of the State Controller (OSC) at the close of each fiscal year to report Federal award information for inclusion on the State’s SEFA. Federal program expenditures reported on the SEFA must be segregated between direct award expenditures and amounts provided to subrecipients. OSC is responsible for compiling this information on behalf of the State. In fiscal year 2023, the Department of Professional and Financial Regulation received Federal funding and incurred related expenditures under ALN 21.026, the Homeowner Assistance Fund (HAF) Program. The Security and Employment Service Center (SESC), which is responsible for submitting the summary of HAF expenditures to OSC, did not segregate the amounts provided to subrecipients in the exhibits and related schedules provided to OSC. OSC utilized this information to compile and prepare the SEFA. As a result, all HAF expenditures were inaccurately reported as direct expenditures on the State’s fiscal year 2023 SEFA when provided to the Office of the State Auditor for audit purposes. Context: In fiscal year 2023, HAF expenditures totaled $12.3 million. Of that amount, $4.3 million was direct expenditures and $8.0 million was paid to subrecipients. Cause: Lack of adequate internal control relating to Department SEFA submissions to OSC Effect: Inaccurate reporting of expenditure amounts on the SEFA, which is submitted to the Federal government, may result in incorrect information used for programmatic, policy, or statistical purposes. Recommendation: We recommend that SESC implement additional procedures to improve preparation and submission of SEFA information to OSC. These control procedures will ensure that expenditures are reported accurately on the SEFA. Corrective Action Plan: See F-26 Management’s Response: The Department agrees with this finding. The expenditure data was not correctly classified as sub-recipient expenditures. Contact: Marilyn Leimbach, Director, Security and Employment Service Center, DFPS, DAFS, 207-248-2556 (State Number: 23-1000-01)

(2023-058) Title: Internal control over CSLFRF expenditures needs improvement Prior Year Findings: None State Department: Economic and Community Development State Bureau: Commissioner’s Office Federal Agency: U.S. Department of the Treasury Assistance Listing Title: Coronavirus State and Local Fiscal Recovery Funds (COVID-19) Assistance Listing Number: 21.027 Federal Award Identification Number: See E-93 to E-94 Compliance Area: Activities allowed or unallowed Allowable costs/cost principles Type of Finding: Significant deficiency Questioned costs Known Questioned Costs: $591,845 Likely Questioned Costs: $591,845 Criteria: 2 CFR 200.303; 2 CFR 200.302; 2 CFR 200.403; Coronavirus State and Local Fiscal Recovery Fund 2022 Final Rule The Department must establish and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. Costs must be adequately documented. The State’s financial management systems, including records documenting compliance with Federal statutes, regulations, and the terms and conditions of the Federal award, must be sufficient to determine that such funds have been used in accordance with Federal statutes, regulations, and the terms and conditions of the Federal award. Coronavirus State and Local Fiscal Recovery Fund (CSLFRF) recipients may use funds “to respond to the public health emergency with respect to COVID-19 or its negative economic impacts, including assistance to households, small businesses, and nonprofits, or aid to impacted industries such as tourism, travel, and hospitality.” The CSLFRF 2022 Final Rule states (U.S.) Treasury is maintaining the interim final rule definition of “small business,” which used the Small Business Administration’s (SBA) definition of fewer than 500 employees, or per the standard for that industry, as defined by SBA. Condition: As part of the American Rescue Plan Act, the State was advanced $997 million in Federal CSLFRF to support its response to and recovery from the COVID-19 public health emergency. In response, Public Law 2022, Chapter 168, L.D. 2010 authorized funding to establish an energy rebate program for certain electricity customers. The law required the Department of Economic and Community Development (DECD) to make payments to utility companies for energy rebate credits to the accounts of eligible customers. To support the allowability of energy rebates to small businesses, DECD prepared the “Energy Rate Relief for Small Organizations” business case. In the business case, DECD stated its intent to use CSLFRF funding to provide direct credits to qualifying Maine small businesses to help defray increased electricity costs. DECD noted the project would provide direct relief utilizing the framework established in LD 2010, Resolve, To Help Certain Businesses with Energy Costs. The Maine Jobs and Recovery Review Committee reviewed and approved the business case on behalf of the State under the assumption that energy rebates would be provided to small businesses. DECD relied on utility companies to identify customers eligible for the energy rebate based on energy usage. Utility companies provided detailed lists of the customers which they deemed eligible to receive the rebate, and DECD reviewed and approved the invoices for payment. The Office of the State Auditor (OSA) reviewed the invoices and related payments to utility companies and identified credits were issued to several commercial entities ineligible under the CSLFRF 2022 Final Rule definition of “small business.” The entities listed included large businesses, government entities, and school systems. In total, OSA identified 234 entities credited a total of $591,845 that were not approved as supported by the business case. Context: Energy Rate Relief payments totaled $7.1 million of the $207.8 million in CSLFRF expenditures during fiscal year 2023. Cause: Lack of supervisory oversight Effect: • Known questioned costs • Potential future questioned costs and disallowances • Noncompliance with Federal regulations Recommendation: We recommend that the Department review expenditures charged to CSLFRF, including the above-noted expenditures, to ensure that costs are allowable and align with the approved business case and Federal regulations. Corrective Action Plan: See F-26 Management’s Response: The Department agrees with this finding. Approved business cases are established under a single US Treasury expenditure category. Consistent with legislative direction, the scope of this business case was expanded during the original implementation to include additional allowable expenditure categories; however, the Department did not divide the original business case into multiple business cases to reflect the additional expenditure categories as required. The Department intends on dividing the approved business case into multiple business cases to align with the applicable US Treasury expenditure categories. Contact: Denise Garland, Deputy Commissioner, DECD, 207-624-7496 (State Number: 23-1699-01)

(2023-059) Title: Internal control over CSLFRF subrecipient audit procedures needs improvement Prior Year Findings: None State Department: Economic and Community Development State Bureau: Commissioner’s Office Federal Agency: U.S. Department of the Treasury Assistance Listing Title: Coronavirus State and Local Fiscal Recovery Funds (COVID-19) Assistance Listing Number: 21.027 Federal Award Identification Number: See E-93 to E-94 Compliance Area: Subrecipient monitoring Type of Finding: Significant deficiency Questioned Costs: None Criteria: 2 CFR 200.303; 2 CFR 200.332; 2 CFR 200.521 The Department must establish and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. The Department must follow-up and ensure that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the Federal award provided to the subrecipient from the pass-through entity detected through audits, on-site reviews, and written confirmation from the subrecipient, highlighting the status of actions planned or taken to address Single Audit findings related to the particular subaward. The Department must verify that every subrecipient is audited as required by 2 CFR 200, subpart F regarding audit requirements. Furthermore, the Department must issue a management decision for audit findings that relate to Federal awards provided to the subrecipient within six months of acceptance of the audit report by the Federal Audit Clearinghouse. Condition: As part of the American Rescue Plan Act, the State was advanced $997 million in Federal Coronavirus State and Local Fiscal Recovery Funds (CSLFRF) to support its response to and recovery from the COVID-19 public health emergency. The Department of Economic and Community Development (DECD) partnered with subrecipients to support the administration of CSLFRF. The Office of the State Auditor (OSA) selected a sample of three DECD subrecipients subject to Single Audit requirements outlined in 2 CFR 200, subpart F and identified that DECD did not review the subrecipients’ Single Audits. Additionally, one of the subrecipient Single Audit Reports included a CSLFRF finding for not verifying whether beneficiaries were suspended or debarred; DECD did not issue a management decision as required by Federal regulations. OSA selected a non-statistical random sample. Context: For fiscal year 2023, CSLFRF expenditures totaled $207.8 million, of which approximately $55 million was provided to 12 DECD subrecipients. Cause: • Lack of adequate policies and procedures • Lack of supervisory oversight Effect: • Noncompliance with Federal regulations • Subrecipients may not be complying with Federal statutes, regulations, or the terms and conditions of the subaward. Recommendation: We recommend that the Department enhance policies and procedures to ensure that audit reports for all subrecipients receiving over $750,000 in Federal awards requiring audits are properly reviewed, and management decisions are issued timely. Corrective Action Plan: See F-27 Management’s Response: The Department agrees with this finding. The selected sample of subrecipient single audits were not reviewed in keeping with federal guidance in 2 CFR 200 and management decision letters were not issued. Moving forward DECD will engage their consulting firm to conduct regular reviews of subrecipient single audits and work with DECD staff to issue timely and actionable management decisions. Contact: Denise Garland, Deputy Commissioner, DECD, 207-624-7496 (State Number: 23-1699-02)

(2023-060) Title: Internal control over CSLFRF subrecipient risk evaluation procedures needs improvement Prior Year Findings: None State Department: Labor State Bureau: Commissioner’s Office Federal Agency: U.S. Department of the Treasury Assistance Listing Title: Coronavirus State and Local Fiscal Recovery Funds (COVID-19) Assistance Listing Number: 21.027 Federal Award Identification Number: See E-93 to E-94 Compliance Area: Subrecipient monitoring Type of Finding: Significant deficiency Questioned Costs: None Criteria: 2 CFR 200.303; 2 CFR 200.332 The Department must establish and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. The Department is required to evaluate each subrecipient’s risk of noncompliance with Federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate subrecipient monitoring described in 2 CFR 200.332. Condition: As part of the American Rescue Plan Act, the State was advanced $997 million in Federal Coronavirus State and Local Fiscal Recovery Funds (CSLFRF) to support its response to and recovery from the COVID-19 public health emergency. The Maine Department of Labor (MDOL) partnered with subrecipients to support the administration of CSLFRF. MDOL has a documented policy that requires subrecipient risk evaluations. The Office of the State Auditor (OSA) tested a sample of 35 subrecipients paid by various State agencies under CSLFRF, including seven MDOL subrecipients, to ensure that proper subrecipient monitoring was performed as required by Federal regulations. MDOL subrecipient monitoring procedures included providing Federal award information in grant award agreements, communicating program guidelines, establishing reporting requirements, providing technical assistance, and communicating with the subrecipients to discuss program performance; however, MDOL could not provide evidence to demonstrate that monitoring procedures were established in response to an evaluation of the subrecipient’s risk of noncompliance for the seven MDOL subrecipients tested. OSA selected a nonstatistical random sample. Context: During fiscal year 2023, the Department provided $2.4 million to 20 MDOL subrecipients, from a total of $110.5 million provided to all CSLFRF subrecipients. Cause: • Lack of supervisory oversight • Lack of adequate procedures Effect: • Subrecipients that are deemed higher risk may not be monitored on a more frequent basis. Conversely, subrecipients that are deemed lower risk may not be monitored on a less frequent basis, which would free resources and time to dedicate towards other higher risk subrecipients. • Subrecipient noncompliance could go undetected. Recommendation: We recommend that the Department enforce policies and procedures that require evaluation of each subrecipient’s risk of noncompliance specifically for the purposes of determining the appropriate subrecipient monitoring to be performed. This will ensure subrecipients are monitored appropriately based on risk designation. Corrective Action Plan: See F-27 Management’s Response: The Department agrees with this finding. MDOL received funds via the Maine Jobs and Recovery Plan to accomplish several goals across 20 unique initiatives. To best meet the goals of several initiatives, MDOL selected various partners to work with - via a competitive Request for Applications (RFA) process or other contractual arrangement. MDOL’s competitive RFA process required evaluating individual applicants’ previous experience in managing grants and delivering similar programs, which directly correlated with selection criteria and grantee scoring. After selection, grantees are required to submit quarterly performance reports and participate in grantee check-in calls at least twice per year. For grantees not on track to meet their performance goals, monthly calls were held with interim progress milestones set to track performance. While the above procedures were implemented for all subrecipients, going forward, the Department will document that monitoring procedures were established in response to an evaluation of the subrecipient’s risk of noncompliance. Contact: Samantha Dina, Associate Commissioner, MDOL, 207-816-1714 (State Number: 23-1699-04)

(2023-061) Title: Internal control over CSLFRF reporting needs improvement Prior Year Findings: None State Department: Administrative and Financial Services State Bureau: Security and Employment Service Center Federal Agency: U.S. Department of the Treasury Assistance Listing Title: Coronavirus State and Local Fiscal Recovery Funds (COVID-19) Assistance Listing Number: 21.027 Federal Award Identification Number: See E-93 to E-94 Compliance Area: Reporting Type of Finding: Significant deficiency Questioned Costs: None Criteria: 2 CFR 200.303; 2 CFR 200.332(b); 2 CFR 200.510 The Department must establish and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. The Department must maintain accurate, current, and complete disclosure of the financial results of each Federal award or program in accordance with reporting requirements. The Department must prepare a Schedule of Expenditures of Federal Awards (SEFA) for the period covered by the State’s financial statements which must include the total Federal awards expended. At a minimum, the SEFA must provide total Federal awards expended for each individual Federal program and the Assistance Listing Number (ALN) and include the total amount provided to subrecipients from each Federal program. Condition: The Department of Administrative and Financial Services’ Security and Employment Service Center (SESC) is responsible for accurately recording information needed to report on the Coronavirus State and Local Fiscal Recovery Funds (CSLFRF) Quarterly Project and Expenditure Reports. Information from these CSLFRF reports is used by the Office of the State Controller for SEFA preparation. The Office of the State Auditor reviewed amounts reported on the SEFA and identified $24.1 million of Federal expenditures incorrectly reported as amounts provided to subrecipients that should have been reported as direct expenditures. SESC inaccurately identified vendors as subrecipients. As a result, vendor payments were incorrectly classified as subrecipient payments on the CSLFRF Quarterly Project and Expenditure Reports and were incorrectly included in the initial amount reported on the SEFA as amounts provided to subrecipients. Context: Payments to the providers totaled $24.1 million of the $207.8 million in CSLFRF expenditures. Cause: • Lack of adequate policies and procedures • Lack of supervisory oversight Effect: • Incomplete or inaccurate reporting of expenditures on the CSLFRF reports and SEFA, which are submitted to the Federal government, may result in incorrect information used for programmatic, policy or statistical purposes. • Noncompliance with Federal regulations Recommendation: We recommend that the Department implement policies and procedures to ensure contractors and subrecipients are appropriately classified and reported on the CSLFRF Quarterly Project and Expenditure Reports and SEFA. Corrective Action Plan: See F-27 Management’s Response: The Department agrees with this finding. The Security and Employment Service Center will continue to work with our partner agencies to help ensure the sub-recipient/vendor classification is appropriately determined when the initial contracts are written. Contact: Marilyn Leimbach, Director, Security and Employment Service Center, DFPS, DAFS, 207-248-2556 (State Number: 23-1699-03)

(2023-062) Title: Internal control over Special Education period of performance needs improvement Prior Year Findings: None State Department: Education Administrative and Financial Services State Bureau: Special Services & Inclusive Education General Government Service Center Federal Agency: U.S. Department of Education Assistance Listing Title: Special Education Cluster (IDEA) (COVID-19) Assistance Listing Number: 84.027, 84.173 Federal Award Identification Number: See E-93 to E-94 Compliance Area: Allowable costs/cost principles Period of performance Type of Finding: Material weakness Material noncompliance Questioned costs Known Questioned Costs: $2,446,391 Likely Questioned Costs: Undeterminable; the exceptions noted in our sample represent nonroutine transactions; therefore, the projection of questioned costs utilizing the error rate related to known exceptions and amounts tested would not produce a reasonable estimate of likely questioned costs. Criteria: 2 CFR 200.303; 2 CFR 200.344; 2 CFR 200.403; 34 CFR 76.703 and .709 The Department must establish and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. Unless the Federal awarding agency authorizes an extension, the Department must liquidate all financial obligations incurred under the Federal award no later than 120 calendar days after the end date of the period of performance as specified in the terms and conditions of the Federal award. To be allowable under Federal awards, costs must be necessary and reasonable for the performance of the Federal award and be adequately documented. The Department must obligate Federal award funds during the 27-month period of performance, extending from July 1 of the fiscal year for which the funds were appropriated through September 30 of the second following fiscal year. Condition: The Department of Education’s (DOE) Office of Special Services & Inclusive Education, in conjunction with the Department of Administrative and Financial Services’ General Government Service Center (GGSC), administers Federal funding received through the Special Education Cluster (SEC) program. The SEC program provides grants to states, and through them to Local Education Agencies (LEAs), to assist in providing special education and related services to eligible children. DOE and GGSC review and approve requests for reimbursement from LEAs and invoices for other costs including payroll, administrative expenditures, and awards to subrecipients of State-level activities. This review includes a determination of whether the costs are obligated within the applicable Federal award’s period of performance through a comparison of billing dates and billing periods to grant award terms. Period of performance compliance requirements applicable to the SEC program in fiscal year 2023 relate to the Federal fiscal year 2021 grant award. The award’s obligation period ended September 30, 2022, and the liquidation period ended 120 calendar days following, on January 28, 2023. The Office of the State Auditor (OSA) tested 43 expenditure transactions that occurred during the Federal fiscal year 2021 grant award’s liquidation period to ensure that the expenditures were obligated and liquidated in accordance with Federal regulations, and identified the following: • Six transactions related to an obligation that occurred after the end of the period of performance. Upon further review, OSA determined that the full obligation included 20 transactions totaling $1.7 million. • Three obligations totaling $742,668 were liquidated after expiration of the liquidation period. The above-noted transactions did not meet the Federal fiscal year 2021 grant award’s period of performance requirements and are not allowable under the terms of the award. As a result, OSA identified questioned costs totaling $2.4 million. OSA selected a non-statistical random sample. Context: In fiscal year 2023, the Department expended $71.6 million in SEC program funds. Of this total, $5.1 million of Federal fiscal year 2021 grant funds was expended during the award’s liquidation period which occurred during fiscal year 2023. The identified questioned costs of $2.4 million represent approximately 47 percent of the award funds expended during the liquidation period. Cause: • Lack of adequate policies and procedures • Lack of supervisory oversight Effect: • Known questioned costs • Potential future questioned costs and disallowances • Noncompliance with Federal regulations Recommendation: We recommend that the Department enhance policies and procedures to ensure that obligation and liquidation of grant funds are made within period of performance requirements established in the terms and conditions of Federal grant awards. Corrective Action Plan: See F-27 Management’s Response: The Department agrees with this finding. The Department will review and implement stronger internal controls to ensure obligations and final payments are made within the period of performance requirements. Regarding the 20 transactions totaling $1.7 million, all expenditures reimbursed were within the period of performance, however there was a lengthy delay in determining the final payment mechanism. Due to this delay, the final obligation date in Advantage was outside of the grant's date of obligation. Contact: Nicole Denis, Director of Finance, DOE, 207-530-2161 (State Number: 23-1201-02)

(2023-063) Title: Internal control over Special Education subrecipient audit procedures needs improvement Prior Year Findings: None State Department: Education State Bureau: Commissioner’s Office Special Services & Inclusive Education Federal Agency: U.S. Department of Education Assistance Listing Title: Special Education Cluster (IDEA) (COVID-19) Assistance Listing Number: 84.027, 84.173 Federal Award Identification Number: See E-93 to E-94 Compliance Area: Subrecipient monitoring Type of Finding: Significant deficiency Questioned Costs: None Criteria: 2 CFR 200.303; 2 CFR 200.332; 2 CFR 200.521 The Department must establish and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. The Department must follow-up and ensure that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the Federal award provided to the subrecipient from the pass-through entity detected through audits, on-site reviews, and written confirmation from the subrecipient, highlighting the status of actions planned or taken to address Single Audit findings related to the particular subaward. The Department must issue a management decision for audit findings that relate to Federal awards provided to the subrecipient within six months of acceptance of the audit report by the Federal Audit Clearinghouse. Condition: The Department of Education’s (DOE) School Finance and Operations team within the Commissioner’s Office, in conjunction with DOE’s Office of Special Services & Inclusive Education, is responsible for tracking and reviewing subrecipient audits and issuing management decisions on Special Education Cluster (SEC) subrecipient audit findings. SEC program subrecipients consist of Local Education Agencies and organizations that are provided Federal funding for special education programs. The Office of the State Auditor (OSA) reviewed 23 SEC subrecipients to ensure proper tracking and review of Single Audit Reports, audit findings, and DOE management decisions in response to findings related to SEC funding. For 2 of the 23 subrecipients, OSA requested documentation of management decisions pertaining to findings included in the Single Audit Reports. DOE could not provide management decision letters documenting consideration, review, and approval of the subrecipients’ corrective action plans. OSA selected a non-statistical random sample. Context: In fiscal year 2023, the Department expended $71.6 million in SEC program funds, of which $66.8 million was provided to 258 subrecipients. Based on OSA’s review, approximately 120 subrecipients were required to undergo a Single Audit in accordance with Federal regulations. Cause: • Lack of adequate policies and procedures • Lack of supervisory oversight Effect: • Noncompliance with Federal regulations • Subrecipients not complying with Federal statutes, regulations, or the terms and conditions of SEC subawards may not be implementing appropriate corrective action in response to audit findings. Recommendation: We recommend that the Department enhance policies and procedures to ensure that adequate documentation is maintained during the review of audit findings, and that management decisions related to audit findings and corrective action are issued timely to subrecipients. Corrective Action Plan: See F-28 Management’s Response: The Department agrees with this finding. The Department will review the current procedure regarding the notification of management decisions related to audit findings and corrective action, to strengthen the areas where prior notifications were missed. Contact: Nicole Denis, Director of Finance, DOE, 207-530-2161 (State Number: 23-1201-01)

(2023-064) Title: Internal control over ESF expenditures needs improvement Prior Year Findings: See schedule of Findings and Questioned Costs for chart/table State Department: Education State Bureau: Office of Federal Emergency Relief Programs Federal Agency: U.S. Department of Education Assistance Listing Title: Education Stabilization Fund (ESF) (COVID-19) Assistance Listing Number: 84.425D, 84.425U Federal Award Identification Number: See E-93 to E-94 Compliance Area: Activities allowed or unallowed Allowable costs/cost principles Type of Finding: Material weakness Material noncompliance Questioned costs Known Questioned Costs: $161,468 Likely Questioned Costs: $7,308,277; likely questioned costs were projected by dividing the known questioned costs in our sample by total expenditures tested to establish an error rate, then applying that error rate to total expenditures paid in fiscal year 2023. Criteria: 2 CFR 200.303; 2 CFR 200.403; Coronavirus Aid, Relief, and Economic Security Act, Public Law No. 116-136; Coronavirus Response and Relief Supplemental Appropriations Act, Public Law No. 116-260; American Rescue Plan Act, Public Law No. 117-2 The Department must establish and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. To be allowable under Federal awards, costs must be necessary and reasonable for the performance of the Federal award and be adequately documented. The Coronavirus Aid, Relief, and Economic Security Act; Coronavirus Response and Relief Supplemental Appropriations Act; and American Rescue Plan (ARP) Act authorized the creation of the Education Stabilization Fund and its subprograms. Governors and State Education Agencies (SEAs) must demonstrate that costs incurred by governors, SEAs, and subrecipients are allowable under the relevant statutory and regulatory provisions, assurances, and certification and agreement, and consistent with the purpose of the Education Stabilization Fund, which is to prevent, prepare for, and respond to COVID-19. Condition: Education Stabilization Funds (ESF) were authorized by Federal legislation for use by school administrative units (SAUs) within the State to prevent, prepare for, and respond to the COVID-19 pandemic. SAUs were required to submit applications to the Office of Federal Emergency Relief Programs (OFERP) under the Department of Education outlining identified uses for ESF including planned projects. Applications included detail on costs and the necessity of costs as a result of the COVID-19 pandemic. Program coordinators within OFERP were responsible for reviewing and approving applications submitted by SAUs. Once there was an approved application on file, SAUs could submit reimbursement requests to the Department for expenditures identified and approved in the application. The Office of the State Auditor (OSA) tested 60 SAU reimbursement requests for ESF and identified the following: • One ARP Elementary and Secondary School Emergency Relief (ESSER) subprogram reimbursement request included an invoice for a tractor purchase totaling approximately $91,000. The SAU’s approved application stated that the purpose of the tractor purchase was to help with lawn mowing, snow removal, and outdoor maintenance so that the school could safely engage in more outdoor learning. • One ARP ESSER subprogram reimbursement request included an invoice for a paving project totaling $47,500. The paving project was included in the SAU’s approved application. The reimbursement request outlined that the “paving improvements in [the] bus area [were] to help facilitate with disinfecting and cleaning of buses.” • Supporting documentation for OFERP’s review prior to approval of one ESSER II subprogram reimbursement request totaling $22,896 was not maintained. OSA was able to verify the allowability of the costs based on documentation provided by OFERP during audit testing. • One ARP ESSER subprogram reimbursement request included oil and electricity utility bills totaling $14,710. • One ESSER II subprogram reimbursement request included oil and electricity utility bills totaling $8,258. All subrecipients had an approved application on file with OFERP. The applications and the invoices were approved for reimbursement by OFERP. The purpose of ESF is to prevent, prepare for, and respond to COVID-19. The project descriptions and supporting documentation for the tractor purchase and paving project provided by the SAU and maintained by the Department do not demonstrate that these reimbursements are a reasonable use of funds consistent with the purpose of ESF. In addition, utility bills such as oil and electricity are routine costs that are supported by a SAU’s annual operating budget, and these reimbursements are not consistent with the purpose of ESF. OSA selected a non-statistical random sample. Context: In fiscal year 2023, ESF expenditures totaled $178.2 million, of which $167.8 million was paid to subrecipient SAUs. Cause: • Lack of established policies and procedures to ensure that only necessary expenditures are charged to the Federal program • Misinterpretation of Federal regulations Effect: • Noncompliance with Federal regulations • Known questioned costs • Potential future questioned costs and disallowances Recommendation: We recommend that the Department review all expenditures reimbursed using ESF to ensure that only allowable costs are charged to the Federal program. Expenditures that do not meet ESF criteria for allowability should be transferred out of ESF. Corrective Action Plan: See F-28 Management’s Response: The Maine Department of Education (MDOE) disagrees with the identified questioned costs. The FERP utilized guidance provided by the U.S. Department of Education (grantor) and conferred in writing with Maine’s assigned U.S. Department of Education program officer throughout the Education Stabilization Fund application review process. The Maine Department of Education’s FERP provided the auditor with the grantor’s guidance which clearly states that the questioned costs were allowable, reasonable, and necessary to prepare, prevent, and respond to the COVID-19 pandemic. Throughout the application review process, FERP utilized ESF federal statutory language and the grantor’s published guidance to determine allowability. Once funding applications were approved, SAUs requested reimbursement from the FERP for the approved costs outlined in the school administrative unit (SAU) application. The FERP reviewed SAU reimbursement requests and provided payment for approved expenses. The ESF costs outlined in this finding were allowable, reasonable, and necessary to prepare, prevent, and respond to the COVID-19 pandemic. Contact: Shelly Chasse-Johndro, Director of OFERP, DOE, 207-458-3180 Auditor’s Concluding Remarks: Documentation provided by the Department for the reimbursements totaling $161,468 did not provide adequate evidence that the expenditures were reasonable, necessary, and in line with the allowability criteria of ESF, as outlined below: • A $91,000 tractor purchase is not a reasonable or necessary use of funds in response to a need directly arising from the public health emergency. While outdoor learning space may have been expanded in response to COVID-19, lawn mowing, snow removal, and outdoor maintenance are routine costs of the SAU. • A $47,500 paving project is not a reasonable or necessary use of funds in response to a need directly arising from the public health emergency. There is no direct correlation between paving improvements and disinfecting and cleaning of buses. • $22,968 in oil and electricity bill reimbursements are not reasonable or necessary uses of funds in response to needs directly arising from the public health emergency. Utility bills are routine costs that are supported by a SAU’s annual operating budget. Federal guidance for the ESF program does not clearly state that the expenditures noted as questioned costs are allowable, reasonable, and necessary to prevent, prepare for, and respond to COVID-19. Furthermore, the Department did not provide grantor guidance to OSA as stated in Management’s Response. To be allowable under Federal awards, costs must be necessary and reasonable for the performance of the Federal award and be adequately documented. Without documentation and evidence to substantiate that the expenditures are necessary and reasonable in response to needs directly arising from the public health emergency, OSA cannot determine that the reimbursements were consistent with the purpose of ESF; therefore, OSA continues to question the allowability of these costs. The finding remains as stated. (State Number: 23-1235-03)

(2023-065) Confidential finding, see below for more information Title: ________ over the ________ and ________ needs improvement Pursuant to paragraph 6.63 of the U.S. Government Accountability Office’s Government Auditing Standards (also known as the Yellow Book), we omitted details from this finding as they are confidential under the provisions of 5 MRSA 244-C (3). Though the content of this finding has been redacted, we provided the Department(s) with detailed information regarding the specific condition we identified, as well as the related criteria, context, causes, effects, and our specific recommendations for improvement. Prior Year Findings: See schedule of Findings and Questioned Costs for chart/table Type of Finding: Material weakness Corrective Action Plan: See F-28 Contact: Shirley Browne, Deputy State Controller, Office of the State Controller, 207-626-8423 (State Number: 23-0909-06)

(2023-066) Title: Internal control over ESF special reporting needs improvement Prior Year Findings: See schedule of Findings and Questioned Costs for chart/table State Department: Education State Bureau: Commissioner’s Office Federal Agency: U.S. Department of Education Assistance Listing Title: Education Stabilization Fund (ESF) (COVID-19) Assistance Listing Number: 84.425C Federal Award Identification Number: See E-93 to E-94 Compliance Area: Reporting Type of Finding: Significant deficiency Questioned Costs: None Criteria: 2 CFR 200.303; 2 CFR 170 The Department must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the Department is managing the award in compliance with Federal statutes, regulations, and the terms and conditions of the award. Agencies must report each subaward that equals or exceeds the first-tier subaward threshold of $30,000 in Federal funds in the public-facing Federal Funding Accountability and Transparency Act (FFATA) Subaward Reporting System (FSRS). Condition: When an amount exceeding the first-tier subaward threshold is awarded to a subrecipient, the Department must collect and enter data into FSRS. The Department provided the Office of the State Auditor (OSA) with all monthly reports submitted in FSRS during fiscal year 2023. The Department could not provide support that Education Stabilization Fund (ESF) subawards submitted in FSRS represented a complete record of all subawards required to be reported, as procedures to reconcile subaward activity and FSRS reporting were not in place. Additionally, in OSA’s test of 36 ESF subawards that exceeded the first-tier subaward threshold, 13 subawards listed an incorrect project description, which is considered a key data element of FFATA reporting. The reported projects associated with the subaward funding did not accurately describe subrecipient activities using Federal funds as required by Federal regulations. OSA selected a non-statistical random sample. Context: During fiscal year 2023, the Department reported 177 first-tier subawards totaling approximately $17 million to ESF subrecipients. All 177 subawards exceeded the first-tier subaward threshold for reporting in FSRS. Cause: • The Department does not have a process in place to ensure that ESF subaward information submitted to FSRS is complete. • Supervisory review did not detect or prevent the errors contained in ESF subaward project descriptions submitted to FSRS. Effect: Inaccurate or incomplete information may be and was reported to the Federal government. This information may be used for programmatic, policy or statistical purposes. Recommendation: We recommend that the Department enhance policies and procedures to ensure all subawards that meet or exceed the first-tier threshold are reported accurately, timely, and in accordance with Federal regulations. Corrective Action Plan: See F-29 Management’s Response: The Department agrees with this finding. The Department has implemented a new procedure in FY24 to review project descriptions and reconcile subawards reported between USA Spending and Advantage. Contact: Nicole Denis, Director of Finance, DOE, 207-530-2161 (State Number: 23-1235-02)

(2023-067) Title: Internal control over ESF subrecipient monitoring procedures needs improvement Prior Year Findings: See schedule of Findings and Questioned Costs for chart/table State Department: Education State Bureau: Commissioner’s Office Federal Agency: U.S. Department of Education Assistance Listing Title: Education Stabilization Fund (ESF) (COVID-19) Assistance Listing Number: 84.425D, 84.425R, 84.425U Federal Award Identification Number: See E-93 to E-94 Compliance Area: Subrecipient monitoring Type of Finding: Significant deficiency Questioned Costs: None Criteria: 2 CFR 200.303; 2 CFR 200.313; 2 CFR 200.332 The Department must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the Department is managing the award in compliance with Federal statutes, regulations, and the terms and conditions of the award. For equipment acquired with Federal funding, records must be maintained that include: • a description and identification number; • the source of funding, including the Federal Award Identification Number; • who holds title and the acquisition date; • the cost of the property, including the percentage of Federal participation in the project costs for the Federal award under which the property was acquired; • the location, use and condition; and • any ultimate disposition data including the date of disposal and sale price of the property. A physical inventory of the property must be taken and the results reconciled with the property records at least once every two years. A control system must be developed to ensure adequate safeguards to prevent loss, damage, or theft of the property. Any loss, damage, or theft must be investigated. The Department must monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. Condition: The Education Stabilization Fund (ESF) provides funding to school administrative units (SAUs) to purchase equipment for use in preventing, preparing for, or responding to the COVID-19 pandemic. SAUs were required to submit applications to the Office of Federal Emergency Relief Programs (OFERP) under the Department of Education outlining identified uses for ESF, including planned equipment purchases. Program coordinators within OFERP were responsible for reviewing and approving applications submitted by SAUs. Once there was an approved application on file, SAUs could submit reimbursement requests to the Department for equipment purchases identified and approved in the application. All SAU equipment purchases reimbursed with ESF are subject to applicable inventory control, log maintenance, and disposition requirements consistent with Federal regulations for equipment and real property management. During fiscal year 2023, the Department did not have policies and procedures in place to track SAU equipment purchases reimbursed with ESF; therefore, the Department does not have assurance that: • a complete and accurate record of all equipment purchased with ESF funds was maintained by each SAU. • proper monitoring activities surrounding subrecipient compliance with Federal regulations for equipment and real property management were conducted. Context: In fiscal year 2023, ESF expenditures totaled $178.2 million, of which $167.8 million was paid to subrecipient SAUs. Cause: • Lack of policies and procedures • Lack of supervisory oversight Effect: • Noncompliance with Federal regulations • Subrecipients may not be in compliance with equipment and real property management requirements. • Assets purchased with ESF funds may not be properly safeguarded or maintained. Recommendation: We recommend that the Department implement policies and procedures to ensure that a complete and accurate record of all equipment purchased under ESF is maintained by the Department and by each SAU. This record should be utilized during subrecipient monitoring activities to verify subrecipient compliance with Federal regulations. Corrective Action Plan: See F-29 Management’s Response: The Department agrees with this finding. The Office of Federal Emergency Relief Programs has developed and will be implementing a procedure to maintain complete and accurate records of all equipment purchased with ESF by each SAU. Contact: Shelly Chasse-Johndro, Director of OFERP, DOE, 207-458-3180 (State Number: 23-1235-04)

(2023-068) Confidential finding, see below for more information Title: ________ over the ________ needs improvement Pursuant to paragraph 6.63 of the U.S. Government Accountability Office’s Government Auditing Standards (also known as the Yellow Book), we omitted details from this finding as they are confidential under the provisions of 5 MRSA 244-C (3). Though the content of this finding has been redacted, we provided the Department(s) with detailed information regarding the specific condition we identified, as well as the related criteria, context, causes, effects, and our specific recommendations for improvement. Prior Year Findings: None Type of Finding: Significant deficiency Corrective Action Plan: See F-29 Contact: Shirley Browne, Deputy State Controller, Office of the State Controller, 207-626-8423 (State Number: 23-0900-07)

(2023-069) Title: Internal control over ICA program subrecipient monitoring procedures needs improvement Prior Year Findings: See schedule of Findings and Questioned Costs for chart/table State Department: Health and Human Services State Bureau: Maine Center for Disease Control & Prevention Federal Agency: U.S. Department of Health and Human Services Assistance Listing Title: Immunization Cooperative Agreements (COVID-19) Assistance Listing Number: 93.268 Federal Award Identification Number: See E-93 to E-94 Compliance Area: Subrecipient monitoring Type of Finding: Material weakness Material noncompliance Questioned Costs: None Criteria: 2 CFR 200.303; 2 CFR 200.332 The Department must establish and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. The Department must: • include Federal award information in the subaward that enables subrecipients to identify the source of the Federal award, as well as certain subrecipient information. • evaluate each subrecipient’s risk of noncompliance with Federal regulations for the purposes of determining the appropriate level of subrecipient monitoring to be performed. • monitor the activities of the subrecipient as necessary to ensure that subawards are used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward, and that subaward performance goals are achieved. Condition: The Department is responsible for ensuring subrecipients comply with Federal requirements by: • reviewing subrecipient grant awards to ensure accurate Federal award identification information is included to allow subrecipients to accurately identify the source of the subawards; • utilizing risk evaluations to determine the appropriate level of monitoring activities to be performed that correspond to the results of those risk evaluations; and • performing ongoing monitoring activities to ensure that the subaward was used for authorized purposes and in compliance with Federal regulations. The Office of the State Auditor (OSA) tested compliance with subrecipient monitoring requirements for eight subrecipients and found that: • three subawards did not properly identify required Federal award information: o one subaward was missing the subrecipient’s Data Universal Numbering System (DUNS) number. o three subawards reported the wrong Assistance Listing Number and title. • two subrecipients were deemed “higher risk” after the Department performed a risk evaluation; however, the Department could not provide documentation to support that additional monitoring activities were performed in response to the “higher risk” designation. • 35 financial reports were required to be completed and submitted for fiscal year 2023 to ensure subawards are used for approved budgeted expenditures; however, 23 could not be provided. • 17 performance reports were required to be completed and submitted for fiscal year 2023 to ensure subaward performance goals are achieved; however, eight could not be provided. The Department could not provide any other documentation to support that subrecipient monitoring procedures to ensure that the subaward was used for authorized purposes occurred during fiscal year 2023. OSA selected a non-statistical random sample. Context: The Department provided $2.7 million to 37 Immunization Cooperative Agreements (ICA) program subrecipients in fiscal year 2023. Cause: • Lack of adequate policies and procedures • Lack of supervisory oversight Effect: • Noncompliance with Federal regulations • Lack of ongoing subrecipient monitoring procedures could result in undetected subrecipient noncompliance. Recommendation: We recommend that the Department enhance policies and procedures to ensure that: • subaward agreements include all required information and are accurate; • risk evaluations are utilized to determine the appropriate level of monitoring activities to be performed; and • ongoing subrecipient monitoring is completed during the subaward and documented. Corrective Action Plan: See F-29 Management’s Response: The Department agrees with this Finding. Presently, the Department engages in at least monthly meetings with subrecipients during which quarterly progress reports, quarterly financial reports, and workplans are reviewed and assessed for compliance. The Department documents its review of subrecipients’ quarterly progress and financial reports in a quarterly review template. Additionally, the Department completes annual monitoring visits with subrecipients to monitor their compliance and documents findings during those visits in a sub monitoring visit template. The Department also meets on an as-needed basis with subrecipients to address emerging challenges and concerns and meet subrecipients’ technical assistance needs to support their compliance. Contact: Eden Silverthorne, Associate Director, Office of Population Health Equity, MeCDC, DHHS, 207-441-1090 (State Number: 23-1118-02)

(2023-070) Confidential finding, see below for more information Title: ________ over ________ and ________ needs improvement Pursuant to paragraph 6.63 of the U.S. Government Accountability Office’s Government Auditing Standards (also known as the Yellow Book), we omitted details from this finding as they are confidential under the provisions of 5 MRSA 244-C (3). Though the content of this finding has been redacted, we provided the Department(s) with detailed information regarding the specific condition we identified, as well as the related criteria, context, causes, effects, and our specific recommendations for improvement. Prior Year Findings: See schedule of Findings and Questioned Costs for chart/table Type of Finding: Material weakness Corrective Action Plan: See F-30 Contact: Shirley Browne, Deputy State Controller, Office of the State Controller, 207-626-8423 (State Number: 23-0906-04)

(2023-071) Title: Internal control over ICA program cash management needs improvement Prior Year Findings: See schedule of Findings and Questioned Costs for chart/table State Department: Administrative and Financial Services State Bureau: Health and Human Services Service Center Federal Agency: U.S. Department of Health and Human Services Assistance Listing Title: Immunization Cooperative Agreements (COVID-19) Assistance Listing Number: 93.268 Federal Award Identification Number: See E-93 to E-94 Compliance Area: Cash management Type of Finding: Significant deficiency Questioned Costs: None Criteria: 2 CFR 200.303; 2 CFR 200.302; 31 CFR 205.33; State Administrative and Accounting Manual (SAAM) Section 50.40.80 The Department must establish and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. Financial records must adequately identify the source and application of funds and provide accountability for all funds, property, and other assets related to the Federally funded activities. The Department must minimize the time between the drawdown of Federal funds and the disbursement of these funds for Federal program purposes. The timing and amount of fund transfers must be as close as administratively feasible to the Department’s actual cash outlay for program costs. Section 50.40.80 of the SAAM has defined administratively feasible as no more than seven business days. Condition: The Department of Health and Human Services’ Service Center (DHHS SC) is responsible for the drawdown of funds for the Immunization Cooperative Agreements (ICA) program. The DHHS SC requests Federal funds to pay for ICA program expenditures utilizing a system report of expenditures. This report includes both expenditures that have been paid and expenditures that are pending payment. Expenditures that are pending payment can take additional time to process. In the Office of the State Auditor’s (OSA) testing of 40 Federal drawdowns, three drawdowns of Federal funds for the ICA program were beyond the administratively feasible requirement for disbursement, ranging from 10 to 12 days after the receipt of Federal funds. OSA selected a judgmental and a non-statistical random sample. In addition, DHHS SC personnel did not take the existing cash balance into consideration when requesting Federal funds for the ICA program for the first two months of fiscal year 2023, resulting in an excess cash balance. Context: In fiscal year 2023, there were 177 Federal grant drawdowns totaling approximately $10 million for the ICA program. The three drawdowns beyond the administratively feasible requirement for disbursement totaled $215,595. Cause: • Lack of adequate policies and procedures • Lack of supervisory oversight Effect: • Noncompliance with Federal regulations • The Federal government may impose more stringent program-specific cash management requirements based on noncompliance. Recommendation: We recommend that the DHHS SC develop and implement policies and procedures to ensure that Federal cash is requested based on immediate cash needs which includes consideration of existing cash balances. We also recommend that the DHHS SC review and revise current policies and include guidance for drawing Federal funds to exclude pending expenditures to ensure that Federal cash is requested based on immediate cash needs. Corrective Action Plan: See F-30 Management’s Response: The Department and its Financial Service Center agree with this finding. Policies and procedures will be reviewed for CMIA, draw procedures and reconciliations. The DHHS Financial Service Center will work to obtain and/or increase estimated revenue within the ICA appropriations. With an approval of estimated revenue, expenses will process first, and federal cash will be drawn after, reducing the risk of CMIA noncompliance as Federal cash will be instantly replenishing the account rather than waiting for invoices to process. Contact: Sarah Gove, Director, DHHS Service Center, DAFS, 207-458-6626 (State Number: 23-1118-01)

(2023-072) Confidential finding, see below for more information Title: ________ over the ________ needs improvement Pursuant to paragraph 6.63 of the U.S. Government Accountability Office’s Government Auditing Standards (also known as the Yellow Book), we omitted details from this finding as they are confidential under the provisions of 5 MRSA 244-C (3). Though the content of this finding has been redacted, we provided the Department(s) with detailed information regarding the specific condition we identified, as well as the related criteria, context, causes, effects, and our specific recommendations for improvement. Prior Year Findings: See schedule of Findings and Questioned Costs for chart/table Type of Finding: Significant deficiency Corrective Action Plan: See F-30 Contact: Shirley Browne, Deputy State Controller, Office of the State Controller, 207-626-8423 (State Number: 23-0906-01)

(2023-073) Title: Internal control over ELC program reporting needs improvement Prior Year Findings: See schedule of Findings and Questioned Costs for chart/table State Department: Health and Human Services State Bureau: Maine Center for Disease Control & Prevention Federal Agency: U.S. Department of Health and Human Services Assistance Listing Title: Epidemiology and Laboratory Capacity for Infectious Diseases (ELC) (COVID-19) Assistance Listing Number: 93.323 Federal Award Identification Number: See E-93 to E-94 Compliance Area: Reporting Type of Finding: Significant deficiency Questioned Costs: None Criteria: 2 CFR 200.303; 2 CFR 200.302; 2 CFR 200.329 The Department must establish and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. The Department must maintain accurate, current, and complete disclosure of the financial results of each Federal award or program in accordance with reporting requirements. The Department must submit performance reports at the interval required by the Federal awarding agency or pass-through entity to best inform improvements in program outcomes and productivity. Condition: The purpose of the Epidemiology and Laboratory Capacity for Infectious Diseases (ELC) program is to protect public health and safety by enhancing the capacity of public health agencies to effectively detect, respond to, prevent, and control known and emerging infectious diseases. The Maine Center for Disease Control & Prevention (MeCDC) administers the ELC program and is responsible for the preparation, accuracy, and submission of financial and performance reports to the Federal awarding agency. Financial Reports The Office of the State Auditor (OSA) reviewed seven of the 33 financial reports due in fiscal year 2023 and found that adequate documentation to support that four of the reports had been reviewed prior to submission could not be provided. OSA selected a non-statistical random sample. Performance Reports The Department was required to submit performance reports for three grants during fiscal year 2023. MeCDC provided the submitted reports; however, adequate supporting documentation could not be provided. Context: During fiscal year 2023, 33 financial reports and performance reports for three grants were required to be filed for the ELC program. Cause: • Lack of adequate policies and procedures • Lack of supervisory oversight Effect: Without documentation in support of ELC program reporting requirements, the timeliness and veracity of procedures to ensure compliance cannot be verified; therefore, incorrect or incomplete data may be reported to the Federal government Recommendation: We recommend that MeCDC enhance policies and procedures to ensure that documentation to support the accuracy and completeness of performance and financial reports is retained to demonstrate compliance with Federal reporting requirements. Corrective Action Plan: See F-31 Management’s Response: The Department agrees with this finding. With each quarterly financial reporting due on the 20th of each subsequent month (November, February, May, and August), the Maine CDC will submit quarterly financial reports for internal review by the 10th of the pertinent month. The internal reviewer will have until the 18th to review and submit corrections, for reporting to be inputted into CAMP. A confirmatory email for the process will be issued to record the examination of financial reporting. For performance reporting, quantitative data is pulled for each report, however data cleaning of the quantitative data is ongoing and a requirement from the Federal CDC. Data pulled for each report will only be accurate at the point in time when the data is pulled. Each year's data is not finalized until six plus months after the year ends. The Federal CDC does not require past reports to be reposted and updated as data cleaning occurs after the initial report is filed. For performance reporting of qualitative data, each team holds a quarterly meeting to review the milestones and provide updates. These meetings will now be recorded and will be available to audit upon request. For any qualitative milestone where progress is made on any given period, the Maine CDC will ensure there is a documented note associated with the percentage completeness selected to further document the recorded value. Contact: Sara Robinson, Infectious Disease Program Manager, DHHS, 207-287-4610 (State Number: 23-1156-02)

(2023-074) Title: Internal control over ELC program cash management needs improvement Prior Year Findings: See schedule of Findings and Questioned Costs for chart/table State Department: Health and Human Services Administrative and Financial Services State Bureau: Maine Center for Disease Control & Prevention Health and Human Services Service Center Federal Agency: U.S. Department of Health and Human Services Assistance Listing Title: Epidemiology and Laboratory Capacity for Infectious Diseases (ELC) (COVID-19) Assistance Listing Number: 93.323 Federal Award Identification Number: See E-93 to E-94 Compliance Area: Cash management Type of Finding: Significant deficiency Questioned Costs: None Criteria: 2 CFR 200.303; 31 CFR 205.33; State Administrative and Accounting Manual (SAAM) Section 50.40.80 The Department must establish and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. The Department must minimize the time between the drawdown of Federal funds and the disbursement of these funds for Federal program purposes. The timing and amount of fund transfers must be as close as administratively feasible to the Department’s actual cash outlay for program costs. Section 50.40.80 of the SAAM has defined administratively feasible as no more than seven business days. Condition: The Department of Health and Human Services’ (DHHS) Service Center (SC) provides services including human resources, payroll, accounting, and finance to programs administered by DHHS, including the Epidemiology and Laboratory for Infectious Diseases (ELC) program. The DHHS SC requests Federal funds to reimburse ELC program expenditures utilizing a system report of expenditures. This report includes both expenditures that have been paid and expenditures that are pending payment. Expenditures that are pending payment can take a significant amount of time to process. In the Office of the State Auditor’s (OSA) testing of 51 Federal drawdowns, four drawdowns of Federal funds for the ELC program were beyond the administratively feasible requirement for disbursement. Disbursements ranged from 8 to 11 days after the receipt of Federal funds. OSA selected a non-statistical random sample. Context: In fiscal year 2023, there were 211 Federal grant drawdowns for the ELC program totaling $39.4 million. The four drawdowns beyond the administratively feasible requirement for disbursement totaled $1.1 million. Cause: • Lack of adequate policies and procedures • Lack of supervisory oversight Effect: • Noncompliance with Federal regulations • The Federal government may impose more stringent program-specific cash management requirements based on noncompliance. Recommendation: We recommend that the DHHS SC review and revise current policies and include guidance for drawing Federal funds to exclude pending expenditures to ensure that Federal cash is requested based on immediate cash needs. Corrective Action Plan: See F-31 Management’s Response: The DHHS and the DHHS Financial Service Center agree with this finding. As of July 1st, 2023, a Treasury State Agreement was put in place and estimated revenue was established for all appropriations related to the ELC program. Federal cash requests are now following the Treasury State Agreement and funds are being drawn weekly based upon actual expenditures. The DHHS Financial Service Center will update procedures for CMIA, Federal cash requests and reconciliations related to the ELC program to include the guidance of the Treasury State Agreement and weekly draw process. Contact: Sarah Gove, Director, DHHS Service Center, DAFS, 207-458-6626 (State Number: 23-1156-01)

(2023-075) Title: Internal control over payments made to and on behalf of TANF clients needs improvement Prior Year Findings: See schedule of Findings and Questioned Costs for chart/table State Department: Health and Human Services State Bureau: Office for Family Independence Federal Agency: U.S. Department of Health and Human Services Assistance Listing Title: Temporary Assistance for Needy Families (TANF) Assistance Listing Number: 93.558 Federal Award Identification Number: See E-93 to E-94 Compliance Area: Activities allowed or unallowed Allowable costs/cost principles Type of Finding: Material weakness Material noncompliance Questioned costs Known Questioned Costs: $4,721 Likely Questioned Costs: $279,992; likely questioned costs were projected by dividing the identified known overpayment in our sample by total payments tested to establish an error rate, then applying that error rate to total payments to Temporary Assistance for Needy Families (TANF) clients for services and payments to providers on behalf of TANF clients in fiscal year 2023. Criteria: 2 CFR 200.303; 2 CFR 200.403; 45 CFR 263.11 The Department must establish and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. To be allowable under Federal awards, costs must be necessary and reasonable for the performance of the Federal award and be adequately documented. The Department must use Federal TANF funds for expenditures that are reasonably calculated to accomplish the purposes of TANF. Use of funds in violation of this is considered misuse of funds. Condition: The Department issues TANF payments directly to a TANF client for various items and services. The Department also issues TANF payments directly to providers on behalf of TANF clients for services rendered such as child care and transportation. The Office of the State Auditor (OSA) tested 60 payments and found that: • one payment issued in September 2022 underpaid a provider by $1 for Transitional Child Care (TCC). Upon further review, OSA found an additional $666 overpaid to the childcare provider during fiscal year 2023, thus OSA is questioning costs totaling $665. Both the underpayment and overpayment were identified by OSA during audit testing. • one payment issued in November 2022 correctly paid a provider $154 for TCC. Upon further review, OSA found that the Department received income documentation for the client after the payment was made which would decrease future weekly TCC payments. The Department did not recalculate the TCC payment as required, and as a result, an additional $1,020 was overpaid to the childcare provider during fiscal year 2023, thus OSA is questioning costs totaling $1,020. The overpayment was identified by OSA during audit testing. • one payment issued in November 2022 overpaid a provider by $7 for TCC. Upon further review, OSA found an additional $210 overpaid to the childcare provider during fiscal year 2023, thus OSA is questioning costs totaling $217. The overpayment was identified by OSA during testing. • one payment issued in January 2023 overpaid a TANF client a total of $247 for clothing. An advance allowance of $300 was issued to the TANF client, and the TANF client submitted receipts substantiating purchases of $53. The Department sent a letter to the client requesting receipts for the unsubstantiated amount but did not establish an overpayment. OSA is questioning costs totaling $247. The overpayment was identified by OSA during testing. • one payment issued in March 2023 correctly paid a provider $13 for TCC. Upon further review, OSA found that the Department received income documentation for the client after the payment was made which would decrease future weekly TCC payments. The Department did not recalculate the TCC payment as required and as a result, an additional $156 was overpaid to the childcare provider during fiscal year 2023, thus OSA is questioning costs totaling $156. The overpayment was identified by OSA during audit testing. • one payment issued in April 2023 correctly paid a provider $138 for TCC. Upon further review, OSA found that the Department received income documentation for the client after the payment was made which would decrease future weekly TCC payments. The Department did not recalculate the TCC payment as required and as a result, an additional $88 was overpaid to the childcare provider during fiscal year 2023, thus OSA is questioning costs totaling $88. The overpayment was identified by OSA during audit testing. In addition, Department controls identified the following overpayments. Because these payments were not in accordance with Federal regulations and the Department has not recouped the funds, OSA is questioning the costs: • one payment issued in September 2022 overpaid a TANF client by $150 for clothing. An advance allowance of $150 was issued to the TANF client; however, the TANF client did not submit a receipt substantiating the purchase as required. The Department identified the overpayment in March 2023, thus OSA is questioning costs totaling $150. • one payment issued in September 2022 overpaid a provider by $104 for TCC. Upon further review, OSA found an additional $2,074 overpaid to the childcare provider during fiscal year 2023, thus OSA is questioning costs totaling $2,178. The Department identified the overpayment in October 2022. OSA selected a non-statistical random sample. Context: In fiscal year 2023, payments to TANF clients for services other than direct cash benefits and payments to providers on behalf of TANF clients totaled $8.3 million. Cause: • Lack of adequate procedures • Lack of supervisory oversight Effect: • Known questioned costs • Potential future questioned costs and disallowances • Noncompliance with Federal regulations Recommendation: We recommend that the Department: • implement additional procedures to ensure that payments made to TANF clients and providers are accurate, allowable, and adequately documented; • increase monitoring procedures over these payments; and • establish recoupments of overpayments in instances where they have not yet been established. Corrective Action Plan: See F-31 Management’s Response: OFI disagrees with this finding. OSA’s interpretation of federal regulation regarding the recoupment of overpaid funds is incorrect, and benefit overpayments are identified and processed by OFI in compliance with federal regulation and policy. Overpayments are required to be recouped in the shortest timeframe possible, but the recoupment amount cannot exceed the standards as set by policy. Neither state policy nor federal regulation requires an overpayment to be recouped within the same state fiscal year it is identified, so it was not appropriate for OSA to include as questioned costs on that basis the two cases where recoupment did not occur in the same fiscal year that the overpayment was established. Further, OFI disputes how OSA calculated the questioned costs. Three of the payments tested by OSA were found to be correct at the time of issuance. OSA then reviewed all payments during the state fiscal year for the three cases and stated that parent fees should have been adjusted based on documentation in DocuWare. Transitional Child Care does not require changes in income to be reported during the certification period unless the gross income exceeds 250% of the federal poverty level (MPAM, Ch. V, A, (6)), and adjustment of the parent fees were not required for these cases. They should not be included in the list of exceptions. While OSA cites MPAM, Ch. V, A (6), “TCC payments remain constant until a redetermination is completed, or until the recipient or child care provider reports a change that affects the amount of TCC benefits (emphasis added)” the reported change did not affect the amount of TCC benefits. Contact: Ian Yaffe, Director, Office for Family Independence, DHHS, 207-592-1481 Auditor’s Concluding Remarks: The Office for Family Independence (OFI) has misconstrued the finding. OSA does not expect the Department to recoup funds within the year they are identified. OSA does expect that when the Department identifies overpayments, recoupments are established for those overpayments. While OSA agrees that the Department identified two of the eight overpayments as noted in the finding, OFI did not take action and appropriately establish a related recoupment to ensure that funds would be recovered. Had appropriate action been taken by OFI, OSA would not have questioned the costs. Regarding the three cases “found to be correct at the time of issuance” in relation to the calculation of questioned costs: • OSA understands TCC payments do not require changes in income to be reported during the certification period unless the gross income exceeds 250 percent of the Federal poverty level; however, this is the reporting responsibility of the client, not the State. • Management’s Response cites Ch. V, A, (6) of the Department’s Maine Public Assistance Manual (MPAM) which states TCC payments remain constant until a redetermination is completed, or until the recipient or childcare provider reports a change that affects the amount of TCC benefits. For the three cases, the recipient self-reported a change in income. The Department did not recalculate the TCC payment, resulting in the childcare provider being overpaid during fiscal year 2023. The finding remains as stated. (State Number: 23-1111-03)

(2023-076) Title: Internal control over Income Eligibility and Verification System procedures needs improvement Prior Year Findings: See schedule of Findings and Questioned Costs for chart/table State Department: Health and Human Services State Bureau: Office for Family Independence Federal Agency: U.S. Department of Health and Human Services Assistance Listing Title: Temporary Assistance for Needy Families (TANF) Assistance Listing Number: 93.558 Federal Award Identification Number: See E-93 to E-94 Compliance Area: Eligibility Special tests and provisions Type of Finding: Material weakness Material noncompliance Questioned Costs: None Criteria: 2 CFR 200.303; 45 CFR 205.56 The Department must establish and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. The Department is required to comply with Federal Income Eligibility and Verification System (IEVS) exchange rules and regulations in accordance with program agreements. The Department is required to resolve all discrepancies identified through IEVS reports within 45 days of receipt. Condition: IEVS is used to exchange information among State and Federal agencies to verify various information needed to determine eligibility for Federal financial assistance. This information is updated in the Automated Client Eligibility System (ACES) to ensure eligibility determinations are made based on current information. IEVS generates various discrepancy reports on a weekly, monthly, and quarterly basis. The Department is required to resolve all discrepancies identified through IEVS reports within 45 days of receipt. Federal guidance over the Temporary Assistance for Needy Families (TANF) program outlines audit procedures to ensure that the State has established and implemented the required IEVS exchange for data matching and verification of such data. These procedures include testing a sample of TANF cases subject to IEVS. The Office of the State Auditor (OSA) requested a list of TANF cases subject to IEVS for testing purposes; in response, the Department provided OSA with all IEVS discrepancy reports run in fiscal year 2023. The reports provided by the Department contain cases for TANF, SNAP, and Medicaid/Medicare, and do not have a specific Federal program indicator. The Department was unable to provide OSA with a report that isolates TANF-specific cases subject to IEVS. Without a population of TANF-specific cases for fiscal year 2023, OSA is unable to verify that the program is in compliance with Federal requirements. Context: 224 IEVS reports are required to be generated annually. The number of discrepancies on each report can vary from zero to approximately 20,000. The Department cannot determine the number of discrepancies related to TANF. Cause: • Lack of resources • Lack of adequate procedures to ensure that an accurate report of TANF cases subject to IEVS can be provided Effect: • IEVS information may not be updated timely in ACES, which could result in incorrect eligibility determinations. • Failure to maintain documentation to support compliance with required TANF exchange rules may result in the U.S. Department of Health and Human Services penalizing the State up to two percent of the grant award. Recommendation: In October 2023, the Department updated procedures and added a Federal program indicator field to the IEVS discrepancy reports which will enable the Department to isolate TANF-specific cases subject to IEVS. Therefore, we recommend that the Department monitor newly employed procedures to ensure that they are properly implemented and IEVS discrepancy reports can be provided for TANF-specific cases. Corrective Action Plan: See F-32 Management’s Response: The Department disagrees with this finding. The Office for Family Independence (OFI) has conducted the required IEVS eligibility verifications. Additionally, sufficient evidence of these efforts has been provided to the Office of the State Auditor so that audit procedures can be performed in accordance with Federal regulations. The finding does not articulate any deficiency in OFI policy or practice with respect to federal IEVS requirements. The Office of the State Auditor (OSA) takes exception with OFI’s identified population from which to test a sample. It is our position that OSA could have identified a complete population to test from the information that OFI provided this year and last year. That information included: • A report of all TANF cases “subject to the IEVS requirement” in the audit period and • All the IEVS reports in our possession, which would allow OSA to cross-reference whether sampled TANF cases were identified in a discrepancy report and should have had IEVS-related activity reflected in ACES during the audit period. We also provided access to ACES, which would allow OSA to review sampled TANF cases in detail to determine whether IEVS activity occurred appropriately on the case during the audit period. Contact: Ian Yaffe, Director, Office for Family Independence, DHHS, 207- 592-1481 Auditor’s Concluding Remarks: 2 CFR 200.303 requires the Department to establish and maintain effective internal control over Federal awards. 45 CFR 205.56 requires the Department to comply with Federal IEVS exchange rules and regulations. The Department did not demonstrate effective internal control over the TANF program or provide documentation to support required components for participation in IEVS. Federal guidance requires OSA to develop audit procedures to test a sample of TANF cases subject to IEVS. OFI could not provide a population of TANF cases subject to IEVS in order to draw a sample for testing purposes. In response to the materials provided to OSA by OFI: • “A report of all TANF cases subject to the IEVS requirement in the audit period.” This list includes all TANF eligible clients for fiscal year 2023 subject to IEVS; however, not all TANF eligible clients are reported on IEVS discrepancy reports. Therefore, this listing does not isolate the correct population and cannot be utilized for audit testing. • “All the IEVS reports in our possession, which would allow OSA to cross-reference whether sampled TANF cases were identified in a discrepancy report and should have had IEVS-related activity reflected in ACES during the audit period.” As stated in the Condition, the IEVS discrepancy reports provided by the Department contain cases for Medicaid, SNAP, and TANF, and do not have a specific Federal program indicator to delineate TANF-specific cases. It is unreasonable for OFI to suggest that OSA crosswalk information to prepare a population for audit testing as this would impair auditor independence. Auditor independence is defined in and required by Government Auditing Standards issued by the Comptroller General of the United States. The reports provided do not identify the correct population and cannot be utilized for audit testing. • “We also provided access to ACES, which would allow OSA to review sampled TANF cases in detail to determine whether IEVS activity occurred appropriately on the case during the audit period.” This provides OSA with access to ACES for audit testing purposes; however, as noted above, OSA was not provided the information requested in order to complete required audit testing. OFI is responsible for coordinating data exchanges with Federally-assisted benefit programs and requesting and using income and benefit information when making TANF eligibility determinations. Without a complete and accurate population of TANF cases subject to IEVS, OFI cannot substantiate that: • IEVS data was utilized to appropriately update all TANF cases subject to IEVS in accordance with 45 CFR 205.56; • eligibility determinations for the TANF program are accurate; and • management is properly overseeing compliance with 45 CFR 205.56. Therefore, OFI’s inability to identify and isolate TANF cases subject to IEVS corroborates a deficiency in internal control over compliance with Federal IEVS exchange rules and regulations. Additionally, though the Department has disagreed with the finding, the Department began implementing corrective action in October 2023. The finding remains as stated. (State Number: 23-1111-01)

(2023-077) Title: Internal control over subrecipient cash management needs improvement Prior Year Findings: See schedule of Findings and Questioned Costs for chart/table State Department: Health and Human Services State Bureau: Division of Audit Division of Contract Management Federal Agency: U.S. Department of Agriculture U.S. Department of Health and Human Services Assistance Listing Title: Special Supplemental Nutrition Program for Women, Infants, and Children (WIC) (COVID-19) Immunization Cooperative Agreements (COVID-19) Temporary Assistance for Needy Families (TANF) Assistance Listing Number: 10.557; 93.268; 93.558 Federal Award Identification Number: See E-93 to E-94, E-94 Compliance Area: Cash management Subrecipient monitoring Type of Finding: Material weakness Material noncompliance Questioned Costs: None Criteria: 2 CFR 200.303; 2 CFR 200.305 The Department must establish and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. The Department is required to monitor cash drawdowns by their subrecipients to ensure that the time elapsing between the payment of Federal funds to the subrecipient and the subrecipient’s actual disbursement for program purposes is minimized. Condition: The Department’s Division of Contract Management (DCM) has three methods for providing payments to subrecipients: cost-settled, cost-settled by invoice, and fee-for-service subawards. Cash management requirements are not applicable for fee-for-service subawards. For cost-settled subawards, DCM procedures include making equal advance monthly payments and then reconciling those amounts to the quarterly financial reports submitted by the subrecipient. This procedure does not take into consideration the time elapsing between the payment of Federal funds to the subrecipient and the subrecipient’s actual disbursement for program purposes, and therefore is not in compliance with subrecipient cash management requirements. For “cost-settled by invoice” (reimbursement) subawards, DCM procedures do not require subrecipients to include supporting documentation with monthly requests for reimbursement. As a result, DCM does not have assurance whether payments are for reimbursement or advances. During fiscal year 2023, the Department’s Division of Audit (DOA) performed testing over a sample of payments made to 37 subrecipients deemed high risk by the Department; payments were reviewed for compliance with cash management and allowability requirements. The Office of the State Auditor reviewed DOA’s testing and identified: • eight subrecipients where testing was not completed; therefore, compliance with cash management requirements was not determined. • eight subrecipients where documentation to support cash management testing performed could not be provided. As a result, compliance with subrecipient cash management requirements could not be substantiated. • 13 subrecipients were noted as noncompliant with cash management requirements by DOA; however, corrective action plans have not been established for any of the 13 subrecipients. Therefore, as evidenced above, the Department is not in compliance with subrecipient cash management requirements. Context: In fiscal year 2023, the Department provided: • $31.7 million to subrecipients from TANF grant funds of $91.8 million. TANF’s subawards are either cost-settled, cost-settled by invoice, or fee-for-service. • $6 million to subrecipients from WIC grant funds of $22.4 million. All of WIC’s subawards are cost-settled. • $2.7 million to subrecipients from Immunization Cooperative Agreements grant funds of $24.5 million. Immunization Cooperative Agreement’s subawards are either cost-settled or cost-settled by invoice. Cause: • Lack of adequate subrecipient monitoring procedures • Misinterpretation of Federal regulations Effect: • Noncompliance with subrecipient cash management requirements • Federal programs may not be effectively and efficiently administered. • The Federal government may require the implementation of more stringent subrecipient cash management procedures. Recommendation: We recommend that the Department enhance monitoring procedures to ensure that: • the time elapsing between the payment of Federal funds to the subrecipient and the subrecipient’s actual disbursement for program purposes is minimized for cost-settled subawards. • the payment of Federal funds to the subrecipient is for reimbursement purposes, and not for advance payment, for “cost-settled by invoice” subawards. • corrective action plans are established for subrecipients where noncompliance has been identified. Corrective Action Plan: See F-32 Management’s Response: The Department disagrees with this finding. The Department believes that we are in compliance with the requirement for minimizing the time between payments to our subrecipients and the disbursement is as close as administratively feasible. The Department’s procedures related to cash management include: reconciling payments to expenditures quarterly and monitoring subrecipient’s audits. The Department’s subrecipients not only are required to have Single Audits but also are required to have audited financial statements and audited Schedule of Expenditures of Department Awards at a lower threshold than that of the Single Audit through the Department’s rule, Maine Uniform Accounting and Auditing Practices for Community Agencies (MAAP). This rule also defines a major program at a much lower threshold than the Uniform Guidance, so far more programs get tested annually than just Single Audits alone. Contact: Jim Lopatosky, Director, Division of Contract Management, DHHS, 207-287-5075 Auditor’s Concluding Remarks: The subrecipient monitoring procedures outlined in Management’s Response do not ensure that subrecipients are drawing funds in accordance with Federal cash management requirements, as follows: • The Department does not obtain documentation to support the timing of the subrecipient’s expenditures reported on the quarterly expense reports and to substantiate compliance. • Though reviewing the subrecipient’s MAAP audits and Single Audits for findings is beneficial: o monitoring procedures must be performed during the award period; however, MAAP and Single Audits are completed towards the end or after the grant award period. o MAAP audit requirements do not require testing of all subawards. Therefore, the subrecipient’s cash management may or may not be tested by the subrecipient’s auditor. o it is not guaranteed that cash management will be selected for testing by the subrecipient’s auditor; therefore, relying on the subrecipient’s auditor to discover cash management issues is not an adequate procedure to monitor the subrecipient’s compliance with that requirement. Additionally, Management’s Response does not address specific issues identified by OSA cited in the Condition above. Therefore, the Department was noncompliant with Federal regulation 2 CFR 200.305 that requires monitoring cash drawdowns of subrecipients to ensure that the time elapsing between the payment of Federal funds to the subrecipient and the subrecipient’s actual cash disbursement for program purposes is minimized. The finding remains as stated. (State Number: 23-1111-04)

(2023-078) Title: Internal control over TANF subrecipient risk evaluation procedures needs improvement Prior Year Findings: See schedule of Findings and Questioned Costs for chart/table State Department: Health and Human Services State Bureau: Office for Family Independence Office of Child and Family Services Division of Contract Management Federal Agency: U.S. Department of Health and Human Services Assistance Listing Title: Temporary Assistance for Needy Families (TANF) Assistance Listing Number: 93.558 Federal Award Identification Number: See E-93 to E-94 Compliance Area: Subrecipient monitoring Type of Finding: Material weakness Material noncompliance Questioned Costs: None Criteria: 2 CFR 200.303; 2 CFR 200.332 The Department must establish and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. The Department is required to evaluate each subrecipient’s risk of noncompliance with Federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate subrecipient monitoring described in 2 CFR 200.332. Condition: The Department has established subrecipient monitoring procedures depending on whether the subaward is competitively bid or not. If a subaward is competitively bid, the Department’s Division of Contract Management’s (DCM) Competitive Procurement Unit seeks input from the Department of Health and Human Services’ Service Center, the Department’s Division of Audit, and DCM’s Contracts Unit regarding known issues with the provider who submitted the bid. Those responses are collected and provided to the evaluation team which consists of various program personnel. The subaward agreement is then drafted and the level of subrecipient monitoring is included in the agreement. If a subaward is not competitively bid, the subaward agreement is drafted based on the level of subrecipient monitoring that the Department has established for the provided services. The Office of the State Auditor (OSA) selected seven TANF subrecipients, which included seven subawards that were competitively bid and six subawards that were not competitively bid and found that for: • three competitively bid subawards, DCM provided evidence to support that feedback was solicited from other Bureaus for any known issues or prior noncompliance; however, evidence could not be provided to support the level of subrecipient monitoring that was completed. • four competitively bid subawards, DCM could not provide evidence to support that feedback was solicited from other Bureaus for any known issues or prior noncompliance. In addition, evidence could not be provided to support the level of subrecipient monitoring that was completed. • six non-competitively bid subawards, evidence could not be provided to support the level of subrecipient monitoring that was completed. OSA selected a non-statistical random sample. Context: The Department provided $31.7 million from a total of $91.8 million to TANF subrecipients during fiscal year 2023. Cause: • Lack of adequate policies and procedures • Lack of supervisory oversight Effect: • Without a documented process, subrecipient risk evaluation procedures may not be consistently followed, and documentation may not be adequately maintained. • Subrecipients that are deemed higher risk may not be monitored on a more frequent basis. Conversely, subrecipients that are deemed lower risk may not be monitored on a less frequent basis, which would free resources and time to dedicate towards other higher risk subrecipients. Recommendation: We recommend that the Department: • document procedures that outline the collaborative process with all Bureaus. • implement policies and procedures that require evaluation of each subrecipient’s risk of noncompliance specifically for the purposes of determining the appropriate subrecipient monitoring to be performed. This will ensure subrecipients are monitored appropriately based on risk designation. Corrective Action Plan: See F-33 Management’s Response: The Department disagrees with this finding. The Department has subrecipient monitoring procedures for all of its subrecipients whether they were competitively bid or not. The first assessment of risk, as noted in the finding, is when a subaward is competitively bid. Secondly, another risk assessment built into the Maine Uniform Accounting and Auditing Practices for Community Agencies (MAAP), requires higher risk subrecipients to undergo a higher level of testing. Additionally, there are audit and review requirements at a much lower threshold than that of the Uniform Guidance (UG). Finally, the Social Service Unit of the Division of Audit performs a risk assessment and tests transactions for those subrecipients that have been determined to be higher risk. The Department's subrecipient monitoring procedures ensures that we comply with the UG 200.332(d) Pass-through entity (PTE) monitoring of the subrecipient must include: 1) Review of financial and performance reports. 2) Following-up and ensuring that subrecipients take timely and appropriate action on all deficiencies. 3) Issues management decisions. 4) PTE is responsible for resolving audit findings specifically related to the subaward. Based on the Department's MAAP rules we ensure we comply with UG 200.332(e) Depending on the PTE's assessment of risk, the following tools may be useful: 1) Training and technical assistance. 2) On-site reviews. 3) Arranging for agreed upon procedures. The Department covers #3 by ensuring that all of our subrecipients have a requirement to submit to the Department a/an Audit, Review or Schedule of Expenditures of Department Awards (SEDA). Contact: Jim Lopatosky, Director, Division of Contract Management, DHHS, 207-287-5075 Auditor’s Concluding Remarks: The Department has misinterpreted the Federal regulation cited in this finding. The Department has responded to 2 CFR 200.332(d), which identifies monitoring procedures to be conducted during the subrecipient award period. OSA audited compliance with this during-the-award monitoring requirement and did not identify deficiencies. The Federal regulation that the Department failed to meet is 2 CFR 200.332(b). This regulation identifies procedures to be performed prior to monitoring procedures in order to determine the level of monitoring required for each subrecipient. 2 CFR 200.332(b) states that the Department must evaluate each subrecipient’s risk of noncompliance with Federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate subrecipient monitoring, which may include consideration of factors such as: • the subrecipient’s prior experience with the same or similar subawards; • the results of previous audits including whether or not the subrecipient receives a Single Audit, and the extent to which the same or similar subaward has been audited as a major program; • whether the subrecipient has new personnel or new or substantially changed systems; and • the extent and results of Federal awarding agency monitoring. The Department did not provide any documentation to support that monitoring procedures performed were based on an evaluation of the subrecipient’s risk of noncompliance. The finding remains as stated. (State Number: 23-1111-05)

(2023-079) Confidential finding, see below for more information Title: ________ over the ________ needs improvement Pursuant to paragraph 6.63 of the U.S. Government Accountability Office’s Government Auditing Standards (also known as the Yellow Book), we omitted details from this finding as they are confidential under the provisions of 5 MRSA 244-C (3). Though the content of this finding has been redacted, we provided the Department(s) with detailed information regarding the specific condition we identified, as well as the related criteria, context, causes, effects, and our specific recommendations for improvement. Prior Year Findings: See schedule of Findings and Questioned Costs for chart/table Type of Finding: Material weakness Corrective Action Plan: See F-33 Contact: Shirley Browne, Deputy State Controller, Office of the State Controller, 207-626-8423 (State Number: 23-0905-03)

(2023-080) Title: Internal control over TANF client child support sanction procedures needs improvement Prior Year Findings: See schedule of Findings and Questioned Costs for chart/table State Department: Health and Human Services State Bureau: Office for Family Independence Federal Agency: U.S. Department of Health and Human Services Assistance Listing Title: Temporary Assistance for Needy Families (TANF) Assistance Listing Number: 93.558 Federal Award Identification Number: See E-93 to E-94 Compliance Area: Special tests and provisions Type of Finding: Significant deficiency Questioned Costs: None Criteria: 2 CFR 200.303; 45 CFR 264.30; 42 USC 608(a)(2) The Department must establish and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. If the Department determines that an individual is not cooperating with child support enforcement requirements, the Department is required to sanction the individual by deducting an amount equal to not less than 25 percent from the Temporary Assistance for Needy Families (TANF) assistance that would otherwise be provided to the family of the individual and may deny the family any TANF assistance. Condition: The Department’s Division of Support Enforcement and Recovery (DSER) is responsible for enforcing child support requirements. DSER staff initiate a sanction memo in the Child Support Enforcement of Maine (CSEME) system indicating the date of noncooperation, and send email notifications to TANF personnel when individuals not cooperating with child support enforcement requirements are identified. If TANF personnel determine that the individual needs to be sanctioned after reviewing the individual’s case, they will process the sanction request in the Automated Client Eligibility System (ACES). Federal guidance requires the Office of the State Auditor (OSA) to develop audit procedures in order to test a sample of cases referred to TANF by DSER. OSA requested a list of sanction requests from DSER for testing purposes. In response to this request, DSER provided a report of all sanction memos initiated in the CSEME system with dates of noncooperation during fiscal year 2023. Because OSA is also required to evaluate the report to ensure that the population provided is accurate and complete, a report from TANF personnel of DSER noncooperation sanctions applied during fiscal year 2023 was also requested and a cross-match was performed. OSA identified 128 sanctions on the TANF-provided report that were not included on the DSER-provided report. OSA selected a sample of 15 of these discrepancies for further review and identified the following exceptions: • eight cases where a sanction memo initiated during fiscal year 2023 was provided to TANF; however, these eight cases were not included on the DSER-provided report. • two cases where TANF received an email referral from DSER; however, these two cases were not included on the DSER provided report. • two cases where OFI stated the child support noncooperation sanction was initiated by TANF personnel; however, ACES case notes for both cases state that email referrals from DSER requesting child support noncooperation sanctions were received. Both cases were not included on the DSER provided report. As evidenced above, if OSA had relied on the DSER-provided report for testing purposes, an unknown number of sanction requests would have been omitted to ensure compliance with child support sanction requirements. Therefore, OSA cannot rely on the population provided by the Department for audit testing as the population is not accurate and complete. OSA is unable to test to ensure the Department is in compliance with child support sanction requirements. OSA selected a non-statistical random sample. Context: DSER provided a report of 455 sanction requests initiated in fiscal year 2023. The number of sanction requests that were made but omitted from the DSER report is unknown. Cause: • Lack of adequate policies and procedures • Lack of supervisory oversight Effect: • Noncompliant clients may be paid benefits that they are not entitled to receive. • Failure to maintain appropriate documentation to demonstrate compliance with Federal program sanction requirements may result in the U.S. Department of Health and Human Services penalizing the State for up to five percent of the grant award. Recommendation: We recommend that the Department establish procedures to ensure all child support sanction requests can be provided so that audit procedures can be performed in accordance with Federal regulations. We further recommend that the Department increase oversight to ensure compliance with Federal requirements. Corrective Action Plan: See F-33 Management’s Response: The Department disagrees with this finding. The audit objective identified in the Compliance Supplement is to “Determine whether, after notification by the state Title IV-D agency, the TANF agency has taken necessary action to reduce or deny TANF assistance.” One of the two suggested audit procedures is to “Test a sample of cases referred by the Title IV-D agency to the TANF agency to ascertain if benefits were reduced or denied as required.” The Department spent a lot of time and effort attempting to validate for OSA that it had a testable population, and the Department believes that the Office of State Auditor can perform this procedure either with the DSER-provided report of referrals or with that report in conjunction with the additional material the Department has pulled and analyzed for OSA. In the absence of that review nothing in the Department’s records, data, or discussions with OSA could reasonably be interpreted to suggest a “significant deficiency” in its Internal Controls over this aspect of the TANF program. There has not been any evidence that referrals made from DSER to OFI are getting lost, ignored, or misapplied. All 38 cases that the Department analyzed for completeness purposes reflect a well-functioning and substantively accurate sanction referral and case-action process, and this record does not support the OSA’s conclusion to the contrary. Contact: Ian Yaffe, Director, Office for Family Independence, DHHS, 207-592-1481 Auditor’s Concluding Remarks: 2 CFR 200.303 requires the Department to establish and maintain effective internal control over Federal awards. 45 CFR 264.30 requires the Department to sanction individuals not cooperating with child support enforcement. The Department did not demonstrate effective internal control over the TANF program or provide documentation to support compliance with child support non-cooperation requirements. As stated in the Condition, OSA is required to evaluate the report (population) to ensure that the population provided is accurate and complete. During this evaluation, it became evident that the population was not accurate or complete. OFI is responsible for ensuring that individuals not cooperating with child support enforcement are properly sanctioned. Without a complete and accurate population of sanction referrals from DSER to TANF, OFI cannot attest that: • all DSER sanction referrals are tracked to ensure that referrals are not “lost, ignored, or misapplied,” or • management is properly overseeing compliance with 45 CFR 264.30. Therefore, OFI’s inability to provide an accurate and complete population of referrals validates that there is not a “well-functioning and substantively accurate sanction referral and case-action process” in place. The finding remains as stated. (State Number: 23-1111-02)

(2023-081) Title: Internal control over TANF performance reporting and work participation procedures needs improvement Prior Year Findings: See schedule of Findings and Questioned Costs for chart/table State Department: Health and Human Services State Bureau: Office for Family Independence Federal Agency: U.S. Department of Health and Human Services Assistance Listing Title: Temporary Assistance for Needy Families (TANF) Assistance Listing Number: 93.558 Federal Award Identification Number: See E-93 to E-94 Compliance Area: Reporting Special tests and provisions Type of Finding: Significant deficiency Questioned Costs: None Criteria: 2 CFR 200.303; 45 CFR 261.60 through .62; 45 CFR 265.7 and .8 The Department must establish and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. The Department must maintain adequate documentation, perform adequate verification, and implement other control procedures for Temporary Assistance for Needy Families (TANF) client work participation. Work participation activities include unsubsidized employment, job search and job readiness, job skills training directly related to employment, vocational education, and other work-related programs. The Department must report the actual hours that a work-eligible TANF client participates in these work-related activities on the ACF-199 TANF Data Report on a quarterly basis. These reports are required by the Federal government. Condition: The Department reported incorrect work participation information on the ACF-199 reports. Of the 30 clients tested, inaccurate or unverifiable work participation data was reported for five clients, including inaccurate: • countable months towards the Federal time limit of 60 months, • work participation status, • unsubsidized employment hours, and • job search and readiness hours. The Office of the State Auditor selected a non-statistical random sample. Context: The Department must maintain adequate documentation, verification, and internal control procedures to ensure the accuracy of information reported to the Federal government and used to calculate work participation rates. In fiscal year 2023, the number of families reported on the ACF-199 report ranged from approximately 10,000 to 12,000 per quarter. Cause: • Lack of adequate procedures to ensure work participation data is accurately reported on the quarterly Federal performance reports • Lack of supervisory oversight Effect: • Incorrect work participation data reported to the Federal government may affect the Federal requirement for TANF’s State Maintenance of Effort. • The Federal government may penalize the State by an amount not less than one percent and not more than five percent of the grant award for violation of work verification plan requirements. Recommendation: We recommend that the Department enhance existing procedures to ensure that the information reported on the ACF-199 reports is accurate and complete prior to submission to the Federal government. This should include increased systemic monitoring to improve the reliability of work participation data that is reported to the Federal government. Corrective Action Plan: See F-34 Management’s Response: The Department agrees with this finding. OFI staff will meet internally to review system protocols and discuss possible changes to increase reporting accuracy. Subsequently, OFI will meet with Fedcap technical staff to discuss possible system information exchange improvements. If feasible improvements are identified that will lead to a marked increase in reporting accuracy, OFI will work internally and with Fedcap staff to implement changes. Contact: Ian Yaffe, Director, Office for Family Independence, DHHS, 207-592-1481 (State Number: 23-1111-06)

(2023-082) Confidential finding, see below for more information Title: ________ over ________ and ________ needs improvement Pursuant to paragraph 6.63 of the U.S. Government Accountability Office’s Government Auditing Standards (also known as the Yellow Book), we omitted details from this finding as they are confidential under the provisions of 5 MRSA 244-C (3). Though the content of this finding has been redacted, we provided the Department(s) with detailed information regarding the specific condition we identified, as well as the related criteria, context, causes, effects, and our specific recommendations for improvement. Prior Year Findings: See schedule of Findings and Questioned Costs for chart/table Type of Finding: Material weakness Corrective Action Plan: See F-34 Contact: Shirley Browne, Deputy State Controller, Office of the State Controller, 207-626-8423 (State Number: 23-0906-03)

(2023-083) Title: Internal control over CCDF provider payments needs improvement Prior Year Findings: None State Department: Health and Human Services State Bureau: Office of Child and Family Services Federal Agency: U. S. Department of Health and Human Services Assistance Listing Title: CCDF Cluster (COVID-19) Assistance Listing Number: 93.489, 93.575, 93.596 Federal Award Identification Number: See E-93 to E-94 Compliance Area: Allowable costs/cost principles Type of Finding: Significant deficiency Questioned costs Known Questioned Costs: $3,101 Likely Questioned Costs: $32,099; likely questioned costs were projected by dividing the known questioned costs in our sample by total provider payments tested to establish an error rate, then applying that error rate to total provider payments in fiscal year 2023. Criteria: 2 CFR 200.303; 2 CFR 200.403; 45 CFR 98.68 The Department must establish and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. To be allowable under Federal awards, costs must be necessary and reasonable for the performance of the Federal award and be adequately documented. In the Child Care and Development Fund (CCDF) State Plan, Lead Agencies are required to describe effective internal controls that are in place to ensure program integrity and accountability while maintaining continuity of services. Condition: The CCDF program provides funds to increase the availability, affordability, and quality of childcare services in the State. The Department provides biweekly payments to childcare providers for services rendered. Provider payment amounts are based on current childcare market rates and the approved childcare subsidy awarded on behalf of the child receiving care. Once the subsidy is awarded, the Department accepts electronic invoices from the provider through a portal. Invoices are reviewed and approved by the Department prior to payment processing. The Office of the State Auditor (OSA) tested 60 provider payments to verify that the payments were accurate and in line with program guidelines and identified one provider’s biweekly invoice was overpaid by $151 due to an inaccurate childcare subsidy determination. This error was not identified by the Department during the review and approval process and persisted for 10 months of fiscal year 2023, resulting in a total overpayment of $3,101. OSA selected a non-statistical random sample. Context: In fiscal year 2023, the Department provided $40.1 million to 1,056 providers in the CCDF program. Cause: Lack of adequate supervisory oversight Effect: • Inaccurate childcare subsidy determinations will result in overpayments or underpayments to providers. • Known questioned costs • Potential future questioned costs and disallowances • Noncompliance with Federal regulations Recommendation: We recommend that the Department enhance oversight policies and procedures to ensure that childcare subsidy determinations and resulting provider payments are accurate. Corrective Action Plan: See F-35 Management’s Response: The Department agrees with this finding. The Department will enhance oversight policies and procedures to ensure that childcare subsidy determinations and resulting provider payments are accurate. The Program will seek to maintain a below 10% threshold of improper payments as required by CCDF Rule. Contact: John Feeney, Chief Operating Officer, OCFS, DHHS, 207-626-8614 (State Number: 23-1114-02)

(2023-084) Title: Internal control over CCDF provider application and payment approvals needs improvement Prior Year Findings: None State Department: Health and Human Services State Bureau: Office of Child and Family Services Federal Agency: U.S. Department of Health and Human Services Assistance Listing Title: CCDF Cluster (COVID-19) Assistance Listing Number: 93.489, 93.575, 93.596 Federal Award Identification Number: See E-93 to E-94 Compliance Area: Allowable costs/cost principles Special tests and provisions Type of Finding: Significant deficiency Questioned Costs: None Criteria: 2 CFR 200.303; 45 CFR 98.68 The Department must establish and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. In the Child Care and Development Fund (CCDF) State Plan, Lead Agencies are required to describe effective internal controls that are in place to ensure integrity and accountability, while maintaining continuity of services, in the CCDF program. Condition: The CCDF program provides monthly stabilization grant payments to eligible childcare providers. The Department utilizes the InforME system as a mechanism for providers to submit applications for the American Rescue Plan Act’s Child Care Stabilization Funds (CCSF) under the CCDF program. The Department reviews the application to ensure that the provider is eligible for CCSF, provider costs submitted for CCSF reimbursement are allowable, required program certifications are complete, and payment amounts are accurate, and then approves the application in the InforME system and initiates grant payments. The Office of the State Auditor (OSA) tested 60 CCSF provider payments to verify that payments are allowable, accurate, and made to eligible providers, and identified the following: • Documentation in support of grant application approvals was not maintained for any of the 60 providers reviewed. • Nine provider CCSF grant applications were manually modified by the Department, and documentation of the modifications or the user initiating the modification was not maintained. The Department does not require documentation to support the modifications in the InforME system. In addition, providers are not notified of modifications to submitted applications. The nine modifications noted as exceptions resulted in changes to the amount paid to providers in the month selected for testing. For the provider applications and payments noted above, OSA verified that all providers were eligible for CCSF and payments were accurate. OSA selected a non-statistical random sample. Context: In fiscal year 2023, the Department provided $34.4 million in CCSF to over 1,300 providers. Cause: • Lack of adequate policies and procedures • Lack of supervisory oversight Effect: • Potential unauthorized application approvals • Potential unauthorized or inaccurate application modifications, which may lead to inaccurate provider payment amounts Recommendation: We recommend that the Department enhance policies and procedures to include a requirement for documentation of provider application modifications and approvals and increase supervisory oversight of these processes. This will help ensure that only authorized and accurate provider application modifications, approvals, and resulting payments are processed. Corrective Action Plan: See F-35 Management’s Response: The Department agrees with this finding. Updates have been made to the Portal to identify program personnel making determinations to ensure appropriate supporting documentation. Updates have been made to the system to send email communications to the providers, an itemization of monthly payments and when changes have been made to determinations. Contact: John Feeney, Chief Operating Officer, OCFS, DHHS, 207-626-8614 (State Number: 23-1114-01)

(2023-085) Title: Internal control over CCDF provider health and safety requirements needs improvement Prior Year Findings: None State Department: Health and Human Services State Bureau: Office of Child and Family Services Federal Agency: U.S. Department of Health and Human Services Assistance Listing Title: CCDF Cluster (COVID-19) Assistance Listing Number: 93.489, 93.575, 93.596 Federal Award Identification Number: See E-93 to E-94 Compliance Area: Special tests and provisions Type of Finding: Significant deficiency Questioned Costs: None Criteria: 2 CFR 200.303; 45 CFR 98.41 and .68 The Department must establish and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. Lead Agencies are required to design, implement, and enforce health and safety requirements for the protection of children. In the Child Care and Development Fund (CCDF) State Plan, Lead Agencies are required to describe effective internal controls that are in place to ensure program integrity and accountability while maintaining continuity of services. Condition: The CCDF program is administered by the Office of Child and Family Services (OCFS) and provides funds to increase the availability, affordability, and quality of childcare services in the State. OCFS completes annual childcare provider site visits or licensing inspections for providers receiving subsidies from the CCDF program. During site visits and licensing inspections, OCFS reviews Federal program health and safety requirements using a provider compliance checklist. Any deficiencies are noted by OCFS, corrective action by the provider is required, and the frequency of site visits or licensing inspections is increased until remediation of noted deficiencies is complete. The Office of the State Auditor reviewed the listing of providers subject to health and safety site visits or licensing inspections and identified that 27 provider facilities did not receive a site visit or licensing inspection during fiscal year 2023 as required. OCFS does not have adequate policies and procedures in place to monitor providers due for annual health and safety site visits or licensing inspections. Context: The Department provided $87.4 million to CCDF program providers in fiscal year 2023. Cause: • Lack of adequate policies and procedures • Lack of supervisory oversight Effect: • Noncompliance with Federal regulations • Providers not meeting CCDF program regulations for health and safety may go undetected, or deficiencies may not be remediated timely. Recommendation: We recommend that OCFS enhance policies and procedures to ensure that required annual provider site visits and licensing inspections, and any resulting corrective action, are monitored and completed. Corrective Action Plan: See F-35 Management’s Response: The Department agrees with this finding. Child Care Licensing is responsible for completing at least an annual onsite inspection to ensure health and safety requirements are met. This was not met with 27 providers which is approximately 1% of licensed child care providers and license exempt providers receiving federal CCDF subsidy. During the period under review the Licensing team had multiple vacancies which is largely the reason not all providers were seen within the one year. Contact: Janet Whitten, CLIS Program Manager, DHHS, 207-441-2259 (State Number: 23-1114-03)

(2023-086) Title: Internal control over the Foster Care – Title IV-E eligibility and benefit determination process needs improvement Prior Year Findings: None State Department: Health and Human Services State Bureau: Office of Child and Family Services Federal Agency: U.S. Department of Health and Human Services Assistance Listing Title: Foster Care – Title IV-E (COVID-19) Assistance Listing Number: 93.658 Federal Award Identification Number: See E-93 to E-94 Compliance Area: Allowable costs/cost principles Eligibility Type of Finding: Material weakness Material noncompliance Questioned costs Known Questioned Costs: $8,006 Likely Questioned Costs: $220,373; likely questioned costs were projected by dividing the identified known overpayment in our sample by total payments tested to establish an error rate, then applying that error rate to total payments made on behalf of Foster Care – Title IV-E clients in fiscal year 2023. Criteria: 2 CFR 200.303; 2 CFR 200.403; 45 CFR 1356.21 The Department must establish and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. To be allowable under Federal awards, costs must be necessary and reasonable for the performance of the Federal award and be adequately documented. Funds may be expended for foster care maintenance payments on behalf of eligible children, in accordance with the Title IV-E agency’s foster care maintenance payment rate schedule, to individuals serving as foster family homes, to childcare institutions, or to public or private child-placement or child-care agencies. Condition: The Foster Care – Title IV-E program is designed to help states provide safe and stable out-of-home care for children under its jurisdiction until the children are returned home safely, placed with adoptive families, or placed in other planned arrangements for permanency. The Office of Child and Family Services (OCFS) administers the Foster Care – Title IV-E program for the State of Maine. A financial resources specialist (FRS) determines program eligibility and initiates benefits through completion of a determination checklist. The FRS reviews program eligibility factors, gathers required supporting documentation, and documents the certification decision on the checklist. The FRS enters the information into the child welfare information system for processing. Once the client is determined eligible in the child welfare information system, a level of benefits is assigned. OCFS relies on this information and the related system coding to ensure that benefits are accurately provided to eligible clients. The Office of the State Auditor (OSA) tested 60 clients and 60 benefit payments and found: • 10 determination checklists that did not include a certification decision; and • one benefit payment for an ineligible client. The client was erroneously paid a total of $8,006 for six months during fiscal year 2023. OSA selected non-statistical random samples. Context: In fiscal year 2023, the State provided approximately 900 Foster Care – Title IV-E clients with $5.3 million in Federal benefits. Cause: Lack of adequate policies and procedures and supervisory oversight over the child welfare information system. The system was implemented in fiscal year 2023 and policies and procedures were not designed to properly test system coding for all eligibility change circumstances that could occur. Effect: • Known questioned costs • Potential future questioned costs and disallowances • Noncompliance with Federal regulations Recommendation: We recommend that the Department enhance policies and procedures to ensure that eligibility determination checklists include certification decisions by a FRS and benefits are paid only to eligible clients. Corrective Action Plan: See F-35 Management’s Response: The Department agrees with this finding. The Financial Resources Specialist (FRS) role is to accurately determine Title IV-E Eligibility Foster care for the State of Maine DHHS OCFS. One of the items utilized in their determination of program eligibility is to document all of their findings in the “Title IV-E Initial Determination” document. This is included in every case file in front of the corresponding paperwork that confirms each element of that eligibility determination. Contact: Manisha Donahue, Title IV-E Program Manager, OCFS, DHHS, 207-592-1268 (State Number: 23-1109-01)

(2023-087) Title: Internal control over DHHS allocated costs needs improvement Prior Year Findings: None State Department: Administrative and Financial Services Health and Human Services State Bureau: Health and Human Services Service Center Office of Child and Family Services Federal Agency: U.S. Department of Health and Human Services Assistance Listing Title: Title IV-E Prevention Program Foster Care – Title IV-E (COVID-19) Assistance Listing Number: 93.472; 93.658 Federal Award Identification Number: See E-93 to E-94 Compliance Area: Allowable costs/cost principles Type of Finding: Significant deficiency Questioned Costs: None Criteria: 2 CFR 200.303; 2 CFR 200.403; Department of Health and Human Services’ Cost Allocation Plan The Department must establish and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. To be allowable under Federal awards, costs must be necessary and reasonable for the performance of the Federal award and be adequately documented. Some accounts include costs that benefit multiple programs (cost pool accounts). A Random Moment Time Study (RMTS) allocation method is used to allocate certain Office of Child and Family Services cost pool accounts. RMTS is used to identify time spent on Title IV-E programs and time reimbursable for child welfare system operational costs. Condition: A Cost Allocation Plan (CAP) is used when a cost cannot be identified to a particular cost objective (direct expensed). The Department of Health and Human Services’ (DHHS) CAP is a written summary that documents how DHHS allocates cost pool accounts across multiple programs, including approved allocation methods by cost pool account, and is approved by the Federal government. The Office of the State Auditor (OSA) identified that the Foster Care – Title IV-E program’s allocated costs decreased by 31 percent in fiscal year 2023. In response to OSA’s inquiry, the Department acknowledged that the program was overcharged by $2.7 million due to incorrect RMTS statistic information that was provided beginning in October 2021 through April 2023. These costs should have been charged to ALN 93.472 Title IV-E Prevention Program. During the last quarter of fiscal year 2023, the Department initiated corrective action and appropriately transferred the unallowable costs that were incurred during fiscal year 2023 from the Foster Care – Title IV-E program to the Title IV-E Prevention Program. Context: Of the $80.2 million in costs allocated through the DHHS CAP, $11.9 million was correctly charged to the Foster Care – Title IV-E program and $4.9 million was correctly charged to the Title IV-E Prevention Program during fiscal year 2023. Cause: • Lack of adequate procedures to prevent, or detect and correct, errors timely • Lack of supervisory oversight Effect: • Potential questioned costs and disallowances if unallowable costs are charged to the wrong Federal program and not detected timely • Noncompliance with Federal requirements Recommendation: We recommend that the Department implement additional procedures to validate the accuracy of changes to the DHHS CAP before implementation and to enhance monitoring procedures over allocated costs. This will ensure that Federal programs are appropriately charged through the DHHS CAP in accordance with Federal regulations. Corrective Action Plan: See F-36 Management’s Response: The DHHS and DHHS Financial Service Center agree with this finding. The DHHS Financial Service Center and the Office of Child and Family Services will implement additional procedures to validate the accuracy of OCFS applicable changes to the DHHS CAP by December 31, 2024. Contact: Sarah Gove, Director, DHHS Service Center, DAFS, 207-458-6626 (State Number: 23-1103-01)

(2023-088) Title: Internal control over the Adoption Assistance – Title IV-E eligibility and benefit determination process needs improvement Prior Year Findings: None State Department: Health and Human Services State Bureau: Office of Child and Family Services Federal Agency: U.S. Department of Health and Human Services Assistance Listing Title: Adoption Assistance – Title IV-E (COVID-19) Assistance Listing Number: 93.659 Federal Award Identification Number: See E-93 to E-94 Compliance Area: Allowable costs/cost principles Eligibility Type of Finding: Material weakness Material noncompliance Questioned Costs: None Criteria: 2 CFR 200.303; 2 CFR 200.403; 45 CFR 1356.40 The Department must establish and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. To be allowable under Federal awards, costs must be necessary and reasonable for the performance of the Federal award and be adequately documented. The State is allowed to pay a portion of the Federal Adoption Assistance maintenance payments and claim Federal financial participation for Title IV-E eligible clients. Condition: The Adoption Assistance – Title IV-E Program provides Federal funds to states to facilitate the timely placement of children, whose special needs or circumstances would otherwise make them difficult to place, with adoptive families. Funds are available for a one-time payment to assist with the costs of adopting a child as well as for subsidies to adoptive families to assist with the care of the eligible child on an ongoing basis. The Office of Child and Family Services (OCFS) administers the Adoption Assistance – Title IV-E program for the State. A financial resources specialist (FRS) determines program eligibility and initiates benefits through completion of an adoption assistance checklist. The FRS reviews program eligibility factors, gathers required supporting documentation, documents the certification decision on the checklist, and obtains supervisory approval. The FRS enters the information into the child welfare information system for processing. The Office of the State Auditor (OSA) tested 60 eligibility determinations and found: • one checklist did not have supervisory approval; • one checklist did not have a FRS signature or supervisory approval; • one checklist was not included in the case file; and • one checklist was signed by a FRS and included supervisory approval; however, information indicating that the required steps were taken to determine benefit eligibility was excluded. Once the client is determined eligible in the child welfare information system, a daily rate is negotiated by OCFS and the adoptive parents. OCFS relies on the information entered in the system and related system coding for the assignment of the appropriate revenue source to charge the assigned benefits. OSA tested 60 client benefit payments and identified that benefits for one client paid with State funds should have been charged to Federal funds. Through discussions with OCFS, OSA was informed that the error was caused by an issue with the newly implemented child welfare information system, which affected 421 clients. $1.6 million of State funds were utilized to pay benefits that should have been charged to Federal funds. OSA selected non-statistical random samples. Context: In fiscal year 2023, the State provided approximately 4,000 Adoption Assistance – Title IV-E clients with $24.6 million in Federal benefits. Cause: Lack of adequate policies and procedures and supervisory oversight over: • the documentation of eligibility determinations • the child welfare information system. The system was implemented in fiscal year 2023 and policies and procedures were not designed to properly test system coding to ensure that benefits were paid utilizing the appropriate funding source. Effect: • Individuals not eligible for services could be deemed eligible or eligible individuals could be deemed ineligible. • Potential questioned costs and disallowances • Noncompliance with Federal regulations Recommendation: We recommend that OCFS enhance policies and procedures to ensure that eligibility determination checklists include certification decisions and are documented consistently for all case files. We understand that OCFS is completing a retroactive review to correct the issue and charge the appropriate funding source for previously paid benefits. We recommend that OCFS continue this process and implement policies and procedures which require monitoring of the system to ensure benefits are accurately paid to eligible clients. Corrective Action Plan: See F-36 Management’s Response: The Department agrees with this finding. Completion of the Adoption Assistance Checklist has not been universally understood to be used as the internal control for documentation of certification decisions, but as a guide for staff to use in preparing and organizing the Application for Adoption Assistance Packets. We agree that this is an effective tool to ensure certification decisions regarding IVE, and consistent documentation in case files. OCFS staff will be trained in the importance of these internal control procedures. The Adoption Policy is currently in revision and the policy will be enhanced to reflect these changes. Contact: Karen Benson, Adoption Program Manager, DHHS, 207-561-4208 (State Number: 23-1110-01)

(2023-089) Confidential finding, see below for more information Title: ________ over ________ and ________ needs improvement Pursuant to paragraph 6.63 of the U.S. Government Accountability Office’s Government Auditing Standards (also known as the Yellow Book), we omitted details from this finding as they are confidential under the provisions of 5 MRSA 244-C (3). Though the content of this finding has been redacted, we provided the Department(s) with detailed information regarding the specific condition we identified, as well as the related criteria, context, causes, effects, and our specific recommendations for improvement. Prior Year Findings: None Type of Finding: Material weakness Corrective Action Plan: See F-37 Contact: Shirley Browne, Deputy State Controller, Office of the State Controller, 207-626-8423 (State Number: 23-0906-02)

(2023-090) Title: Internal control over Adoption Assistance – Title IV-E level of effort needs improvement Prior Year Findings: None State Department: Health and Human Services State Bureau: Office of Child and Family Services Federal Agency: U.S. Department of Health and Human Services Assistance Listing Title: Adoption Assistance – Title IV-E (COVID-19) Assistance Listing Number: 93.659 Federal Award Identification Number: See E-93 to E-94 Compliance Area: Matching, level of effort, earmarking Reporting Type of Finding: Significant deficiency Questioned Costs: None Criteria: 2 CFR 200.303; 42 USC 673(a)(8)(B) and (D) The Department must establish and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. The Department must file an annual report containing accurate information on any savings (referred to as “adoption savings”) resulting from the application of differing program eligibility rules to all applicable children for a fiscal year. As part of the Adoption Assistance – Title IV-E program’s level of effort, referred to as maintenance of effort (MOE) requirements, the Department must use adoption savings to supplement and not supplant any Federal or non-Federal funds to provide any service under Title IV-B or IV-E. Condition: The Adoption Assistance – Title IV-E program has expanded eligibility provisions for any child who meets the criteria of an “applicable child.” The expanded eligibility provisions allow the State to receive additional Federal funding for adoption, thereby allowing them to reduce the level of non-Federal funds required for these services, referred to as “adoption savings.” The State must report the amount of adoption savings and how the adoption savings are spent on Form CB-496 Annual Adoption Savings Calculation and Accounting Report. The Office of the State Auditor (OSA) reviewed the Federal fiscal year 2022 adoption savings calculation reported in State fiscal year 2023 and found: • the average monthly number of applicable children was incorrectly calculated and reported as 1,171 instead of 1,052, resulting in an overstatement of approximately $962,000 reported on Form CB-496. The Department informed OSA that the error was due to inaccurate information obtained from the child welfare system vendor. • the Department could not provide documentation to support amounts reported on Form CB-496. While the Federal fiscal year 2022 adoption savings was incorrectly calculated and reported, OSA was able to verify that the Department met MOE requirements relating to the use of adoption savings to supplement not supplant any Federal or non-Federal funds. Context: The Department reported $9,461,754 in adoption savings on the Federal fiscal year 2022 Form CB-496; however, $8,500,226 should have been reported. Cause: • Lack of adequate procedures • Lack of supervisory oversight Effect: • The Department is required to meet specific MOE requirements that relate to adoption savings. An inaccurate adoption savings calculation could result in the Department not meeting these requirements. • Inaccurate information reported to the Federal government may be used for programmatic, policy or statistical purposes. • Noncompliance with Federal regulations Recommendation: We recommend that the Department enhance monitoring procedures to ensure the annual adoption savings information reported on Form CB-496 is accurate and complete prior to submission and retain documentation to support amounts reported. Corrective Action Plan: See F-37 Management’s Response: The Department agrees with this finding. Requirements will be added to the standard operating procedure and backup data will be stored in an OCFS shared drive for future needs. Contact: John Feeney, Chief Operating Officer, OCFS, DHHS, 207-626-8614 (State Number: 23-1110-02)

(2023-091) Title: Internal control over Medicaid Nursing Facility audits needs improvement Prior Year Findings: See schedule of Findings and Questioned Costs for chart/table State Department: Health and Human Services State Bureau: Division of Audit Federal Agency: U.S. Department of Health and Human Services Assistance Listing Title: Medicaid Cluster (COVID-19) Assistance Listing Number: 93.775, 93.777, 93.778 Federal Award Identification Number: See E-93 to E-94 Compliance Area: Special tests and provisions Type of Finding: Material weakness Material noncompliance Questioned Costs: None Criteria: 2 CFR 200.303; 42 CFR 447.253(g); MaineCare Benefits Manual, Chapter III, Section 67 The Department must establish and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. The Department is required to provide for the periodic audits of the financial and statistical records of participating providers. The MaineCare Benefits Manual (MCBM) Chapter III, Section 67 outlines the documentation and support required to be included in a provider’s annual cost report filing submission to the Division of Audit. The Division of Audit’s requirements for reviewing the cost reports and performing uniform desk reviews is also outlined. Section 67 states that the Division of Audit must perform a uniform desk review on each Nursing Facility (NF) cost report submission within 365 days of receipt of an acceptable cost report filing. Condition: For each participating Long Term Care Facility, the Department must provide for the filing of uniform cost reports in order to establish payment rates and must provide for the periodic audits of financial and statistical records. The specific audit requirements will be established by the State plan. The MCBM states uniform desk reviews shall be completed within 365 days after receipt of an acceptable cost report filing, including financial statements and other information requested from the provider except in unusual situations including, but not limited to, delays in obtaining necessary information from a provider. Unless the Division of Audit intends to schedule an on-site audit or an unusual situation referenced above exists, a written summary report of findings and adjustments shall be issued upon completion of the uniform desk review. The Division of Audit did not complete NF audits in accordance with Federal regulations. The population of NF uniform desk reviews due for completion in fiscal year 2023 was 96. Of those 96 uniform desk reviews, one was completed timely, one was completed 128 days late, and 94 had not been completed at the time of audit testing. Context: The Department: • provided $275.7 million in Federal Medicaid funding and $80.3 million in State Medicaid funding to NFs during fiscal year 2023. • completed 66 NF uniform desk reviews related to prior fiscal years in fiscal year 2023. Cause: Lack of resources Effect: • Noncompliance with Federal and State regulations • The determination of amounts owed to or from NFs is delayed. Recommendation: We recommend that the Department reallocate resources to address the backlog of NF uniform desk reviews. Timely audit issuance will minimize the impact on providers of potential payables and receivables. Corrective Action Plan: See F-37 Management’s Response: The Department agrees with this finding. This is a long-standing finding due, in part, to the complexity of audit-related work for Nursing Facility cost reports. Meeting the requirement has always been a challenge. Further complicating this topic, during State Fiscal year 2023, the Division of Audit experienced a vacancy rate of over 30%. In addition to being short of staffing, over 600 additional audit reviews were added to the audit workload as a result of COVID funding requirements. Staff are still assigned to completing the COVID audits. Once those are completed, the staff will be assigned to the Long Term Care audits. Additionally, the Division has worked with HR to increase our recruiting efforts. We will continue to work on recruiting and hiring qualified audit staff in order to improve the timeliness of audit assignments. Contact: Herb Downs, Director, Division of Audit, DHHS, 207-287-2778 (State Number: 23-1106-02)

(2023-092) Title: Internal control over Medicare Part B premium payments needs improvement Prior Year Findings: See schedule of Findings and Questioned Costs for chart/table State Department: Health and Human Services Administrative and Financial Services State Bureau: Office for Family Independence Office of Information Technology Federal Agency: U.S. Department of Health and Human Services Assistance Listing Title: Medicaid Cluster (COVID-19) Assistance Listing Number: 93.775, 93.777, 93.778 Federal Award Identification Number: See E-93 to E-94 Compliance Area: Allowable costs/cost principles Type of Finding: Significant deficiency Questioned Costs: None Criteria: 2 CFR 200.303; 42 CFR 431.625 The Department must establish and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. 42 CFR 431.625 outlines eligibility criteria which, if met, allows the State to pay a portion of the Federal Medicare Part B premium on behalf of the client and claim Federal financial participation in the payment. Clients may be deemed eligible by the Federal government as indicated by a Federal Buy-In code, or by the State as indicated by eligibility status in the Automated Client Eligibility System (ACES). Condition: The Department receives monthly invoices from the Centers for Medicare and Medicaid Services (CMS) for Medicare Part B premiums. CMS provides a separate detailed listing of Medicaid clients that supports the invoice to the Office of Information Technology (OIT). OIT produces a Monthly Reconciliation Report identifying potential discrepancies between the CMS detailed listing and the Department’s eligibility information recorded in ACES. Office for Family Independence personnel use this reconciliation report to identify clients for whom payment should not be made. Of the 12 Monthly Reconciliation Reports required in fiscal year 2023, the Department could not provide documentation that reports were reviewed or corrective action was taken for six reports. In the Office of the State Auditor’s (OSA) test of 60 premium payments: • one premium was paid by the Department on behalf of a client who was coded eligible on the CMS invoice but was coded not eligible in ACES. • one premium was paid by the Department on behalf of a client who was coded eligible in ACES but was not included on the CMS invoice. • four premiums were paid by the Department on behalf of clients who were coded eligible on the CMS invoice and in ACES; however, discrepancies existed between their Federal and State Buy-In eligibility codes. The Monthly Reconciliation Report did not identify these discrepancies. However, additional OSA procedures determined that the clients were eligible and the payments were allowable. OSA selected a non-statistical random sample. Context: In fiscal year 2023, approximately $129 million in Federal funds and $57 million in State funds were paid to CMS for Medicare Part B premiums. Cause: • Lack of resources • Lack of supervisory oversight • The Monthly Reconciliation Report is not adequately designed to identify all discrepancies. Effect: • Potential Medicare Part B premiums paid by the State for ineligible clients • Potential questioned costs and disallowances • Noncompliance with Federal regulations Recommendation: We recommend that the Department implement oversight procedures to ensure the review and follow up to Monthly Reconciliation Reports, and that the Department improve procedures for the documentation of those reports. We further recommend that the Department design the Monthly Reconciliation Report to identify all discrepancies. Corrective Action Plan: See F-38 Management’s Response: The Office for Family Independence agrees with this finding and recommendation. We have created a MaineCare Program Integrity team and have hired a Program Manager for this group effective February 5, 2024. The work of this team will include Medicare Part B reconciliations. Contact: Ian Yaffe, Director, Office for Family Independence, DHHS, 207-592-1481 (State Number: 23-1106-01)

(2023-093) Title: Internal control over Medicaid cost of care deductions needs improvement Prior Year Findings: None State Department: Health and Human Services State Bureau: Office of MaineCare Services Federal Agency: U.S. Department of Health and Human Services Assistance Listing Title: Medicaid Cluster (COVID-19) Assistance Listing Number: 93.775, 93.777, 93.778 Federal Award Identification Number: See E-93 to E-94 Compliance Area: Allowable costs/cost principles Type of Finding: Significant deficiency Questioned Costs: None Criteria: 2 CFR 200.303; 2 CFR 200.403; 42 CFR 435.725 The Department must establish and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. To be allowable under Federal awards, costs must be necessary and reasonable for the performance of the Federal award and be adequately documented. The Department must reduce its payment to an institution for services provided to an individual by the amount that remains after deducting certain amounts from the member’s total income. This remaining amount is the member’s maximum share of the cost, known as cost of care (COC). Condition: A COC assessment represents the required contribution that a MaineCare recipient must pay toward care in a Long Term Care Facility (LTCF). The Office for Family Independence (OFI) is responsible for COC assessments for all Medicaid members in the State. COC assessments are either calculated by the Automated Client Eligibility System or calculated manually by eligibility specialists. System-generated COC assessments are not subject to secondary review. A COC deduction represents the amount of assessment that was deducted from a paid claim. Members may have an assessment calculated but may never have a claim with a deduction utilizing that assessment. The Office of MaineCare Services (OMS) is responsible for applying assessments to submitted claims prior to payment. The Office of the State Auditor (OSA) tested 60 COC assessments and related deductions from paid claims. OSA identified one COC deduction that was not updated after the claim was adjusted. As a result, the Department underpaid the provider by $263 for the month of September 2022. Seven additional claims that utilized this member’s COC were paid during fiscal year 2023 resulting in a total underpayment of $2,039. The monthly COC exception report generated by the system did not identify this error. OSA selected a non-statistical random sample. Context: In fiscal year 2023, approximately: • 26,000 COC assessments were calculated by OFI; • 9,400 members had COC assessments; and • $430 million was paid to nursing facilities and residential care facilities. Cause: Lack of adequate procedures to ensure system exception reports are complete and accurate Effect: • Potential questioned costs and disallowances • Inaccurate COC deductions and retroactive changes may result in overpayments or underpayments for members or the State. Recommendation: We recommend that OMS collaborate with OFI to ensure that system exception reports capture all COC-related claims which require adjustments. Corrective Action Plan: See F-38 Management’s Response: The Department agrees with this finding. OMS acknowledges a discrepancy in the report of identified claims for adjustments needed to claims as a result of changes to a member's cost of care. OFI generates the report for reporting COC changes from the ACES system, but the report provided only captures manual changes made to the member's cost of care. This report does not capture all cost of care changes. Example: NF COC, person has a level of care change and now needs APRC. They needed APRC starting in November and OFI doesn't know about it until January. They cannot have the system “run” that change because it is a change in the assistance group type that occurred in the past. OFI has to manually make that adjustment. It will populate as a change on the manually adjusted COC report. The report used by the OMS Adjustment Unit is generated by our vendor and sent by the second Wednesday of the month, capturing changes made to cost of care for an identified period of time. The cost of care adjustments are intended to be completed within the same month. Based on the discrepancy in the claims identified for adjustment, OMS is in agreement that collaboration between OFI and OMS should occur to assure accurate claims data is reviewed for those member's having changes to their cost of care within that month. Contact: Michelle Probert, Director, Office of MaineCare Services, DHHS, 207-287-2093 (State Number: 23-1106-04)

(2023-094) Title: Internal control over Medicaid drug rebates needs improvement Prior Year Findings: None State Department: Health and Human Services State Bureau: Office of MaineCare Services Federal Agency: U.S. Department of Health and Human Services Assistance Listing Title: Medicaid Cluster (COVID-19) Assistance Listing Number: 93.775, 93.777, 93.778 Federal Award Identification Number: See E-93 to E-94 Compliance Area: Allowable costs/cost principles Type of Finding: Significant deficiency Questioned Costs: None Criteria: 2 CFR 200.303; Section 1927 of the Social Security Act (42 USC 1396r-8) The Department must establish and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. Section 1927 of the Social Security Act requires manufacturers that wish to have their outpatient drugs covered by Medicaid to enter into an agreement with the Centers for Medicare & Medicaid Services (CMS) under which the manufacturers agree to pay rebates for drugs dispensed and paid for by the State Medicaid agencies under the State plan. Drug rebates are shared between the State and Federal government. Condition: Drug manufacturers are required to submit a list of all covered outpatient drugs, along with each drug’s average manufacturer price and “best price” to CMS. Utilizing this information, CMS calculates a unit rebate amount (URA) for each covered outpatient drug and provides the amounts to the State on a quarterly basis. The Department is required to maintain drug utilization data that identifies, by National Drug Code, the number of units of each covered outpatient drug for which the Department has paid pharmacy providers. The utilization data is provided to CMS and the manufacturers. The number of dispensed units is applied to the URA to determine the rebate amount due from each manufacturer. The State contracts with a vendor to calculate the drug rebate amounts and invoice manufacturers for drug rebates. During audit testing, the Office of the State Auditor identified that the Department does not have procedures in place to ensure the accuracy and completeness of the drug rebate amounts invoiced by the vendor. The Department does not compare drug utilization data to the number of dispensed units utilized to ensure that the vendor has calculated the rebate correctly. Context: In fiscal year 2023, the State invoiced approximately $315 million for rebatable drugs and received approximately $220 million in rebates. Of the $220 million in rebates, approximately $159 million was returned to the Federal government. Due to the amount of time rebate negotiations may take, discrepancies will exist between the invoiced total and the total amount of rebates received. Cause: • Lack of adequate procedures • Lack of supervisory oversight Effect: • Inaccurate or incomplete invoicing of drug rebates would result in overpayments or underpayments to the State and Federal government. • Noncompliance with Federal regulations Recommendation: We recommend that the Department implement procedures to confirm the drug rebate amounts calculated and invoiced by the vendor are accurate and complete by utilizing drug utilization data. This will ensure that correct drug rebate amounts are returned to the State and Federal government. Corrective Action Plan: See F-38 Management’s Response: The Department agrees with this finding. The control described is built into the computer systems that facilitate selecting claims for submission to the Pharmacy Rebate Invoice Management System (PRIMS). An additional check on the collection of claims is not needed for the following reasons: In response to the concern of completeness of the rebate eligible claim capture, the criteria for selecting outpatient drug claims from our claims system was defined, implemented, tested, and validated when PRIMS was first installed. This claim selection coding is what ensures that all outpatient drug claims are submitted to PRIMS for invoicing. In response to the concern of accuracy, pre-invoicing variance checks are completed within PRIMS and the manufacturers scrutinize the invoices once received which would detect any incorrect calculations. We have both a preventative control with the variance checks and independent detection with the drug manufacturers with respect to accuracy. However, we will take additional steps to ensure accuracy. Contact: Michelle Probert, Director, Office of MaineCare Services, DHHS, 207-287-2093 Auditor’s Concluding Remarks: Though the Department agrees with this finding, the Department asserts that controls exist over the control deficiency identified in the Condition and an “additional check on the collection of claims is not needed.” However, as a result of not comparing drug utilization data to the number of dispensed units utilized, the Department is relying on the drug manufacturer to submit the correct drug rebate information to the Department and to notify the Department of any discrepancies. The drug manufacturer is not an independent source to ensure accuracy of the drug rebate amount. An “additional check” would ensure that the drug rebate amount received is accurate and complete. The finding remains as stated. (State Number: 23-1106-08)

(2023-095) Title: Internal control over conflict of interest requirements needs improvement Prior Year Findings: None State Department: Administrative and Financial Services State Bureau: Division of Procurement Services Federal Agency: U.S. Department of Health and Human Services Assistance Listing Title: Medicaid Cluster (COVID-19) Assistance Listing Number: 93.775, 93.777, 93.778 Federal Award Identification Number: See E-93 to E-94 Compliance Area: Procurement and suspension and debarment Type of Finding: Significant deficiency Questioned Costs: None Criteria: 2 CFR 200.303; 2 CFR 200.318 The Department must establish and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. The Department must maintain written standards of conduct covering conflicts of interest and governing the actions of its employees engaged in the selection, award or administration of contracts. No employee, officer, or agent may participate in the selection, award or administration of a contract supported by a Federal award if he or she has a real or apparent conflict of interest. Condition: The Division of Procurement Services (DPS) oversees the creation, development, approval, and implementation of contracts for the State. DPS publishes contract templates and a Procurement Justification Form (PJF) template to be used by State agencies during the procurement process. The templates are reviewed by DPS to ensure all pertinent Federal requirements are included. The Office of the State Auditor reviewed the contract and PJF templates and found that the following templates did not include required conflict of interest language: • Service contract template, which only addressed a prohibition of employment between a State employee and the party to the contract • PJF template, which is utilized for contracts procured through the non-competitive bidding (sole source) process Context: $825.3 million in Federal expenditures was paid to contractors, subcontractors, or vendors through contracts in fiscal year 2023. Cause: Lack of supervisory oversight Effect: • All conflicts of interest may not be disclosed and thus, may not be considered by the State when entering into contracts with contractors, subcontractors or vendors. Conflict of interest disclosures are required to ensure transparency, accountability, and remove potential bias. • Noncompliance with Federal regulations Recommendation: We recommend that DPS enhance oversight procedures to ensure conflict of interest requirements and disclosures are included in all contract and PJF templates. This will ensure transparency, accountability, and remove potential bias. Corrective Action Plan: See F-38 Management’s Response: The Department agrees with this finding. The service contract did not include updated conflict of interest verbiage. Upon review and consultation, Procurement Services has updated the contract to appropriately reference the applicable statute and verbiage. These new contracts will be distributed to agencies for future use. Historically, the NOI-PJF has not included the conflict of interest reference. This was the case at the time of this audit review, a revised PJF form has been created with a department attestation referencing the statute at the time of the document signature. This new PJF will be distributed for use. Contact: David Morris, Acting Chief Procurement Officer, DAFS, 207-624-7335 (State Number: 23-1010-01)

(2023-096) Title: Internal control over DG – PA program special reporting needs improvement Prior Year Findings: See schedule of Findings and Questioned Costs for chart/table State Department: Defense, Veterans and Emergency Management State Bureau: Maine Emergency Management Agency Federal Agency: U.S. Department of Homeland Security Assistance Listing Title: Disaster Grants – Public Assistance (Presidentially Declared Disasters) (COVID-19) Assistance Listing Number: 97.036 Federal Award Identification Number: See E-93 to E-94 Compliance Area: Reporting Type of Finding: Material weakness Material noncompliance Questioned Costs: None Criteria: 2 CFR 200.303; 2 CFR 170 The Department must establish and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. Agencies must report each subaward that equals or exceeds the first-tier subaward threshold of $30,000 in Federal funds in the public-facing Federal Funding Accountability and Transparency Act (FFATA) Subaward Reporting System (FSRS). Condition: When an amount exceeding the first-tier subaward threshold is awarded to a subrecipient, Maine Emergency Management Agency (MEMA) must collect and enter data into FSRS. MEMA did not report any of its first-tier subawards under the DG – PA program in FSRS for fiscal year 2022 or 2021. As a result, a backlog existed during fiscal year 2023. MEMA entered approximately 100 first-tier subawards into FSRS during fiscal year 2023; however, many of these awards were attributable to prior fiscal years. Additionally, upon subsequent review, MEMA identified completeness and accuracy issues related to the awards entered into FSRS in fiscal year 2023. The Office of the State Auditor and MEMA agreed that it was not beneficial to select a sample of subawards for audit testing. For this reason, the auditee did not provide a listing of awards input into FSRS or a listing of awards subject to FFATA reporting. Context: First-tier subawards totaled $116.4 million under the DG – PA program in fiscal year 2023. First-tier subawards account for 83 percent of program expenditures. Cause: • Lack of adequate policies and procedures • Competing priorities related to an increase in aid requests as a result of COVID-19 • Lack of resources Effect: • Noncompliance with Federal regulations • Accurate first-tier subaward information for the DG – PA program was not reported to the Federal government. This information may be used for programmatic, policy, or statistical purposes. Recommendation: We recommend that MEMA evaluate FFATA reporting policies and procedures and allocate necessary resources to ensure that subrecipient awards are properly reported in FSRS as required by Federal program regulations. Corrective Action Plan: See F-39 Management’s Response: The Department agrees with this finding. MEMA will update internal controls to ensure that FFATA reporting is timely and accurate. Contact: James Belanger, Business Office Director MEMA, 207-707-2912 (State Number: 23-1502-02)

(2023-097) Title: Internal control over DG – PA program cash management needs improvement Prior Year Findings: See schedule of Findings and Questioned Costs for chart/table State Department: Defense, Veterans and Emergency Management Administrative and Financial Services State Bureau: Maine Emergency Management Agency Security and Employment Service Center Federal Agency: U.S. Department of Homeland Security Assistance Listing Title: Disaster Grants – Public Assistance (Presidentially Declared Disasters) (COVID-19) Assistance Listing Number: 97.036 Federal Award Identification Number: See E-93 to E-94 Compliance Area: Cash management Type of Finding: Significant deficiency Questioned Costs: None Criteria: 2 CFR 200.303; 31 CFR 205(A); 2023 Treasury-State Agreement (Maine) The Department must establish and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. A Treasury-State Agreement (TSA) documents the accepted funding techniques and methods for calculating interest agreed upon by the U.S. Department of Treasury and the State. The funding technique agreed upon in the State’s TSA for the Disaster Grants – Public Assistance (DG – PA) program is the “weekly drawdown – actual and estimate” method. This method specifies that the State shall make weekly drawdown requests such that funds are deposited in the State account on the median business day of the week, based on actual and estimated expenditures for that week. Condition: The Maine Emergency Management Agency (MEMA) administers the DG – PA program for the State. The Department of Administrative and Financial Services’ Security and Employment Service Center (SESC) is responsible for requesting drawdowns of Federal funds in order to pay DG – PA program expenditures on behalf of MEMA. MEMA reviews, authorizes, and submits approved invoices to SESC for payment. SESC then requests Federal funds based on the approved invoice and processes the authorized payment once Federal funds are received. This process is a cash advance funding technique and is not in compliance with the TSA which requires utilization of the “weekly drawdown – actual and estimate” funding technique. Context: In fiscal year 2023, DG – PA expenditures totaled $139.6 million. Cause: The program has not been included in the TSA in previous years; as a result, policies and procedures to ensure compliance with TSA regulations have not been established. Effect: • Noncompliance with Federal regulations • The Federal government may impose more stringent program-specific cash management requirements based on noncompliance. Recommendation: We recommend that the Department implement policies and procedures to ensure compliance with the funding techniques specified in the TSA when requesting Federal funds. Corrective Action Plan: See F-39 Management’s Response: The Department agrees with this finding. MEMA will update and implement policies and procedures to ensure compliance with the Treasury State Agreement. MEMA has altered the timing and frequency of drawdown requests to conform with the funding technique specified in the Treasury State Agreement. Contact: James Belanger, Business Office Director, MEMA, 207-707-2912 (State Number: 23-1502-01)

(2022-014) Confidential finding, see below for more information Title: ________ over the ________ needs improvement Pursuant to paragraph 6.63 of the U.S. Government Accountability Office?s Government Auditing Standards (also known as the Yellow Book), we omitted details from this finding as they are confidential under the provisions of 5 MRSA 244-C (3). Though the content of this finding has been redacted, we provided the Department(s) with detailed information regarding the specific condition we identified, as well as the related criteria, context, causes, effects, and our specific recommendations for improvement. Prior Year Findings: See Schedule of Findings and Questioned Costs for chart/table Type of Finding: Material weakness Corrective Action Plan: See F-9 Contact: Shirley Browne, Deputy State Controller, Office of the State Controller, 207-626-8423 (State Number: 22-0907-01)

(2022-015) Confidential finding, see below for more information Title: ________ over ________ within the ________ and ________ needs improvement Pursuant to paragraph 6.63 of the U.S. Government Accountability Office?s Government Auditing Standards (also known as the Yellow Book), we omitted details from this finding as they are confidential under the provisions of 5 MRSA 244-C (3). Though the content of this finding has been redacted, we provided the Department(s) with detailed information regarding the specific condition we identified, as well as the related criteria, context, causes, effects, and our specific recommendations for improvement. Prior Year Findings: See Schedule of Findings and Questioned Costs for chart/table Type of Finding: Significant deficiency Corrective Action Plan: See F-9 Contact: Shirley Browne, Deputy State Controller, Office of the State Controller, 207-626-8423 (State Number: 22-0902-01)

(2022-016) Confidential finding, see below for more information Title: ________ over the ________, ________, and ________ needs improvement Pursuant to paragraph 6.63 of the U.S. Government Accountability Office?s Government Auditing Standards (also known as the Yellow Book), we omitted details from this finding as they are confidential under the provisions of 5 MRSA 244-C (3). Though the content of this finding has been redacted, we provided the Department(s) with detailed information regarding the specific condition we identified, as well as the related criteria, context, causes, effects, and our specific recommendations for improvement. Prior Year Findings: None Type of Finding: Significant deficiency Corrective Action Plan: See F-10 Contact: Shirley Browne, Deputy State Controller, Office of the State Controller, 207-626-8423 (State Number: 22-0903-02)

(2022-017) Confidential finding, see below for more information Title: ________ over ________ needs improvement Pursuant to paragraph 6.63 of the U.S. Government Accountability Office?s Government Auditing Standards (also known as the Yellow Book), we omitted details from this finding as they are confidential under the provisions of 5 MRSA 244-C (3). Though the content of this finding has been redacted, we provided the Department(s) with detailed information regarding the specific condition we identified, as well as the related criteria, context, causes, effects, and our specific recommendations for improvement. Prior Year Findings: See Schedule of Findings and Questioned Costs for chart/table Type of Finding: Significant deficiency Corrective Action Plan: See F-10 Contact: Shirley Browne, Deputy State Controller, Office of the State Controller, 207-626-8423 (State Number: 22-0900-01)

(2022-018) Confidential finding, see below for more information Title: ________ over the ________ needs improvement Pursuant to paragraph 6.63 of the U.S. Government Accountability Office?s Government Auditing Standards (also known as the Yellow Book), we omitted details from this finding as they are confidential under the provisions of 5 MRSA 244-C (3). Though the content of this finding has been redacted, we provided the Department(s) with detailed information regarding the specific condition we identified, as well as the related criteria, context, causes, effects, and our specific recommendations for improvement. Prior Year Findings: See Schedule of Findings and Questioned Costs for chart/table Type of Finding: Significant deficiency Corrective Action Plan: See F-10 Contact: Shirley Browne, Deputy State Controller, Office of the State Controller, 207-626-8423 (State Number: 22-0900-02)

(2022-019) Title: Internal control over financial reporting of OFI overpayments needs improvement Prior Year Findings: See Schedule of Findings and Questioned Costs for chart/table State Department: Administrative and Financial Services (DAFS) Health and Human Services (DHHS) State Bureau: Office of the State Controller, a Unit of DAFS Health and Human Services Service Center, a Unit of DAFS Office for Family Independence, a Unit of DHHS Federal Agency: U.S. Department of Agriculture U.S. Department of Health and Human Services Assistance Listing Title: SNAP Cluster (COVID-19) Temporary Assistance for Needy Families (TANF) (COVID-19) Assistance Listing Number: 10.551, 10.561; 93.558 Federal Award Identification Number: SNAP Benefits, Maine; 1901METANF, 2001METANF, 2101METANF Compliance Area: Allowable costs/cost principles Type of Finding: Significant deficiency Questioned Costs: None Criteria: 2 CFR 200.303; Governmental Accounting, Auditing, and Financial Reporting (GAAFR), Part 5, Section A: Internal Control; 5 MRSA 1547 The Department must establish and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. The GAAFR states that a comprehensive framework of internal control is required to obtain reasonable assurance over financial reporting. Accounting and reporting activities of the State of Maine are required by statute to be in conformance with U.S. Generally Accepted Accounting Principles (GAAP). Condition: The Office for Family Independence (OFI) tracks improper payments made to, or on behalf of, clients in a subsidiary ledger. These payments are for services provided to Temporary Assistance for Needy Families (TANF) and Supplemental Nutrition Assistance Program (SNAP) clients. OFI provides the fiscal year-end subsidiary ledger to the Office of the State Controller (OSC) for financial reporting. For the fiscal year ending June 30, 2022, improper payments in OFI?s subsidiary ledger totaled $27.8 million in Federal and State dollars dating back to 1978. OFI does not have a claim termination policy in place to ensure that these improper payments are properly recovered or terminated. Additionally, OSC properly discloses the contingent liability in Note 18 of the State?s financial statements; however, OSC has also recorded a liability due to the Federal government on the financial statements for the amount deemed collectible. The Office of the State Auditor proposed an adjustment to remove the recorded liability as the entire amount due to the Federal government is contingent upon recovery. The proposed adjustment was not recorded by OSC. Context: Of the $27.8 million receivable balance, $22 million, or 80 percent, was established over 5 years ago; $16.3 million, or 60 percent, was established more than 10 years ago; and $7.9 million, or 28 percent, was established more than 20 years ago. Receivables totaled $27.8 million as of June 30, 2022, reduced by the estimated allowance for uncollectible accounts of $23.1 million. The allowance represents 83 percent of the total balance and results in management?s presentation of $4.4 million in net receivables. Cause: ? OFI does not have an established claim termination policy to write off, or terminate, non-recovery of improper payments. ? OSC did not consistently apply procedures for reporting contingent liabilities. Effect: ? The accounts receivable balance and the related allowance for uncollectible accounts are overstated in Note 6 of the financial statements. ? The amount due to the Federal government is overstated and deferred inflows are understated by $4.4 million in the State?s financial statements. Recommendation: We recommend that the Department establish a claim termination policy in accordance with Federal program regulations to ensure that receivable balances are not misstated on the State?s financial statements and that collection efforts are made in a timely manner. We further recommend that OSC implement procedures to ensure that financial reporting of contingent liabilities is consistent in the State?s financial statements. Corrective Action Plan: See F-10 Management?s Response: The Department of Health and Human Services and the Office of the State Controller agree that the variance between the receivable and reserve should be booked as a deferred inflow. A claim termination policy will be established in accordance with federal regulations. OSC Contact: Sandra Royce, Director of Financial Reporting, OSC, 207-626-8451 OFI Contact: Anthony Pelotte, Director, Office for Family Independence, DHHS, 207-624-4104 (State Number: 22-0203-01)

(2022-020) Confidential finding, see below for more information Title: ________ over the ________ needs improvement Pursuant to paragraph 6.63 of the U.S. Government Accountability Office?s Government Auditing Standards (also known as the Yellow Book), we omitted details from this finding as they are confidential under the provisions of 5 MRSA 244-C (3). Though the content of this finding has been redacted, we provided the Department(s) with detailed information regarding the specific condition we identified, as well as the related criteria, context, causes, effects, and our specific recommendations for improvement. Prior Year Findings: See Schedule of Findings and Questioned Costs for chart/table Type of Finding: Significant deficiency Corrective Action Plan: See F-11 Contact: Shirley Browne, Deputy State Controller, Office of the State Controller, 207-626-8423 (State Number: 22-0905-01)

(2022-021) Title: Internal control over valuing estimates for the allowances for uncollectible unemployment insurance receivables needs improvement Prior Year Findings: See Schedule of Findings and Questioned Costs for chart/table State Department: Labor (MDOL) Administrative and Financial Services (DAFS) State Bureau: Unemployment Compensation, a Unit of MDOL Security and Employment Service Center, a Unit of DAFS Office of the State Controller, a Unit of DAFS Federal Agency: U.S. Department of Labor Assistance Listing Title: Unemployment Insurance (UI) (COVID-19) Assistance Listing Number: 17.225 Federal Award Identification Number: Unemployment Insurance Trust Fund, Maine, UI347192055A23, UI372842255A23, UI359482160A23, UI372272255A23, UI356522155A23, UI348602055A23, UI340622055A23 Compliance Area: Allowable costs/cost principles Type of Finding: Significant deficiency Questioned Costs: None Criteria: 2 CFR 200.303; Governmental Accounting, Auditing, and Financial Reporting (GAAFR), Part 5, Section A: Internal Control; 5 MRSA 1547; State Administrative and Accounting Manual, Chapter 80 The Department must establish and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. The GAAFR states that a comprehensive framework of internal control is required to obtain reasonable assurance over financial reporting. Agencies are required by statute to prepare, submit, and retain auditable supporting documentation for all information submitted to the Office of the State Controller (OSC) for financial reporting purposes. Accounting and reporting activities of the State of Maine are required by statute to be in conformance with U.S. Generally Accepted Accounting Principles (GAAP). Accounting estimates used in the financial statements require the use of judgment by management which should be based on actual knowledge and experience with historical and current data. Annual review of these estimates and the circumstances that give rise to the estimates is necessary. Condition: The Maine Department of Labor (MDOL) utilizes the outsourced ReEmployME information system for processing and storage of data related to the Unemployment Insurance (UI) program. ReEmployME stores extensive financial and programmatic data, including records of balances owed to the State by individuals and employers. Detailed reports of receivables balances are necessary for financial reporting purposes. MDOL cannot provide an accounts receivable report from ReEmployME containing records for each debtor as of June 30, 2022. The related valuations of the allowances for uncollectible UI receivables reported on the State?s financial statements are not supported. The estimated allowances for uncollectible accounts related to Federal and State benefit overpayment receivables, unemployment tax receivables, and UI penalties and interest receivables are all based on the same assumption. Receivables outstanding for more than one year are automatically deemed uncollectible, rather than applying assumptions supported by data and evidence for each classification of receivables. OSC?s review and analysis of the estimated allowances is not sufficient. The supporting documentation for this analysis does not include management?s considerations of historical data, detailed collections activity, or current economic trends. The Office of the State Auditor (OSA) performed a review and analysis of collections activity specific to Federal benefit overpayment receivables to determine if OSC?s estimate for uncollectible UI receivables is reasonable. OSA?s analysis found that collection activity did not support OSC?s allowance. As a result, an audit adjustment was proposed to increase the estimated allowance for uncollectible receivables in the Federal Fund by $44.4 million. OSC did not record this proposed audit adjustment. Context: UI receivables for the Employment Security Trust Fund (ESTF) totaled $112.5 million as of June 30, 2022, reduced by the estimated allowance for uncollectible accounts of $63.2 million. This results in management?s presentation of $49.3 million in net ESTF UI receivables, not including interest and penalties. Federal Fund UI receivables totaled $56.9 million as of June 30, 2022, reduced by the estimated allowance for uncollectible accounts of $10.2 million. This results in management?s presentation of $46.7 million in net Federal UI receivables. As of June 30, 2022, a receivable for interest and penalties related to UI totaling $61.8 million was included in the Other Special Revenue Fund, reduced by the estimated allowance for uncollectible accounts of $59 million. The allowance represents 95.5% of the total balance, and results in management?s net presentation of approximately $2.8 million in UI receivables for interest and penalties. Cause: ? Management has identified long-term and ongoing information system limitations that have not been resolved which inhibit functionality for receivables reporting. ? Lack of documented effective policies and procedures to: o generate and retain detailed UI receivables information for financial reporting purposes; and o support management?s considerations in developing the estimated allowances for uncollectible accounts. ? Lack of supervisory oversight Effect: ? Potential misstatement of ESTF UI receivables balances, the allowances for uncollectible accounts which are also separately disclosed in Note 6 of the financial statements, and the resulting net receivables balances. ? Federal Fund receivables are overstated by an estimated $44.4 million in the financial statements, and the allowance for uncollectible accounts separately disclosed in Note 6 of the financial statements is understated by an estimated $44.4 million. Recommendation: We recommend that MDOL and the Security and Employment Service Center generate and retain detailed receivables reports, including collections activity, throughout the fiscal year for proper financial reporting of receivables balances. The reports should also be utilized to establish a formal, documented method to estimate the allowances for uncollectible accounts. The methodology should incorporate current and historical collection experience and other factors used to support professional judgment. MDOL personnel should perform a detailed secondary review of the methodology and calculated estimates for the allowances for uncollectible accounts. In addition, we recommend that OSC request and analyze detailed collection data from MDOL as part of their review of the estimated allowances to reduce the risk of management bias and to prove the allowances are reasonable, complete, and accurate. Corrective Action Plan: See F-11 Management?s Response: The Departments agree that detailed receivables reports should be generated and retained during the fiscal year. The OSC will provide guidance to the Department of Labor (DOL) to develop a reporting mechanism that will provide a more detailed analysis of the activity of the receivable balances. The OSC is responsible for determining the estimates in the financial statements. The accounting estimates are based on subjective, as well as, objective factors; therefore, professional judgement is required to estimate an amount for uncollectible receivables using an aging methodology, which is considered a common and acceptable method within the industry. Management's opinion is that this method is not overly sensitive to variations, is consistent with historical patterns and is not overly subjective or susceptible to bias. Applying this methodology, the OSC and the DOL accumulate relevant, sufficient, and reliable data on which to base the estimate. Additionally, we believe that the estimate is presented in conformity with the applicable accounting principles and that disclosure is adequate. The OSC recently performed a five-year trend analysis of historical collections with information provided by the DOL. The OSC compared the percentages and the assumptions used in the past and updated the reserve percentages accordingly. The OSC will continue to use the rolling year trend analysis with the actual collection data, as provided by the DOL, to update the reserve percentage. The DOL implemented a new system and the OSC will continue to review the reserve process to ensure the allowance continues to be valued properly. Contact: Stacey Thomas, Financial Management Coordinator, OSC, 207-626-8431 Auditor?s Concluding Remarks: OSA performed a review and analysis of collections activity specific to Federal benefit overpayment receivables to determine if OSC?s estimate for uncollectible UI receivables was reasonable. This analysis resulted in a proposed audit adjustment to increase the estimated allowance for uncollectible receivables in the Federal Fund by $44.4 million; therefore, OSC?s methodology for determining the allowance is not reasonable and additional considerations, such as collections data, need to be made. We continue to recommend that MDOL and OSC work together to improve financial reporting to ensure that the State?s financial statements are reasonable, complete, and accurate. The finding remains as stated. (State Number: 22-0308-01)

(2022-022) Title: Internal control over P-EBT Food Benefits needs improvement Prior Year Findings: None State Department: Health and Human Services State Bureau: Office for Family Independence Federal Agency: U.S. Department of Agriculture Assistance Listing Title: Pandemic EBT Food Benefits (P-EBT) (COVID-19) Assistance Listing Number: 10.542 Federal Award Identification Number: P-EBT Benefits, Maine Compliance Area: Activities allowed or unallowed Allowable costs/cost principles Eligibility Type of Finding: Material weakness Material noncompliance Questioned costs Known Questioned Costs: $61,507,558 Likely Questioned Costs: $61,507,558. The full amount of P-EBT Food Benefits issued during fiscal year 2022 are reported as known questioned costs. Criteria: 2 CFR 200.303; 2 CFR 200.403; 7 CFR 274.5; Families First Coronavirus Response Act (FFCRA) (Public Law 116-127), Section 1101; State Plan for Pandemic EBT: Children in School, School Year 2020-2021; State Plan for Pandemic EBT: Children in School and Child Care, Summer 2021; State Plan for Pandemic EBT: Children in School/Child Care 2021-2022 The Department must establish and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. Costs must be adequately documented. The State?s financial management systems, including records documenting compliance with the terms and conditions of the Federal award, must be sufficient to determine that such funds have been used in accordance with Federal statutes, regulations, and the terms and conditions of the Federal award. The State is required to maintain Electronic Benefit Transfer (EBT) issuance, inventory, reconciliation, and other accountability records for a period of three years. The State agency shall control all issuance documents which establish household eligibility while the documents are transferred and processed within the State. The State agency shall use numbers, batching, inventory control logs, or similar controls from the point of initial receipt through the issuance and reconciliation process. The Department must carry out the Pandemic EBT (P-EBT) program, authorized by the FFCRA, in accordance with their State agency plan approved by the U.S. Department of Agriculture (USDA). The State was required to submit plans to the USDA as a precondition for participation in the P-EBT Food Benefits program. The plans outline the proposed framework for operating the program including details on how benefits will be issued, estimates for the total amount of P-EBT benefits and the number of children participating, tentative issuance schedules, and how the State will identify eligible school children and children in child care. Three separate plans were approved by the USDA for P-EBT benefit issuances during fiscal year 2022: School Year 2020- 2021, Summer 2021, and School Year 2021-2022. Condition: The FFCRA authorized the establishment of the P-EBT Food Benefits program in response to the COVID-19 public health emergency. The P-EBT program is administered by the Office for Family Independence (OFI) and provides nutrition assistance for school-age children who would have received free or reduced-price school meals under the National School Lunch Program and School Breakfast Program, and children in child care whose child-care facility was closed or had reduced attendance/hours due to the COVID-19 public health emergency. As outlined in the State?s USDA-approved plans, OFI established an agreement with the Maine Department of Education (MDOE) to provide information required for issuance of P-EBT benefits to eligible children. MDOE provided data on children participating in the Free and Reduced School Lunch Program as the starting point for eligibility determinations under the P-EBT program. OFI utilized this information to apply additional eligibility criteria and build issuance files for P-EBT benefit processing. The agreement between OFI and MDOE established OFI as the responsible party for the maintenance of data used for determining client eligibility and distributing benefits. Federal guidance over the P-EBT program outlines that audit procedures provide assurance that the Department has established and implemented processes to properly determine program eligibility and benefit levels. This includes testing a sample of clients who were issued P-EBT benefits during the fiscal year to verify consistency with the State?s USDA-approved plans and compliance with Federal program requirements. The Office of the State Auditor (OSA) requested original data files containing client and benefit issuance information utilized by OFI during the fiscal year for all P-EBT issuances that occurred. OFI could not provide OSA with these files. Without a population of the original client and benefit information transmitted for P-EBT issuance, OSA is unable to verify compliance with Federal program eligibility and allowability requirements. As a result, all P-EBT benefits issued during fiscal year 2022 totaling $61,507,558 are considered questioned costs. Context: In fiscal year 2022, the State provided approximately 115,000 P-EBT clients with $61.5 million in Federal benefits. Cause: ? Lack of supervisory oversight ? Lack of adequate procedures Effect: ? Known questioned costs ? Potential future questioned costs and disallowances ? Noncompliance with Federal regulations Recommendation: We recommend that the Department establish procedures to ensure that documentation in support of P-EBT eligibility determinations and allowability of resulting benefit issuances can be provided to corroborate Federal award program expenditures and demonstrate compliance with Federal regulations. Corrective Action Plan: See F-11 Management?s Response: The Department disagrees with this finding. The Department provided the Office of the State Auditor (OSA) with all material used to determine P-EBT benefits. While we acknowledge that due to restrictions imposed on us through a Memorandum of Understanding we have with Maine?s Department of Education (MDOE), which called for the destruction of MDOE's original records, we did provide OSA with the modified records used to determine eligibility benefits. This modification (such as removal of duplicates and address correction) was necessary for ingestion of these records into our Automated Client Eligibility System (ACES), the files were based on an exact replica of MDOE's original data files. These files, the output (client payments) and supporting information necessary for OSA to conduct testing and verify compliance with federal program requirements has been and continues to be available. We believe that the costs are allowable and supported by adequate documentation as required by the Uniform Guidance. Without performing audit testing on the population of payments in question, there is no basis for questioning compliance with eligibility requirements for this population and no basis for questioned costs. It should not be assumed that the entire population is considered ineligible without actually performing audit testing. Contact: Anthony Pelotte, Director, Office for Family Independence, DHHS, 207-624-4104 Auditor?s Concluding Remarks: The Department has not provided OSA with all requested documentation used to determine P-EBT benefits as outlined below: 1. Files received from MDOE were not provided: The files containing raw student data provided to OFI from MDOE were destroyed after transfer. OFI contends that this was done in accordance with the MOU in place between OFI and MDOE; however, the MOU further states that OFI should maintain the data used for determining client eligibility and distribution of benefits. In addition, while MDOE could recreate the student data, the files would not be adequate because benefit allotments and client identification information applied by OFI prior to P-EBT benefit issuance would not be included. Auditor's Concluding Remarks are continued on the following page. 2. Modified files based on MDOE data were provided: As noted in Management?s Response, modifications were made to MDOE raw student data files so that the files could be imported into OFI?s database. These modified files were used by OFI to generate benefit issuance files; however, the files contained student data from MDOE but did not provide client identification information or benefit allotment applied to each client. While OFI asserts that the files are based on an exact replica of MDOE?s original data files, OSA is unable to verify that the data presented in the modified files is an exact replica, that the data is accurate, or that all P-EBT eligible clients are included in the modified files. 3. Benefit Issuance files were not provided: OFI could not provide these files to OSA as they were not maintained in accordance with Federal regulations. Issuance files represent the information provided for the establishment and processing of benefits and contain the P- EBT benefit amounts allotted and related eligibility criteria used to issue Federal benefits to each child/client during the fiscal year. These benefit issuance files would have provided OSA an accurate population in order to test Federal compliance requirements for P-EBT eligibility and resulting benefit payment allowability. 4. Paid Benefit files were provided: OFI provided OSA with files containing information on paid benefit issuances during fiscal year 2022, referenced as the output (client payments) files in Management?s Response. While the data fields may be similar to the benefit issuance files used to process eligible clients and related benefit allotments, OSA does not have assurance that the output (client payments) file is accurate, complete, and aligns with the intended P-EBT recipients as established by the benefit issuance files. OFI did not provide OSA with all material used to determine P-EBT benefits. As outlined above, OFI provided modified records rather than original records because OFI did not maintain original issuance files utilized to provide client P-EBT benefits. Federal requirement 7 CFR 274.5 requires that States maintain issuance records for a period of three years. OFI failed to do so, resulting in noncompliance with Federal regulations. Because of OFI?s failure to provide issuance files, OSA was unable to test compliance with P-EBT eligibility and allowability. In accordance with 2 CFR 200.403, costs must be adequately documented. OFI could not provide documentation to support compliance with the terms and conditions of the Federal award to determine that such funds have been used in accordance with Federal program regulations. Therefore, OSA questions all costs for the program. The finding remains as stated. (State Number: 22-1108-05)

(2022-023) Title: Internal control over the submission and review of SNAP and P-EBT Schedule of Expenditures of Federal Awards information needs improvement Prior Year Findings: None State Department: Health and Human Services Administrative and Financial Services State Bureau: Office for Family Independence Office of the State Controller Federal Agency: U.S. Department of Agriculture Assistance Listing Title: SNAP Cluster (COVID-19) Pandemic EBT Food Benefits (P-EBT) (COVID-19) Assistance Listing Number: 10.551, 10.561; 10.542 Federal Award Identification Number: SNAP Benefits, Maine; P-EBT Benefits, Maine Compliance Area: Reporting Type of Finding: Material weakness Material noncompliance Questioned Costs: None Criteria: 2 CFR 200.303; 2 CFR 200.510 The Department must establish and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. The Department must prepare a Schedule of Expenditures of Federal Awards (SEFA) for the period covered by the State?s financial statements which must include the total Federal awards expended. At a minimum, the SEFA must provide total Federal awards expended for each individual Federal program and the Assistance Listing Number (ALN). Condition: The Department must complete and submit exhibits and related schedules to the Office of the State Controller (OSC) at the close of each fiscal year to report Federal award information for inclusion on the State?s SEFA. OSC is responsible for compiling this information on behalf of the State. In fiscal year 2022, the Department received funding for Supplemental Nutrition Assistance Program (SNAP) benefits under ALN 10.551. In addition, the Department received funding for Pandemic EBT Food Benefits (P-EBT) under ALN 10.542. At the close of the fiscal year, the Department and its Service Center provided a summary of Federal expenditures to OSC that included SNAP Cluster and P-EBT expenditures; however, the summary did not specifically identify P-EBT expenditures separately as funding under ALN 10.542. This summary was then used by OSC to compile and prepare the SEFA and the related Notes to the SEFA. Upon preparation, P-EBT expenditures were erroneously reported as SNAP expenditures under ALN 10.551 in the SEFA and in the related Note 5 to the SEFA which outlines Noncash Awards. Subsequent OSC review procedures were not designed to detect and correct these errors. As a result, P-EBT expenditures were omitted from the State?s fiscal year 2022 SEFA and related Notes when provided to the Office of the State Auditor for audit purposes. Context: For fiscal year 2022, P-EBT expenditures totaling $61.5 million were incorrectly reported on the SEFA and in the Notes to the SEFA, resulting in the omission of a Federal program and the overstatement of SNAP benefit expenditures. Cause: ? Lack of adequate internal control relating to Department SEFA submissions to OSC ? Lack of adequate review procedures by OSC Effect: Incomplete or inaccurate amounts by Federal program and ALN on the SEFA would result in noncompliance with Federal regulations if undetected. The SEFA is submitted to the Federal government and may be used for programmatic, policy, or statistical purposes. Recommendation: We recommend that the Department and its Service Center implement additional procedures to improve preparation and submission of SEFA information to OSC. We further recommend that OSC implement additional supervisory review procedures over the SEFA information compiled on behalf of the State. These control procedures will ensure that expenditures are reported accurately on the SEFA and in the related Notes to the SEFA. Corrective Action Plan: See F-12 Management?s Response: DHHS and DHHS Financial Service Center Response: The DHHS and DHHS Financial Service Center agree with this finding. For the next SEFA for SFY 2023, the OFI will report SNAP and P- EBT Benefit expenditures for the associated ALN to the Service Center. The OFI will report any new ALN, as documented in the April 2022 Coronavirus State and Local fiscal Recovery Funds, Department of the Treasury Assistance Listing Recovery Funds, as verified by SNAP, and associated expenses to the Service Center, if applicable. The Financial Service Center will then provide a summary and backup of what is being reported on the SEFA to OFI for their written approval. The Financial Service Center will add to the reviewer?s checklist that the preparer has consulted and has proper backup with the OFI to verify that the benefits are reported under the correct ALN. This will be completed by December 31, 2023. DHHS Contact: Anthony Pelotte, Director, Office for Family Independence, DHHS, 207-624-4104 OSC Response: The Office of the State Controller partially agrees with this finding. Federal funds reporting is decentralized and agencies use different methods for tying amounts to specific federal programs in Advantage. The Management Representation letters received from the agencies acknowledge that the agencies are responsible for the fair presentation of the expenditures in conformity with and in compliance with the rules and regulations of 2 CFR ?200. OSC is responsible to compile the data and submit the SEFA. OSC will update or clarify guidance as necessary and will consult with service center and agency financial personnel to help ensure their compilation/review systems are designed to provide accurate information for the SEFA. OSC Contact: Sandra Royce, Director of Financial Reporting, OSC, 207-626-8451 Auditor?s Concluding Remarks: In reply to OSC?s Management Response, the Office of the State Auditor (OSA) recognizes that SEFA reporting is a decentralized process and that OSC receives Management Representation Letters from agencies acknowledging responsibility for the fair presentation of SEFA information; however, OSC is responsible for reviewing the SEFA before it is provided to OSA for audit purposes. OSC has established review procedures prior to submission to OSA and that review and approval is documented on agencies? submissions. This review process, as stated in the finding, was not designed to detect and correct the errors noted in this finding, and findings 2022-053, 2022-064, and 2022-092, which are all related to agency submissions and OSC review of SEFA information. In addition, the Department of Administrative and Financial Services and OSC provide a signed Engagement Letter and Management Representation Letter to OSA, acknowledging the following responsibilities related to the annual Single Audit: ? Understanding and complying with the requirements of 2 CFR 200, including requirements relating to preparation of the SEFA ? Preparing and fairly presenting the SEFA and related disclosures in accordance with the requirements of the Uniform Guidance, including full identification of all government programs and related activities subject to the Federal compliance audit and all SEFA expenditures made during the audit period for all awards provided by Federal agencies OSA asserts that a year-to-year SEFA comparison would have detected the errors identified in the aforementioned findings; therefore, we continue to recommend that OSC implement additional supervisory review procedures over the SEFA information compiled on behalf of the State. This will provide assurance relating to the responsibility for SEFA information as outlined above and attested to OSA at the commencement and conclusion of the annual Single Audit. The finding remains as stated. (State Number: 22-1108-01)

(2022-024) Confidential finding, see below for more information Title: over , and , and needs improvement Pursuant to paragraph 6.63 of the U.S. Government Accountability Office?s Government Auditing Standards (also known as the Yellow Book), we omitted details from this finding as they are confidential under the provisions of 5 MRSA 244-C (3). Though the content of this finding has been redacted, we provided the Department(s) with detailed information regarding the specific condition we identified, as well as the related criteria, context, causes, effects, and our specific recommendations for improvement. Prior Year Findings: None Type of Finding: Material weakness Corrective Action Plan: See F-12 Contact: Shirley Browne, Deputy State Controller, Office of the State Controller, 207-626-8423 (State Number: 22-0905-05)

(2022-025) Title: Internal control over automated SNAP eligibility determinations and benefit calculations needs improvement Prior Year Findings: None State Department: Health and Human Services State Bureau: Office for Family Independence Federal Agency: U.S. Department of Agriculture Assistance Listing Title: SNAP Cluster (COVID-19) Assistance Listing Number: 10.551, 10.561 Federal Award Identification Number: SNAP Benefits, Maine Compliance Area: Allowable costs/cost principles Eligibility Special tests and provisions Type of Finding: Significant deficiency Questioned costs Known Questioned Costs: $2,952 Likely Questioned Costs: $7,686,166. Likely questioned costs were projected by dividing the known questioned costs in the sample by total authorized benefits tested to establish an error rate, then applying that error rate to total authorized benefits in fiscal year 2022. Criteria: 2 CFR 200.303; 2 CFR 200.403; 7 CFR 272.10; Families First Coronavirus Response Act (FFCRA) (Public Law 116-127), Section 2302 The Department must establish and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statues, regulations, and the terms and conditions of awards. To be allowable under Federal awards, costs must be necessary and reasonable for the performance of the Federal award and be adequately documented. 7 CFR 272.10 requires all State agencies to sufficiently automate their SNAP operations and computerize their systems for obtaining, maintaining, utilizing and transmitting information concerning SNAP. The FFCRA established emergency allotments for households participating in SNAP to provide temporary food needs at the applicable maximum allotment for the household size. Condition: The Supplemental Nutrition Assistance Program (SNAP) administered by the Office for Family Independence (OFI) provides monthly benefits to eligible households to purchase nutritious foods. OFI is required by Federal program regulations to utilize an automated information system for SNAP. The information system must maintain all casefile information necessary to properly process eligibility determinations and benefit computations. The Automated Client Eligibility System (ACES) is the information system used by OFI to automate SNAP operations. ACES relies on the maintenance of a complex framework of system rules to make eligibility determinations, benefit calculations, and notifications when redetermination or revalidation of client eligibility factors is warranted. The Office of the State Auditor (OSA) tested a sample of 60 cases to verify the accuracy of automated SNAP operations utilizing ACES. In two cases, ACES did not properly process casefile information related to social security income in system benefit calculations. Of the two cases, one case resulted in a monthly calculated benefit overpayment of $33 and one case resulted in a monthly calculated benefit overpayment of $2; however, both cases were paid accurate total monthly benefits due to the emergency allotment from the FFCRA which provided the maximum benefit amount for each case. Existing policies and procedures over the automated information system did not identify these errors in system benefit calculations. OSA?s audit procedures also identified one case where household countable assets were inaccurately entered into ACES by OFI personnel. The case should have been deemed ineligible based on household asset limits; however, the case received a monthly benefit amount of $234 for three months and $250 for nine months of fiscal year 2022. The Department does not review information entered into ACES prior to SNAP eligibility determinations and benefit calculations. Known questioned costs total $2,952. OSA selected a non-statistical random sample. OSA issued two other related findings: 2022-082, Internal control over the eligibility determination process needs improvement; and 2022-083, improvement. over needs Context: In fiscal year 2022, the State provided approximately 119,000 SNAP eligible clients with $466 million in Federal benefits. Cause: ? Lack of adequate policies and procedures ? Lack of supervisory oversight Effect: ? Known questioned costs ? Potential future questioned costs and disallowances ? Noncompliance with Federal regulations Recommendation: We recommend that the Department implement additional policies and procedures to ensure that: ? automated eligibility determinations and benefit calculations are processed in accordance with Federal regulations, and ? case information entered into ACES is accurate. Corrective Action Plan: See F-12 Management?s Response: The Department partially agrees with this finding. The Department acknowledges that errors were made in three cases out of the sample of sixty reviewed. However, the Department disagrees with the calculation of the payment error in the third case. Asset limits were eliminated for all categorically eligible households effective January 1, 2022, as part of SNAP rule #212. Therefore, the known questioned costs should only be $1,452. There is an incorrect reference in the condition, in two cases the income type is state supplement income which is issued by the Department and not the Social Security Administration. The Department will continue to review its standard operating procedures to identify opportunities for improvement. Contact: Anthony Pelotte, Director, Office for Family Independence, DHHS, 207-624-4104 Auditor?s Concluding Remarks: OSA recognizes that categorically eligible household asset limits were eliminated by a State SNAP rule change effective January 1, 2022, based on guidance from the U.S. Department of Agriculture?s Food and Nutrition Service. In the third case noted in Management?s Response above, OFI is incorrectly applying the rule change. The change in eligibility criteria is only applicable to new determinations or redeterminations; therefore, in the case identified by OSA, the applicant would have had to apply for redetermination subsequent to the rule change in order for the asset limitation to be exempted from the eligibility determination process. OSA?s calculation of questioned costs totaling $2,952 for all fiscal year 2022 benefits related to this case is accurate. In regard to the incorrect reference noted in Management?s Response, OFI contends that ?information related to social security income? is an incorrect reference in the Condition; however, OSA maintains that the reference is correct and refers to State Supplemental Payments paid to eligible recipients of social security income. The reference as written, or as OFI suggests, does not change the deficiency reported by OSA which identified that controls relied upon in the automated information system did not identify errors in benefit calculations related to this income component. The finding remains as stated. (State Number: 22-1108-06)

(2022-026) Title: Internal control over the issuance of SNAP benefits needs improvement Prior Year Findings: See Schedule of Findings and Questioned Costs for chart/table State Department: Health and Human Services State Bureau: Office for Family Independence Federal Agency: U.S. Department of Agriculture Assistance Listing Title: SNAP Cluster (COVID-19) Assistance Listing Number: 10.551, 10.561 Federal Award Identification Number: SNAP Benefits, Maine Compliance Area: Allowable costs/cost principles Eligibility Type of Finding: Significant deficiency Questioned Costs: None Criteria: 2 CFR 200.303; 2 CFR 200.403 The Department must establish and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statues, regulations, and the terms and conditions of awards. To be allowable under Federal awards, costs must be necessary and reasonable for the performance of the Federal award and be adequately documented. Condition: The Department receives date of death (DOD) information from the Maine Center for Disease Control & Prevention (MeCDC) and the Social Security Administration (SSA) on a weekly basis. The Office of the State Auditor (OSA) obtained DOD information from MeCDC and compared it to clients who received Supplemental Nutrition Assistance Program (SNAP) benefits during fiscal year 2022. Of the cases that had benefit issuances after the client?s DOD, OSA identified 998 cases where SNAP benefits were issued in excess of 30 days following the client?s DOD. In 17 of the 998 cases, benefits were issued 140 days or more after the client?s DOD. In 4 of the 17 cases, MeCDC?s reported DOD did not match the DOD documented in the client?s eligibility system case file. Issuance of benefits to a deceased client does not necessarily result in unallowable program costs, as the issued benefits may not be expended. Context: In fiscal year 2022, the State provided approximately 119,000 SNAP clients with $466 million in Federal benefits. Of the 119,000 SNAP clients, 1,875 had a DOD in fiscal year 2022. Cause: ? Lack of adequate procedures ? Lack of supervisory oversight Effect: ? Benefits issued on behalf of deceased clients may go undetected, and may result in unallowable benefit transaction activity. ? Potential questioned costs and disallowances Recommendation: We recommend that the Department improve procedures to ensure that DOD information is received, reviewed, and updated in the eligibility system on a biweekly or monthly basis to prevent incorrect issuances of benefits. Corrective Action Plan: See F-13 Management?s Response: The Department partially agrees with this finding. The Department acknowledges the 17 exceptions cited, 4 of which also contained a data mismatch between our ACES system and Maine?s CDC DAVE system. However, it should be noted that although we agree with the specific exceptions cited, they represent only 17 cases or 0.9% out of a pool of approximately 1,875 deceased clients identified, well within a reasonable margin of error. The reference to 998 cases cited in the finding, where SNAP benefits were issued in excess of 30 days, is inconsistent with the 365-day requirement from FNS. It should be noted that language contained in 7 CFR 272.14(c)(1) only requires that states make a comparison of deceased matched data with no less frequency of once per year. Our date of death procedures includes weekly processing of discrepancy reports from federal agencies as well as monthly crosswalks between ACES and Maine?s CDC. Contact: Anthony Pelotte, Director, Office for Family Independence, DHHS, 207-624-4104 Auditor?s Concluding Remarks: The Department receives DOD information from MeCDC and the SSA on a weekly basis, and as noted in Management?s Response, has established policies and procedures that require crossmatching of SNAP client information with DOD information on a more frequent basis than the annual requirement cited above. The 17 cases noted as exceptions had benefits issued 140 days or more past DOD and represented the most egregious cases; however, a total of 998 cases were identified out of 1,875 deceased clients where benefits were issued more than 30 days after DOD. This represents 53% of deceased clients in fiscal year 2022 that should have been identified through weekly processing of discrepancy reports from the SSA and through the monthly data crossmatch between ACES and MeCDC. The established procedures are not effective in preventing incorrect issuances of benefits. The finding remains as stated. (State Number: 22-1108-04)

(2022-027) Title: Internal control over EBT reconciliation procedures needs improvement Prior Year Findings: See Schedule of Findings and Questioned Costs for chart/table State Department: Health and Human Services State Bureau: Office for Family Independence Federal Agency: U.S. Department of Agriculture Assistance Listing Title: SNAP Cluster (COVID-19) Pandemic EBT Food Benefits (P-EBT) (COVID-19) Assistance Listing Number: 10.551, 10.561; 10.542 Federal Award Identification Number: SNAP Benefits, Maine; P-EBT Benefits, Maine Compliance Area: Allowable costs/cost principles Special tests and provisions Type of Finding: Significant deficiency Questioned costs Known Questioned Costs: $80,555 under ALN 10.542, P-EBT Food Benefits Likely Questioned Costs: $80,555 under ALN 10.542, P-EBT Food Benefits Criteria: 2 CFR 200.303; 2 CFR 200.403; 7 CFR 274.4 The Department must establish and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. To be allowable under Federal awards, costs must be necessary and reasonable for the performance of the Federal award and be adequately documented. The Department shall account for all Electronic Benefit Transfer (EBT) issuances through a reconciliation of total funds entered into, exiting from, and remaining in the EBT system each day. Condition: The Supplemental Nutrition Assistance Program (SNAP) provides monthly benefits to eligible households to purchase nutritious foods. The Pandemic EBT (P-EBT) Food Benefits program provides temporary emergency nutrition benefits to eligible school children. Both programs utilize EBT cards as the mechanism to provide benefits. Benefit information is transmitted by the Department to the Electronic Payment Processing and Information Control (EPPIC) system for processing. As EBT purchases are made by SNAP and P-EBT clients, EPPIC automatically draws Federal funds using the Automated Standard Application for Payments (ASAP) system in order to pay retailers. The Department is required by Federal program regulations to reconcile EBT activity between the systems every day. The Department did not perform daily reconciliations from July 2021 through April 2022. The Department retrospectively performed these daily reconciliations in April 2022. This retrospective reconciliation process identified an error in July 2021 SNAP benefit issuances. Benefits totaling $80,555 were incorrectly issued out of the Federal P-EBT Food Benefits program instead of the Federal/State SNAP program due to an EPPIC processing error. The error has not been corrected as of February 2023. Context: In fiscal year 2022, the State provided approximately: ? 119,000 SNAP clients with $466 million in Federal benefits, and ? 115,000 P-EBT clients with $61.5 million in Federal benefits. Cause: ? Lack of adequate policies and procedures ? Lack of supervisory oversight to ensure required reconciliations are completed ? The staff member responsible for performing this Federal requirement did not have access to the ASAP system for nine months of the fiscal year, which is needed to perform the daily reconciliation. Access to the ASAP system was granted in April 2022. Effect: ? SNAP program expenditures are understated and P-EBT Food Benefits program expenditures are overstated by $80,555 as reported to the Federal government. ? Known questioned costs ? Potential future questioned costs and disallowances ? Noncompliance with Federal regulations Recommendation: We recommend that the Department maintain policies and procedures to ensure compliance with Federal program regulations and that require: ? completion of EBT reconciliations on a daily basis, and ? timely correction of issuance errors. Corrective Action Plan: See F-13 Management?s Response: The Department partially agrees with this finding. The Department agrees that reconciliations were not completed as required until April of 2022, but that they were done retrospectively. The Department disagrees that there are questioned costs in the amount of $80,555. This debt was not caused by a failure to perform reconciliations. Rather, it was discovered by the retroactive reconciliations performed by the Department. Contact: Anthony Pelotte, Director, Office for Family Independence, DHHS, 207-624-4104 Auditor?s Concluding Remarks: In accordance with 7 CFR 274.4, the Department is required to perform daily reconciliations of the EBT system. The Department?s failure to perform these daily reconciliations resulted in noncompliance with Federal regulations. Furthermore, if the daily reconciliations had been performed as required, the issuance error would have been detected and corrected in a timely manner, preventing reoccurrence throughout the month of July 2021. In accordance with 2 CFR 200.403, for a cost to be allowable under a Federal award, the costs must be reasonable and necessary for the performance of the Federal award. Issuing benefits out of the wrong Federal program is not a necessary cost for the performance of the Federal award; therefore, the Office of the State Auditor questions the allowability of these costs. The finding remains as stated. (State Number: 22-1108-03)

(2022-028) Title: Internal control over EBT card security needs improvement Prior Year Findings: None State Department: Health and Human Services State Bureau: Office for Family Independence Federal Agency: U.S. Department of Agriculture Assistance Listing Title: SNAP Cluster (COVID-19) Assistance Listing Number: 10.551, 10.561 Federal Award Identification Number: SNAP Benefits, Maine Compliance Area: Special tests and provisions Type of Finding: Significant deficiency Questioned Costs: None Criteria: 2 CFR 200.303; 7 CFR 274.5 The Department must establish and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. The State is required to provide the following minimum security and control procedures for EBT cards: secure storage; access limited to authorized personnel; inventory control records; and a periodic review and validation of inventory controls and records by parties not otherwise involved in maintaining control records. Issuance, inventory, reconciliation, and other accountability records must be maintained for a period of three years. Condition: The Supplemental Nutrition Assistance Program (SNAP) provides monthly benefits to eligible households to purchase nutritious foods. The program utilizes Electronic Benefit Transfer (EBT) cards as the mechanism to provide benefits. SNAP benefit information is transmitted to the Electronic Payment Processing and Information Control (EPPIC) system used for EBT. An EBT card is issued by EPPIC and mailed to the client?s home address. EBT cards that are undeliverable are returned to the regional Department of Health and Human Services office for processing. The Department has assigned responsibility for processing returned EBT cards to one employee. This process includes receiving returned cards, record keeping activity, and actual destruction or retransmission of cards. Returned EBT cards are either destroyed or retransmitted and these actions are tracked using two separate spreadsheets. The Department has not implemented segregation of duties within the process to ensure that the activity recorded on the spreadsheets aligns with the activity that occurred. In addition, the existing process does not require that returned EBT cards are secured; returned cards are placed in an open mailbox during processing. The Office of the State Auditor (OSA) tested a sample of 60 returned EBT cards to verify the accuracy and completeness of the activity recorded on the tracking spreadsheets. Three returned EBT cards were disabled in EPPIC between two and seven months before being recorded as destroyed. Since documentation noting the date of receipt at DHHS is not maintained, OSA was unable to verify the security of the EBT card during the extended periods of inactivity. OSA selected a non-statistical random sample. Additional analytical procedures identified: ? two returned EBT cards which were included on both spreadsheets. Additional audit procedures identified that these cards should have been logged as retransmitted. ? three returned EBT cards which were processed utilizing inaccurate client information. Multiple client names were tied to the same client identification number. Context: In fiscal year 2022, the State provided approximately 119,000 SNAP clients with $466 million in Federal benefits. The Department processed 2,200 returned EBT cards; 790 were recorded as retransmitted and 1,410 were recorded as destroyed. Cause: ? Lack of policies and procedures relating to the security of returned EBT cards ? Lack of segregation of duties Effect: Potential unauthorized use of EBT cards Recommendation: We recommend that the Department implement procedures to maintain adequate security over returned EBT cards, including proper segregation of duties within the process. Corrective Action Plan: See F-13 Management?s Response: The Department agrees with this finding. The Department acknowledges the need to implement a revised SOP governing returned card processing. The revised SOP will include clear segregation of duties to include enhanced management oversight by and between personnel involved. The Department disagrees that adequate security controls are not maintained. Undeliverable EBT cards are delivered to a regional office each business day, and those cards are worked the day they are received. They are placed in the mailbox of a clerical resource that works in the office. The mailbox is located in an area restricted to those that have badge access. Contact: Anthony Pelotte, Director, Office for Family Independence, DHHS, 207-624-4104 Auditor?s Concluding Remarks: The State is required by Federal regulations to maintain minimum security procedures for EBT cards that include secure storage and limited access. An unsecured mailbox in a location accessible to numerous employees not authorized to handle returned EBT cards is not secure storage or limited access. In addition, because documentation noting the date of receipt of returned EBT cards at DHHS is not maintained, OSA is unable to verify that cards are processed on the date of receipt. The finding remains as stated. (State Number: 22-1108-02)

(2022-029) Confidential finding, see below for more information Title: over the needs improvement Pursuant to paragraph 6.63 of the U.S. Government Accountability Office?s Government Auditing Standards (also known as the Yellow Book), we omitted details from this finding as they are confidential under the provisions of 5 MRSA 244-C (3). Though the content of this finding has been redacted, we provided the Department(s) with detailed information regarding the specific condition we identified, as well as the related criteria, context, causes, effects, and our specific recommendations for improvement. Prior Year Findings: See Schedule of Findings and Questioned Costs for chart/table Type of Finding: Significant deficiency Corrective Action Plan: See F-13 Contact: Shirley Browne, Deputy State Controller, Office of the State Controller, 207-626-8423 (State Number: 22-0905-02)

(2022-030) Title: Internal control over CNC special reporting needs improvement Prior Year Findings: None State Department: Education State Bureau: Commissioner?s Office Child Nutrition Services Federal Agency: U.S. Department of Agriculture Assistance Listing Title: Child Nutrition Cluster (COVID-19) Assistance Listing Number: 10.553, 10.555, 10.556, 10.559, 10.582 Federal Award Identification Number: 214ME300L1603, 214ME301N1099, 214ME301N1199, 224ME301N1199, 224ME300L1603, 214ME102H1703, 224ME902N8903 Compliance Area: Reporting Type of Finding: Material weakness Material noncompliance Questioned Costs: None Criteria: 2 CFR 200.303; 2 CFR 170 The Department must establish and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. Agencies must report each subaward that equals or exceeds the first-tier subaward threshold of $30,000 in Federal funds in the public-facing Federal Funding Accountability and Transparency Act (FFATA) Subaward Reporting System. Condition: When an amount exceeding the first-tier subaward threshold is awarded to a subrecipient, the Department must collect and enter data into the FFATA Subaward Reporting System. The Department did not report any of its first-tier subawards under the Child Nutrition Cluster (CNC) in the FFATA reporting system for fiscal year 2022. Context: In fiscal year 2022, the Department was required to report first-tier subawards totaling $113 million under the CNC. First-tier subawards account for 95 percent of the program?s fiscal year 2022 expenditures. Cause: ? Lack of supervisory oversight ? Lack of policies and procedures Effect: ? Noncompliance with Federal regulations ? First-tier subaward information for the CNC was not reported to the Federal government. This information may be used for programmatic, policy, or statistical purposes. Recommendation: We recommend that the Department implement policies and procedures to ensure subawards meeting or exceeding the first-tier threshold are reported accurately, timely, and in accordance with Federal regulations. Corrective Action Plan: See F-14 Management?s Response: The Department agrees with this finding. The USDA Child Nutrition grant funds are paid as expenditure reimbursements rather than awarded by a formula or fixed amount. Reimbursements are processed through a claims system specific to Child Nutrition instead of through the Department?s grant management system which houses grant awards from the USDOE. Due to these factors, a new process must be developed to capture reportable Child Nutrition expenditure data. The Department will develop and implement a procedure for the Child Nutrition Cluster to ensure subawards meeting or exceeding the first-tier threshold are reported accurately, timely, and in accordance with Federal regulations. Contact: Jane McLucas, Director of Child Nutrition, DOE, 207-624-6880 (State Number: 22-1203-05)

(2022-031) Title: Internal control over Child Nutrition claim reimbursements needs improvement Prior Year Findings: None State Department: Education State Bureau: Child Nutrition Services Federal Agency: U.S. Department of Agriculture Assistance Listing Title: Child Nutrition Cluster (COVID-19) Assistance Listing Number: 10.553, 10.555, 10.556, 10.559, 10.582 Federal Award Identification Number: 214ME300L1603, 214ME301N1099, 214ME301N1199, 224ME301N1199, 224ME300L1603, 214ME102H1703, 224ME902N8903 Compliance Area: Allowable costs/cost principles Type of Finding: Material weakness Questioned Costs: None Criteria: 2 CFR 200.303; 7 CFR 210.7 and .8 The Department must establish and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. Claims for reimbursement must be based on lunch counts taken daily at the point of service, which correctly identify the number of free, reduced price, and paid lunches served to eligible children. The Department is required to review each School Food Authority?s (SFA) claim for reimbursement, on a monthly basis, to ensure that monthly claims are limited to the number of lunches served to eligible children. The Department then reimburses the SFA for actual meals served, based on the SFA?s claim for reimbursement utilizing rates that are programmed in the system. Condition: The Child Nutrition Program (CNP) provides nutritious meals to eligible children in schools, child-care facilities, and summer lunch programs. Each SFA must submit a monthly claim for reimbursement (CFR) to the State through the CNPWeb system that includes actual meals served for the month. The Department then reimburses the SFA for meals served based on the SFA?s CFR utilizing rates that are programmed in the system. The Department relies on the rates that are programmed in the CNPWeb system to ensure that claims are processed correctly. The Department could not provide documentation that CNPWeb system rates and related rate changes were approved, or tested for accuracy. Furthermore, the Department does not have a process in place to review and monitor discrepancies within the CNPWeb system. The Office of the State Auditor (OSA) selected 60 CFRs for testing and found one claim which included two schools. In this claim, meal counts did not accurately reflect the number of meals from the daily point of service for meals served. Instead, total meals were combined and then split equally between the two schools. OSA selected a non-statistical random sample. Context: Child Nutrition Cluster expenditures totaled $118.3 million in fiscal year 2022. Cause: ? Lack of policies and procedures ? Lack of supervisory oversight Effect: ? CFRs may be processed incorrectly, resulting in erroneous reimbursements to SFAs. ? Noncompliance with Federal regulations ? Potential questioned costs and disallowances Recommendation: We recommend that the Department implement policies and procedures which require review, approval, and a listing of system changes. We further recommend that oversight of the review and processing of monthly CFRs be implemented. Corrective Action Plan: See F-14 Management?s Response: The Department agrees with this finding. The Department will implement policies and procedures to review and approve CNPWeb system changes. The CFR exception noted in this finding occurred during the period of time that schools were operating the Seamless Summer Option (SSO) and operating in varied circumstances due to the pandemic. In this situation two schools that share a cafeteria were operating one line and counting students as one group rather than by school, and then dividing the meals between the schools. The Summer Food Service Program will offer updated training that will include specific procedures on meal counting and claiming for schools that may operate this provision. Additionally, a policy will be created for the oversight of claiming procedures during the SSO operations. Contact: Jane McLucas, Director of Child Nutrition, DOE, 207-624-6880 (State Number: 22-1203-02)

(2022-032) Confidential finding, see below for more information Title: over the needs improvement Pursuant to paragraph 6.63 of the U.S. Government Accountability Office?s Government Auditing Standards (also known as the Yellow Book), we omitted details from this finding as they are confidential under the provisions of 5 MRSA 244-C (3). Though the content of this finding has been redacted, we provided the Department(s) with detailed information regarding the specific condition we identified, as well as the related criteria, context, causes, effects, and our specific recommendations for improvement. Prior Year Findings: None Type of Finding: Material weakness Corrective Action Plan: See F-14 Contact: Shirley Browne, Deputy State Controller, Office of the State Controller, 207-626-8423 (State Number: 22-0909-04)

(2022-033) Confidential finding, see below for more information Title: over the and needs improvement Pursuant to paragraph 6.63 of the U.S. Government Accountability Office?s Government Auditing Standards (also known as the Yellow Book), we omitted details from this finding as they are confidential under the provisions of 5 MRSA 244-C (3). Though the content of this finding has been redacted, we provided the Department(s) with detailed information regarding the specific condition we identified, as well as the related criteria, context, causes, effects, and our specific recommendations for improvement. Prior Year Findings: None Type of Finding: Material weakness Corrective Action Plan: See F-14 Contact: Shirley Browne, Deputy State Controller, Office of the State Controller, 207-626-8423 (State Number: 22-0909-06)

(2022-034) Title: Internal control over the submission of CNC Schedule of Expenditures of Federal Awards information needs improvement Prior Year Findings: None State Department: Education Administrative and Financial Services State Bureau: Child Nutrition Services General Government Service Center Federal Agency: U.S. Department of Agriculture Assistance Listing Title: Child Nutrition Cluster (COVID-19) Assistance Listing Number: 10.553, 10.555, 10.556, 10.559, 10.582 Federal Award Identification Number: 214ME300L1603, 214ME301N1099, 214ME301N1199, 224ME301N1199, 224ME300L1603, 214ME102H1703, 224ME902N8903 Compliance Area: Reporting Type of Finding: Significant deficiency Questioned Costs: None Criteria: 2 CFR 200.303; 2 CFR 200.502; 2 CFR 200.510; 2 CFR 200, Appendix XI, OMB M- 20-26; Section 2202(a) Families First Coronavirus Response Act (FFCRA) The Department must establish and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. The Department must prepare a Schedule of Expenditures of Federal Awards (SEFA) for the period covered by the State?s financial statements which must include the total Federal awards expended, including distribution or use of food commodities, and must be based on when the activity related to the Federal award occurs. For a cluster of programs, the schedule must list individual Federal programs within the cluster. To maximize the transparency and accountability of COVID-19 related award expenditures, OMB M-20-26 (June 18, 2020) instructed recipients and subrecipients to separately identify the COVID-19 Emergency Acts expenditures on the SEFA. Therefore, non-Federal entities should separately identify COVID-19 expenditures on the SEFA. For existing programs that have both COVID-19 expenditures and non-COVID-19 expenditures, this may be accomplished by identifying COVID-19 expenditures on the SEFA on a separate line by Assistance Listing number (ALN) with ?COVID-19? as a prefix to the program name. Several waivers were issued by Food and Nutrition Services under section 2202(a) of the FFCRA. These waivers allowed School Food Authorities to participate in various programs and be paid at higher rates, and allowed schools to be reimbursed for all meals served to students regardless of eligibility status. Condition: The Department must complete and submit exhibits and related schedules to the Office of the State Controller (OSC) at the close of each fiscal year to report Federal award information for inclusion on the State?s SEFA. OSC is responsible for compiling this information on behalf of the State. The Department submitted exhibits to OSC that: ? incorrectly reported expenditures for ALN 10.553 School Breakfast Program ($23.5 million) and ALN 10.556 Special Milk Program ($8,354) under ALN 10.555 National School Lunch Program. ? reported the amount of noncash assistance that the State was entitled to use ($5.9 million), rather than the amount that was actually used ($4.8 million). Furthermore, the entire amount was incorrectly reported under ALN 10.555 when a portion of this should have been reported under ALN 10.559 Summer Food Service Program for Children. ? did not specifically identify COVID-19 related expenditures for the Child Nutrition Cluster (CNC) on the State?s fiscal year 2022 SEFA; this has since been corrected. Furthermore, CNC expenditures increased significantly due to waivers issued under the FFCRA. These expenditures were issued under existing grant awards and therefore cannot be easily identified. As a result, these expenditures are not separately reported on the SEFA as COVID-19 expenditures. Context: In fiscal year 2022, CNC expenditures totaled $118 million. Of that amount: ? $1.7 million was expended under a COVID-19 specific grant. ? $4.8 million was expended as distributions of noncash food commodities. ? expenditures for the School Breakfast Program and Special Milk Program were $23.5 million and $8,354, respectively. Cause: ? Lack of adequate policies and procedures relating to Department SEFA submissions to OSC ? Lack of supervisory oversight Effect: Inaccurate reporting of expenditure amounts on the SEFA, which is submitted to the Federal government, may result in incorrect information used for programmatic, policy, or statistical purposes. Recommendation: We recommend that the Department implement additional procedures to ensure accurate preparation, review and submission of SEFA information to OSC. Corrective Action Plan: See F-15 Management?s Response: The Department agrees with this finding. The Department will report expenditures for the School Breakfast Program and Special Milk Program under the individual ALNs rather than including those expenditures in the broader ALN 10.555. The Department will report noncash assistance at the amount actually used rather than the amount authorized for use. The Department will add a note to the SEFA report indicating any COVID-19 expenditures that cannot be isolated due to waivers. Contact: Nicole Denis, Director of Finance, DOE, 207-530-2161 (State Number: 22-1203-01)

(2022-035) Title: Internal control over CNC subrecipient audit procedures needs improvement Prior Year Findings: None State Department: Education State Bureau: Commissioner?s Office Child Nutrition Services Federal Agency: U.S. Department of Agriculture Assistance Listing Title: Child Nutrition Cluster (COVID-19) Assistance Listing Number: 10.553, 10.555, 10.556, 10.559, 10.582 Federal Award Identification Number: 214ME300L1603, 214ME301N1099, 214ME301N1199, 224ME301N1199, 224ME300L1603, 214ME102H1703, 224ME902N8903 Compliance Area: Subrecipient monitoring Type of Finding: Significant deficiency Questioned Costs: None Criteria: 2 CFR 200.303; 2 CFR 200.332 The Department must establish and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. When a subrecipient?s Federal award expenditures are expected to equal or exceed $750,000 during the fiscal year, the Department must verify that the subrecipient is audited as required. Condition: The Department of Education (DOE) School Finance and Operations is responsible for tracking and reviewing subrecipient audits on behalf of the Child Nutrition Cluster (CNC). CNC program subrecipients include schools that are provided Federal funds to support food service programs. The Office of the State Auditor (OSA) requested a list of subrecipients that required audits in fiscal year 2022 from DOE to test compliance with Federal regulations. OSA independently queried the State?s accounting system to develop a separate list for comparison and to ensure completeness. OSA compared DOE?s tracking to OSA?s generated list and found two subrecipients that were excluded from DOE?s tracking. DOE?s tracking excluded two private schools that received Federal funds in excess of the $750,000 Single Audit requirement; therefore, the audits for the two schools were not received or reviewed. Context: In fiscal year 2022, $113 million was provided to 254 subrecipients. Approximately 120 subrecipients were required to have an audit in accordance with Federal regulations. Cause: ? Lack of adequate policies and procedures. DOE policies do not provide guidance over tracking audits of private schools. ? Lack of supervisory oversight Effect: ? Noncompliance with Federal regulations ? Subrecipients may not be complying with Federal statutes, regulations, or the terms and conditions of the subaward. Recommendation: We recommend that the Department implement policies and procedures to ensure that audit reports for all subrecipients, including private schools, receiving over $750,000 in Federal awards are tracked, received, and reviewed. Corrective Action Plan: See F-15 Management?s Response: The Department agrees with this finding. Child Nutrition will create policies and procedures to collect, track, and review single audits for private schools receiving over $750,000 in Federal awards. Contact: Jane McLucas, Director of Child Nutrition, DOE, 207-624-6880 (State Number: 22-1203-04)

(2022-036) Title: Internal control over Child Nutrition donated food inventory needs improvement Prior Year Findings: None State Department: Education State Bureau: Child Nutrition Services Federal Agency: U.S. Department of Agriculture Assistance Listing Title: Child Nutrition Cluster (COVID-19) Assistance Listing Number: 10.553, 10.555, 10.556, 10.559, 10.582 Federal Award Identification Number: 214ME300L1603, 214ME301N1099, 214ME301N1199, 224ME301N1199, 224ME300L1603, 214ME102H1703, 224ME902N8903 Compliance Area: Special tests and provisions Type of Finding: Significant deficiency Questioned Costs: None Criteria: 2 CFR 200.303; 7 CFR 250.12 and .19 The Department must establish and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. The distributing agency must ensure that a separate inventory record of donated foods is maintained. The distributing agency?s system of inventory management must ensure that donated foods are distributed in a timely manner and in optimal condition. Condition: The Department receives donated foods from the U.S. Department of Agriculture (USDA) for distribution to School Food Authorities (SFAs). In fiscal year 2022, the Department implemented a new inventory system for tracking donated foods. The system, as implemented, did not provide the level of detail needed for accurate tracking of inventory. Limitations included lack of data fields to record: ? lost or damaged goods, and ? the date for all stages of the inventory process (order date, receipt date, distribution date). The Office of the State Auditor (OSA) tested 12 donated food items for proper recording. OSA reviewed documentation of USDA food requests, inventory receipts, and distributions made to SFAs against information in the inventory system. Inventory calculated by OSA did not align with system-generated inventory records for all 12 items. OSA selected a non-statistical random sample. Context: In fiscal year 2022, the Department distributed approximately $5 million of donated foods to SFAs. Cause: ? Lack of a reliable inventory tracking system ? Lack of supervisory oversight Effect: ? Noncompliance with Federal regulations ? Inaccurate reporting of noncash Federal awards on the Schedule of Expenditures of Federal Awards ? Theft, loss, or damage of inventory may go undetected. Recommendation: We recommend that the Department: ? continue to enhance the inventory tracking system, and ? increase oversight of donated food tracking and the inventory systems used. This will ensure inventory records are accurate and complete. Corrective Action Plan: See F-15 Management?s Response: The Department agrees with this finding. Child Nutrition has purchased software and is in the implementation stages of the project. This year, the Food Distribution Program has done supplemental record keeping, supplementing the detail within the system. We will continue to improve the tracking and enhance the inventory system. Contact: Jane McLucas, Director of Child Nutrition, DOE, 207-624-6880 (State Number: 22-1203-06)

(2022-037) Confidential finding, see below for more information Title: over the needs improvement Pursuant to paragraph 6.63 of the U.S. Government Accountability Office?s Government Auditing Standards (also known as the Yellow Book), we omitted details from this finding as they are confidential under the provisions of 5 MRSA 244-C (3). Though the content of this finding has been redacted, we provided the Department(s) with detailed information regarding the specific condition we identified, as well as the related criteria, context, causes, effects, and our specific recommendations for improvement. Prior Year Findings: None Type of Finding: Significant deficiency Corrective Action Plan: See F-15 Contact: Shirley Browne, Deputy State Controller, Office of the State Controller, 207-626-8423 (State Number: 22-0909-05)

(2022-038) Confidential finding, see below for more information Title: over the needs improvement Pursuant to paragraph 6.63 of the U.S. Government Accountability Office?s Government Auditing Standards (also known as the Yellow Book), we omitted details from this finding as they are confidential under the provisions of 5 MRSA 244-C (3). Though the content of this finding has been redacted, we provided the Department(s) with detailed information regarding the specific condition we identified, as well as the related criteria, context, causes, effects, and our specific recommendations for improvement. Prior Year Findings: None Type of Finding: Significant deficiency Corrective Action Plan: See F-16 Contact: Shirley Browne, Deputy State Controller, Office of the State Controller, 207-626-8423 (State Number: 22-0909-08)

(2022-039) Title: Internal control over WIC subrecipient monitoring needs improvement Prior Year Findings: See Schedule of Findings and Questioned Costs for chart/table State Department: Health and Human Services State Bureau: Maine Center for Disease Control & Prevention Federal Agency: U.S. Department of Agriculture Assistance Listing Title: Special Supplemental Nutrition Program for Women, Infants, and Children (WIC) (COVID-19) Assistance Listing Number: 10.557 Federal Award Identification Number: 194ME743W5003, 204ME743W5003, 214ME701W1003, 214ME743W5003, 224ME743W5003, 224ME701W1003 Compliance Area: Subrecipient monitoring Type of Finding: Material weakness Material noncompliance Questioned Costs: None Criteria: 2 CFR 200.303; 7 CFR 246.19 The Department must establish and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. The Department shall establish an ongoing management evaluation system which includes the monitoring of local agency operations, the review of local agency financial and participation reports, the development of corrective action plans to resolve program deficiencies, the monitoring of implementation of the corrective action plans, and on-site visits. The results of such actions must be documented. Monitoring of local agencies must encompass evaluation of management, certification, nutrition education, breastfeeding promotion and support, participant services, civil rights compliance, accountability, financial management systems, and food delivery systems. The Department must conduct monitoring reviews of each local agency at least once every two years. Monitoring must include on-site reviews of a minimum of 20 percent of the clinics in each local agency, or one clinic, whichever is greater. Condition: The State contracts with eight local agencies to administer the WIC program. The Department is required to perform management evaluation reviews (MERs) of each local agency at least once every two years. The Department performed full-year MERs for five of the eight local agencies during fiscal year 2022. In the Office of the State Auditor?s (OSA?s) testing: ? three local agencies had full-year MERs, conducted in excess of the two-year timeframe: o one local agency MER due in July 2020 was not performed until September 2021; o one local agency MER due in April 2020 was not performed until May 2021; and o one local agency MER due in October 2020 was not performed until November 2021. ? the financial review portion of the MER was not completed for any of the five local agencies. Of the three remaining local agencies for which the Department did not perform a full-year MER during fiscal year 2022: ? one local agency MER due in November 2021 was not performed during the fiscal year. ? two local agencies were not due for a full-year MER until after audit testing; therefore, OSA did not perform audit testing on these local agency MERs. Context: The Department provided $3.6 million in WIC program funds to eight local agencies in fiscal year 2022. Cause: ? Lack of staff resources available to perform the financial portion of the MERs ? Lack of supervisory oversight Effect: ? Federal programs may not be effectively and efficiently administered. ? Potential questioned costs and disallowances Recommendation: We recommend that the Department: ? implement a process to ensure that the backlog of reviews is completed; ? review its staffing needs to ensure there are adequate resources allocated to the MER process to ensure all portions of the reviews are fully completed; and ? implement additional oversight procedures to ensure all portions of the reviews are fully completed. Corrective Action Plan: See F-16 Management?s Response: The Department agrees with this finding. WIC completed five MERs for FY 22, due to COVID and lack of personnel the three remaining MERs were delayed. WIC is working to catch up on MERs and has begun working with additional staff from DHHS Internal Audit to aid in completing the MER financial component timelier. The training and planning with the DHHS Internal Audit team is underway. All local agencies were monitored for FY22. Contact: Ginger Roberts-Scott, Senior Health Program Manager, DHHS, 207-287-5342 (State Number: 22-1113-03)

(2022-040) Title: Internal control over WIC cash balances needs improvement Prior Year Findings: See Schedule of Findings and Questioned Costs for chart/table State Department: Health and Human Services Administrative and Financial Services State Bureau: Maine Center for Disease Control & Prevention Health and Human Services Service Center Federal Agency: U.S. Department of Agriculture Assistance Listing Title: Special Supplemental Nutrition Program for Women, Infants, and Children (WIC) (COVID-19) Assistance Listing Number: 10.557 Federal Award Identification Number: 194ME743W5003, 204ME743W5003, 214ME701W1003, 214ME743W5003, 224ME743W5003, 224ME701W1003 Compliance Area: Cash management Type of Finding: Significant deficiency Questioned Costs: None Criteria: 2 CFR 200.303; 2 CFR 200.302 The Department must establish and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. Financial records must adequately identify the source and application of funds and provide accountability for all funds, property, and other assets related to the Federally funded activities. Condition: The Office of the State Auditor (OSA) issued finding 2019-021 as a result of procedures performed for the fiscal year 2019 audit. This finding identified that ?Program personnel did not take the existing cash balance into consideration when requesting Federal funds for the Food portion of the WIC grant.? This resulted in an excess cash balance for the Food grant. The finding was repeated as finding 2020-021 for the fiscal year 2020 audit and finding 2021-018 for the fiscal year 2021 audit. In response to these findings, the Department performed a reconciliation of all prior grant awards to determine the cause of the excess cash balance. This reconciliation identified a $1,055,088 discrepancy between the State?s accounting system, WIC reporting. and Federal draws from the 2013 WIC Food grant. Context: The Department calculated a $1,055,088 residual cash balance from WIC Food grant awards issued in 2013. Cause: Lack of adequate recordkeeping and account reconciliation in prior years Effect: The State may be required to return $1,055,088 to the Federal awarding agency. Recommendation: We recommend that the Department contact the Federal awarding agency to resolve this matter. Corrective Action Plan: See F-16 Management?s Response: The DHHS and DHHS Financial Service Center agree with this finding. To date, considerable effort has been invested in performing grant reconciliations from present back to 2013. Reconciling grants and matching revenues to expenses is labor intensive and takes detailed transaction level analysis. The Department will finalize the reconciliations and take the necessary steps to put the cash balances where they belong. Contact: Sarah Gove, Director, DHHS Service Center, DAFS, 207-458-6626 (State Number: 22-1113-01)

(2022-041) Title: Internal control over CACFP claim reimbursements needs improvement Prior Year Findings: None State Department: Education State Bureau: Child Nutrition Services Federal Agency: U.S. Department of Agriculture Assistance Listing Title: Child and Adult Care Food Program (CACFP) Assistance Listing Number: 10.558 Federal Award Identification Number: 214ME301N1099, 214ME301N1199, 224ME301N1199, 214ME320N1150, 214ME325N2020, 224ME320N1150, 224ME325N2020, 214ME202H1706, 204ME320N1050 Compliance Area: Allowable costs/cost principles Type of Finding: Material weakness Material noncompliance Questioned costs Known Questioned Costs: $11,222 Likely Questioned Costs: Undeterminable. Due to the variety of institution types in the test population and varied meal claim counts, the projection of questioned costs utilizing the error rate related to the known exception and amount tested would not produce a reasonable estimate of likely questioned costs. Criteria: 2 CFR 200.303; 2 CFR 200.403; 7 CFR 226.7, .10, .11, and .16 The Department must establish and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. To be allowable under Federal awards, costs must be necessary and reasonable for the performance of the Federal award and be adequately documented. Each State agency shall establish procedures for institutions to properly submit claims for reimbursement (CFR). Such procedures must include State agency edit checks, including but not limited to ensuring that payments are made only for approved meal types and that the number of meals for which reimbursement is provided does not exceed the product of the total enrollment, operating days, and approved meal types. Prior to submitting its consolidated monthly claim to the State agency, each sponsoring organization must conduct reasonable edit checks on the sponsored centers? meal claims. Condition: The Child and Adult Care Food Program (CACFP) provides nutritious foods that contribute to wellness, healthy growth, and development of eligible children and adults receiving care in day-care centers, day-care homes (DCHs), and at-risk after school snack programs. Each child and adult care center, including day-care homes, must submit a monthly CFR to the State. CFRs by DCHs are first submitted to Sponsoring Organizations (SOs). SOs are responsible for reviewing and consolidating claims into one comprehensive CFR for submission to the State agency. The State reimburses the SOs and centers for actual meals served based on the CFR. The State utilizes the Child Nutrition Program Web (CNPWeb) system to process monthly claims. System edits were relied upon when the claims were submitted; however, edits were not properly implemented during fiscal year 2022. Furthermore, the Department did not obtain enrollment data from DCHs to set maximum claim reimbursement restrictions when processing claims. The Office of the State Auditor (OSA) tested meal counts claimed on 60 CFRs submitted by SOs and found that 14 contained discrepancies. The SOs? CFRs included meals claimed that exceeded the allowable licensed capacity for facilities included in the consolidated CFR. OSA relied on licensed capacity rather than enrollment data when testing claims, as enrollment data was not obtained by the Department. The meals claimed for reimbursement exceeded licensed capacity for 14 facilities. The amount paid over allowable capacity for these facilities totaled $11,222. The Department could not provide documentation to support that the amount paid in excess of capacity was allowable. OSA deemed monthly reimbursements to one SO to be significant to CACFP. To test a sample of claims for this SO, OSA selected all 12 months of the SO?s CFRs and used a risk-based approach for DCH claims and a random approach for all other claims. OSA selected a non-statistical random sample of claims from all other facilities and SOs for the remaining sample. Context: In fiscal year 2022, CACFP expenditures totaled $9.4 million, of which $5.7 million was paid through SOs. Cause: ? Lack of policies and procedures ? Lack of supervisory oversight Effect: ? Known questioned costs ? Potential future questioned costs and disallowances ? Noncompliance with Federal regulations Recommendation: We recommend that the Department implement policies and procedures that require: ? review, approval and testing of system controls to ensure that edit checks are operating as designed; and ? review of monthly CFRs for accuracy. We further recommend that the Department follow up with SOs to identify unallowable costs and recoup costs if warranted. Corrective Action Plan: See F-16 Management?s Response: The Department disagrees with this finding. As explained to OSA by DOE, DHHS, and USDA, Child Care Centers/Providers can enroll and claim over the licensed capacity. The claim edit check that was in place for SY22 for DCH Providers was Total Monthly Attendance x Approved Meal Types due to the fact that providers can enroll over the licensed capacity. Sponsors have been trained: Total Monthly Attendance equals the number of unique kids who attended during the day, are enrolled in CACFP and who ate at least one meal or snack during the day, then add up those daily totals for the month. To use licensed capacity as an edit check, which OSA did to calculate the costs in question, disallows provider reimbursement for eligible meals. CACFP Total Monthly Attendance is a better edit check as it only calculates attendance for enrolled participants. For the provider claims in question the CACFP Team tested them against the Total Monthly Attendance edit check and none suggest an overclaim. The CACFP Team discovered the missing enrollment edit check on 8/24/22 and immediately submitted a ticket to the web designers. This correction required multiple meetings with the web designers and in-depth system testing. The correction to the edit check was completed on 12/23/22. The claim edit checks now in place are: Attendance x Approved Meal Types (same as before) ? AND- Enrollment x Operating Days x Approved Meal Types. Contact: Jane McLucas, Director of Child Nutrition, DOE, 207-624-6880 Auditor?s Concluding Remarks: In accordance with 7 CFR 226.7(k), the Department must establish procedures for facilities to properly submit claims; however, the Department did not have the following procedures in place: ? The Department did not obtain enrollment data to be utilized in the calculation of claims for reimbursement. ? The edit checks that the Department relied upon did not function as intended. The design and implementation of edit checks must ensure that: o payments are only made for approved meal types; and o the number of meals reimbursed does not exceed the total enrollment times the number of operating days times the approved meal types. The Department discovered that the edit checks were not operating as intended on August 24, 2022; however, the Department cannot provide evidence of when the failure occurred as the Department did not test system controls at any time during implementation. Furthermore, the discovery of failed edit checks was identified as a result of an inquiry made by USDA, not by Department controls. OSA also issued finding 2022-033, a material weakness for this system, due to the lack of controls over the system. As stated above and in the Condition of this finding, OSA could not use enrollment data to test the allowability of claims because this data was not obtained by the Department. As an alternative procedure, OSA identified DCHs with CFRs that exceeded licensed capacity and provided this information to the Department for consideration. The Department did not provide documentation to support the allowability of these CFRs, as OSA recognizes Child Care Centers/Providers can enroll and submit CFRs over licensed capacity. In accordance with 2 CFR 200.403, for a cost to be allowable under a Federal award, the costs must be reasonable and necessary for the performance of the Federal award and must be adequately documented. Because the Department did not provide the requested documentation, OSA questions the allowability of these costs. The finding remains as stated. (State Number: 22-1115-01)

(2022-042) Title: Internal control over CACFP subrecipient audit procedures needs improvement Prior Year Findings: None State Department: Education State Bureau: Commissioner?s Office Child Nutrition Services Federal Agency: U.S. Department of Agriculture Assistance Listing Title: Child and Adult Care Food Program (CACFP) Assistance Listing Number: 10.558 Federal Award Identification Number: 214ME301N1099, 214ME301N1199, 224ME301N1199, 214ME320N1150, 214ME325N2020, 224ME320N1150, 224ME325N2020, 214ME202H1706, 204ME320N1050 Compliance Area: Subrecipient monitoring Type of Finding: Material weakness Material noncompliance Questioned Costs: None Criteria: 2 CFR 200.303; 2 CFR 200.332 The Department must establish and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. When a subrecipient?s Federal award expenditures are expected to equal or exceed $750,000 during the fiscal year, the Department must verify that the subrecipient is audited as required. Condition: The Child and Adult Care Food Program (CACFP) provides nutritious foods that contribute to wellness, healthy growth, and development of eligible children and adults receiving care in day-care centers, day-care homes, and at-risk after school snack programs. Child Nutrition Services (CNS) is responsible for monitoring 104 subrecipients that administer these services. Those monitoring procedures include verifying that subrecipients that expend over $750,000 obtain a Single Audit in accordance with Federal regulations. CACFP was previously administered by the State Department of Health and Human Services (DHHS) and subrecipient audits were tracked, received, and reviewed by DHHS? Division of Audit. Prior to fiscal year 2022, the administration of CACFP was moved to the Department of Education (DOE). DOE School Finance and Operations is responsible for the tracking, receipt, and review of subrecipient audits for most programs administered by DOE. CNS asserted that subrecipient audits for private non-profit institutions were received and forwarded to DOE School Finance and Operations for review; however, DOE only stored the audits. Neither CNS nor DOE could provide documentation to support that tracking of subrecipient audit reports was maintained or that reports were received and reviewed. As a result, 19 private non-profit subrecipients that reported receiving over $750,000 in Federal funds and required audits were not reviewed. Context: In fiscal year 2022, $9.3 million in CACFP funds was provided to 104 subrecipients, 51 of which are private non-profit subrecipients and 19 were required to have an audit. Cause: ? Lack of policies and procedures. CNS and DOE School Finance and Operations have not defined roles and responsibilities for tracking, receiving, and reviewing subrecipient audit reports. ? Lack of supervisory oversight Effect: ? Noncompliance with Federal regulations ? Subrecipients may not be complying with Federal statutes, regulations, or the terms and conditions of the subaward. Recommendation: We recommend that CNS and DOE School Finance and Operations collaborate on implementing policies and procedures that define the roles and responsibilities for tracking, receipt, and review of subrecipient audits. Corrective Action Plan: See F-17 Management?s Response: The Department agrees with this finding. Child Nutrition will implement policies and procedures for the tracking, receipt, and review of audits for subrecipients that expend over $750,000, in accordance with Federal regulations. Contact: Jane McLucas, Director of Child Nutrition, DOE, 207-624-6880 (State Number: 22-1115-04)

(2022-043) Title: Internal control over CACFP eligibility needs improvement Prior Year Findings: None State Department: Education State Bureau: Child Nutrition Services Federal Agency: U.S. Department of Agriculture Assistance Listing Title: Child and Adult Care Food Program (CACFP) Assistance Listing Number: 10.558 Federal Award Identification Number: 214ME301N1099, 214ME301N1199, 224ME301N1199, 214ME320N1150, 214ME325N2020, 224ME320N1150, 224ME325N2020, 214ME202H1706, 204ME320N1050 Compliance Area: Allowable costs/cost principles Eligibility Type of Finding: Significant deficiency Questioned costs Known Questioned Costs: $50,275 Likely Questioned Costs: Undeterminable. Likely questioned costs cannot be determined as the projection of questioned costs utilizing the error rate is not tested by dollar amount, but instead is based on eligibility. Criteria: 2 CFR 200.303; 7 CFR 226.2 and .6 The Department must establish and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. The State agency must establish application review procedures to determine eligibility of new and renewing institutions, and facilities for which applications are submitted by sponsoring organizations. Required enrollment information includes the number of enrolled participants that are eligible for free, reduced or paid meals. A for-profit center must have more than 25 percent of the children in care eligible for free or reduced price meals. Documentation that each for-profit center application meets the 25 percent definition is required. A pre-approval visit by the State agency to confirm the information in the institution?s application is required for all new applications. Condition: The Child and Adult Care Food Program (CACFP) provides nutritious foods that contribute to wellness, healthy growth, and development of eligible children and adults receiving care in day-care centers, day-care homes, and at-risk after school snack programs. Annually, these facilities must submit electronic applications and site information, including current enrollment data, for each location. The Department is required to review the application and determine whether the application should be approved or rejected. Before an application for a new facility is approved, the Department must complete a pre-approval site visit to verify that the information provided by the facility is complete and accurate. The Department has established procedures which require the use of a site visit checklist to ensure that all components of approval are reviewed. One requirement for approval included on the checklist is verification of enrollment data. Claims should not be processed or paid until the entire approval process, including the site visit, has been completed. The Office of the State Auditor (OSA) tested a sample of facilities determined eligible for CACFP and found one approved facility that should have been deemed ineligible. The facility reported a percentage of children eligible for free or reduced-price meals that did not meet the minimum 25 percent requirement for eligibility. Furthermore, the Department could not provide documentation to demonstrate that a pre-approval site visit was completed. The Department processed $50,275 in claims to this facility. OSA selected a non-statistical random sample. Context: In fiscal year 2022, CACFP expenditures totaled $9.4 million, of which $9.3 million was paid to facilities. Cause: ? Lack of supervisory oversight ? Lack of adequate policies and procedures Effect: ? Known questioned costs ? Potential future questioned costs and disallowances ? Noncompliance with Federal regulations Recommendation: We recommend that the Department implement policies and procedures that require: ? retention of documentation used to support facility applications including pre-approval site visit information and checklists, and ? review and approval of eligibility requirements for both new and annual renewal applications. This will ensure that all applications are accurate and complete and that funds are only provided to eligible facilities. Corrective Action Plan: See F-17 Management?s Response: The Department partially agrees with this finding. The Department has put additional procedures in place for the review and approval of eligibility requirements. The documentation to support facility applications was retained but was misplaced at the time of the audit. Contact: Jane McLucas, Director of Child Nutrition, DOE, 207-624-6880 Auditor?s Concluding Remarks: Federal regulations state that for costs to be allowable under Federal awards, the costs must be adequately documented. The Department was unable to provide documentation to support information on the application. Therefore, the facility is ineligible and OSA questions the allowability of payments to the facility. The finding remains as stated. (State Number: 22-1115-02)

(2022-044) Title: Internal control over CACFP subrecipient risk evaluation procedures needs improvement Prior Year Findings: None State Department: Education State Bureau: Child Nutrition Services Federal Agency: U.S. Department of Agriculture Assistance Listing Title: Child and Adult Care Food Program (CACFP) Assistance Listing Number: 10.558 Federal Award Identification Number: 214ME301N1099, 214ME301N1199, 224ME301N1199, 214ME320N1150, 214ME325N2020, 224ME320N1150, 224ME325N2020, 214ME202H1706, 204ME320N1050 Compliance Area: Subrecipient monitoring Type of Finding: Significant deficiency Questioned Costs: None Criteria: 2 CFR 200.303; 2 CFR 200.332 The Department must establish and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. The Department is required to evaluate each subrecipient?s risk of noncompliance with Federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate subrecipient monitoring procedures. Condition: The Child and Adult Care Food Program (CACFP) provides nutritious foods that contribute to wellness, healthy growth, and development of eligible children and adults receiving care in day-care centers, day-care homes, and at-risk after school snack programs. The Department is responsible for monitoring 104 subrecipients that administer these services. The level of monitoring required by Federal regulations must be determined using a risk-based approach. Subrecipient risk evaluation should include considerations of: ? the subrecipient?s experience with the program, ? the results of subrecipient audits, ? changes in personnel or systems, and ? the extent of Federal awarding agency monitoring procedures. CACFP regulations require the Department to monitor 33.3 percent of total active facilities in each review cycle (annually). In addition, all facilities must be monitored at least once every three years and Sponsoring Organizations (SOs) with 100 or more facilities must be monitored once every two years. SOs provide administration and support for smaller facilities. Department subrecipient monitoring procedures are based on CACFP regulations and do not use the risk-based approach as required by Federal regulations. Context: In fiscal year 2022, CACFP expenditures totaled $9.4 million, of which $9.3 million was provided to 104 subrecipients. Cause: Lack of adequate policies and procedures Effect: ? Noncompliance with Federal regulations ? Subrecipients that are deemed higher risk may not be monitored on a more frequent basis. Conversely, subrecipients that are deemed lower risk may not be monitored on a less frequent basis, which would free resources and time to dedicate towards other higher risk subrecipients. Recommendation: We recommend that the Department review and update policies and procedures to incorporate Federal regulations along with program regulations. The risk evaluation process should be documented and retained. Corrective Action Plan: See F-17 Management?s Response: The Department agrees with this finding. The CACFP team will create a risk assessment tool to use in scheduling subrecipient reviews. Contact: Jane McLucas, Director of Child Nutrition, DOE, 207-624-6880 (State Number: 22-1115-03)

(2022-045) Confidential finding, see below for more information Title: Internal control over UI claim payments needs improvement Prior Year Findings: See Schedule of Findings and Questioned Costs for chart/table State Department: Labor State Bureau: Unemployment Compensation Federal Agency: U.S. Department of Labor Assistance Listing Title: Unemployment Insurance (UI) (COVID-19) Assistance Listing Number: 17.225 Federal Award Identification Number: Unemployment Insurance Trust Fund, Maine, UI347192055A23, UI372842255A23, UI359482160A23, UI372272255A23, UI356522155A23, UI348602055A23, UI340622055A23 Compliance Area: Allowable costs/cost principles Eligibility Type of Finding: Material weakness Material noncompliance Questioned costs Known Questioned Costs: $19,278 Likely Questioned Costs: Likely questioned costs totaling $2.7 million were projected within each entitlement program by dividing the identified ineligible benefit payments in our sample by the total benefit payments tested to establish an error rate, then applying that error rate to each entitlement program?s benefit payment totals for fiscal year 2022. Criteria: 2 CFR 200.303; 2 CFR 200.403; 20 CFR 615.8; Middle Class Tax Relief and Job Creation Act of 2012; Social Security Act (SSA) Title III, Section 303; Unemployment Insurance Program Letter (UIPL) No. 5-13; Coronavirus Aid, Relief, and Economic Security (CARES) Act; 26 MRSA 1190 through 1199; Consolidated Appropriations Act, 2021; American Rescue Plan Act of 2021 The Department must establish and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. To be allowable under Federal awards, costs must be necessary and reasonable for the performance of the Federal award and be adequately documented. A State administering UI must have State laws and policies in place that are consistent with Federal provisions and required by 20 CFR 615.8; the Middle Class Tax Relief and Job Creation Act of 2012; SSA Title III, Section 303; and UIPL No. 5-13, as follows: ? Standards for claim filing and processing including appeals and reviews, communication with claimants and employers, eligibility standards and disqualifications, and Interstate Benefit Payments and agreements ? Standards for reasonable work search criteria and policies requiring performance of internal audits of work search activity ? Standards for program integrity outlining procedures for identification and recovery of overpayments and penalties, including recovery through offset of future benefit payments The State of Maine?s statutory requirements for UI program benefits are outlined in 26 MRSA 1190 through 1199. In March 2020, as a nationwide response to the effects of the COVID-19 pandemic, including rapidly increasing unemployment rates, the Federal Coronavirus Aid, Relief, and Economic Security (CARES) Act was signed into law. The CARES Act created three temporary Federal unemployment compensation entitlement programs that continued in fiscal year 2022, as follows: ? Pandemic Unemployment Assistance (PUA) provides UI benefits for individuals who are not eligible for regular UI benefits and are unemployed, partially unemployed, or unable or unavailable to work due to COVID-19. Covered individuals include the self-employed, independent contractors, part-time workers, and others not normally eligible to receive regular UI benefits. ? Pandemic Emergency Unemployment Compensation (PEUC) provides an additional 13 weeks of UI benefits for unemployed workers who have exhausted regular UI benefits. This was extended to 24 weeks through enactment of the Consolidated Appropriations Act signed into law at the end of December 2020. ? Federal Pandemic Unemployment Compensation (FPUC) initially provided an additional $600 weekly to all unemployed workers receiving traditional UI benefits, PUA, or PEUC. This was changed to $300 weekly in December 2020 through enactment of the Consolidated Appropriations Act. The Federal American Rescue Plan Act signed into law in March 2021 granted additional extensions of the PUA, PEUC, and FPUC programs through September 2021. Condition: Pursuant to paragraph 6.63 of the U.S. Government Accountability Office?s Government Auditing Standards (also known as the Yellow Book), we omitted details from this finding as they are confidential under the provisions of 5 MRSA 244-C (3). Though the content of this finding has been redacted, we provided the Department(s) with detailed information regarding the specific condition we identified, as well as the related criteria, context, causes, effects, and our specific recommendations for improvement. Department Controls: The Department has complementary controls in place over claimant eligibility, including: ? internal work search audits performed by MDOL personnel required for one percent of weekly claims, and ? establishment of a Benefits Quality Control Unit tasked with investigating a prescribed number of UI paid claims and denied claims each week. Audit Testing Results: As part of the initial eligibility determination process, State UI law requires MDOL to confirm claimant separation from employment through correspondence with a claimant?s most recent employer. OSA?s test of 60 regular UI claimants? initial eligibility identified one claimant where a separation letter was not sent to the most recent employer as required. As part of the continuing eligibility determination process, State UI law requires a weekly claim to be filed and work search activities to be reported. In OSA?s test of 60 regular UI claimants? continuing eligibility, the following exceptions were noted: ? Three claimants reported the same work search activity for multiple claims ranging from three to eighteen weeks without the existence of further verifiable details. Controls were not in place to require additional work search verification procedures prior to continued benefit payments. OSA did not report the underlying benefits paid as questioned costs. ? One claimant did not report work search activities for a period of three weeks. OSA reported benefits totaling $1,476 paid to the claimant during this time as known questioned costs. As part of the PUA eligibility determination process, Federal program regulations require that claimants provide proof of employment information. In OSA?s test of 60 PUA claimants, nine claimants were deemed ineligible to receive benefits by MDOL. These claimants were required to provide proof of employment within 90 days of notification from MDOL. MDOL did not notify two of the claimants until May 2021, six of the claimants until July 2021, and one of the claimants until February 2022. As a result, claimants who did not provide proof of employment received benefits in fiscal year 2021 and fiscal year 2022. Benefits paid to these ineligible claimants totaled $14,832 in fiscal year 2022; OSA reported this amount as known questioned costs. As part of the PEUC eligibility determination process, Federal program regulations require the claimant to have exhausted regular UI benefits. In OSA?s test of 60 PEUC claimants, one claimant received benefits before the exhaustion of regular UI benefits. Regular UI benefits were exhausted prior to fiscal year 2022 and all ineligible PEUC benefit payments occurred in the prior year; therefore, OSA did not report questioned costs for fiscal year 2022. OSA selected non-statistical random samples. Data Analytics: Additional audit procedures included obtaining information from Maine Vital Records and performing cross-matches with benefit payment data from ReEmployME. These procedures identified that: ? based on an analysis of claimant dates of death, five claimants received UI benefit payments from various entitlement programs after their dates of death. These benefit payments totaled $2,970 through the end of fiscal year 2022. OSA reported this amount as known questioned costs. ? based on an analysis of claimant dates of birth, the following claimants received UI benefits during fiscal year 2022: ? 2 claimants under the age of 10. State UI law does not restrict benefit payments based on age. Employment and wage documentation required for eligibility were provided by both claimants so MDOL did not deem the claimants ineligible; however, the system did not identify the claimants for further review prior to benefit issuance. OSA did not report questioned costs for these claimants. ? 290 claimants over the age of 80, including: o 275 claimants between the ages of 80 and 89; and o 15 claimants between the ages of 90 and 99. MDOL does not have adequate procedures in place to identify and review claimant dates of death as well as the reasonableness of claimant age prior to the issuance of benefit payments. Context: The UI program provided $98.5 million in State UI benefits and $163.3 million in Federal UI benefits during fiscal year 2022. Cause: ? Lack of resources ? Lack of adequate controls over initial and continuing claimant eligibility determinations ? Lack of adequate supervisory oversight over information system application controls ? Lack of adequate policies and procedures to identify and review claimant dates of death prior to the issuance of benefit payments Effect: ? Noncompliance with Federal regulations ? Known questioned costs ? Potential future questioned costs and disallowances ? Potential liability, and applicable interest, due to the Federal government for claims paid to ineligible or fraudulent Federal UI benefit claimants Recommendation: We recommend that the Department enhance policies and procedures to require: ? that eligibility requirements are met and adequately supported prior to issuance of benefit payments. ? implementation of additional information system application controls. ? incorporation of data analytics and data cross-matching procedures to prevent or detect payments to ineligible claimants. This will provide assurance that payments to ineligible claimants are prevented, or detected and corrected, in a timely manner. Corrective Action Plan: See F-17 Management?s Response: The Department partially agrees with this finding. The finding states that the Department?s system does not ensure that benefit payments to ineligible claimants are prevented or detected prior to the issuance of payments. The Department collects the necessary information to determine initial and ongoing eligibility. It is important to note that both federal and state law prohibit the withholding of payment from someone who is already receiving benefits when a potential eligibility issue is identified. The Department must gather additional information and issue a written determination, which also includes notification of the right to appeal the determination. In the meantime, payments must be made. If the Department issues a determination that the individual was ineligible, an overpayment is created, and repayment is required. The finding states that the Department has insufficient controls in place to detect claimants using the same work search activities for multiple claims. The work search activity provided by the three claimants in question was participation in a CareerCenter-led job fair, or other accepted work search activity, on multiple claims. The Department agrees with the recommendation of additional controls in this area and expects to implement additional controls before the end of SFY 23. The finding furthermore states that one claimant filed claims without a work search for three consecutive weeks. A review of the claim determined the claimant appropriately received a documented work search warning for the first week, but no decision was rendered on the two subsequent weeks due to a staff training error. The Department agrees with these testing results of the finding. The finding furthermore states that the Department erred in paying benefits to individuals collecting on the Pandemic Unemployment Assistance (PUA) program. The Continued Assistance Act (CAA), released in December 2020, added a new requirement to the PUA program. To continue to receive PUA benefits, claimants were required to provide documentation substantiating employment or self-employment, or the planned commencement of employment or self-employment within 21 or 90 days (depending on the date of initial PUA filing) from the date of the guidance, or when first noticed by the Department. This last part serves as USDOL?s acknowledgement that it would take time to implement the changes into existing functionality and systems. In Maine, the first notices went out on May 6, 2021. Two of the claimants listed received their notice on this day, with one receiving their denial decision on day 90, and one on day 93, preventing further benefits. The Department agrees with the testing results in the latter case. Five claimants received their notice on July 7, 2021, and a denial 90 days later, properly preventing further benefits. The Department disagrees with the testing results of the finding for the claimants cited in July. The remaining two cases cited were claimants who filed a PUA initial claim, and PUA weekly claims in 2020, prior to the release of the CAA. However, payments for these weeks were not processed until 2021 and 2022. At that time, notices to provide proof of employment were sent, followed by a denial decision for failure to respond/provide adequate proof. However, no overpayment was created because the week ending dates of the weeks paid all pre-dated the implementation of the CAA and therefore were not subject to overpayment. The Department disagrees with these testing results of the finding. The finding also states the Department needs additional controls for claims filed after a claimant?s date of death, as well as the claimant?s age when filing a claim for benefits. Though the Department has made significant enhancements to the Vital Statistic crossmatch process, it agrees that the current crossmatch with the state?s Vital Records office that identifies deceased claimants should be reviewed further. That said, there are timing differences that cannot be avoided, and overpayments cannot be completely ruled out. Overpayments, penalties, and prosecutions are all considered when it is determined someone falsely filed for benefits using a deceased person?s information. Regarding the age of the individual filing for benefits, additional controls were implemented during SFY 23, with additional controls still under review for further enhancement and implementation. Contact: Laura Boyett, Director, Bureau of Unemployment Compensation, DOL, 207-621-5156 Auditor?s Concluding Remarks: Management?s Response states that the Department collects necessary information to determine initial and continuing claimant eligibility prior to benefit issuance; however, exceptions included in the finding were the result of a failure to solicit or collect required documentation in support of eligibility for claimants prior to the issuance of benefit payments. For PUA eligibility, OSA acknowledges that the December 2020 implementation of the requirement for PUA claimants to provide proof of employment did place a significant burden on MDOL to develop related controls timely and that guidance from U.S. DOL stated that benefit payments should not be held while awaiting documentation; however, MDOL did not implement necessary controls to address this Federal requirement until several months later. As a result, procedures were not in place to prevent payments to ineligible claimants from December 2020 to May 2021, and claimants that should have been deemed ineligible subsequent to December 2020 continued to receive benefits into fiscal year 2022. OSA acknowledges that timing differences for weekly claim filings and claimant dates of death cannot be entirely prevented; however, the exceptions included in the finding concern the timeliness and frequency of data cross-matching procedures, and the initiation of appropriate follow up action in order to prevent overpayments. The finding remains as stated. (State Number: 22-1302-01)

(2022-046) Title: Internal control over monitoring of employee classification and compensation needs improvement Prior Year Findings: None State Department: Administrative and Financial Services State Bureau: Human Resources Federal Agency: U.S. Department of Labor U.S. Department of Health and Human Services U.S. Department of Defense Assistance Listing Title: Unemployment Insurance (UI) (COVID-19) Immunization Cooperative Agreements (COVID-19) Child Support Enforcement National Guard Military Operations and Maintenance (O&M) Projects Assistance Listing Number: 17.225; 93.268; 93.563; 12.401 Federal Award Identification Number: Unemployment Insurance Trust Fund, Maine, UI347192055A23, UI372842255A23, UI359482160A23, UI372272255A23, UI356522155A23, UI348602055A23, UI340622055A23; NH23IP922604; 2001MECSES, 2101MECSES, 2201MECSES; W912JD-19-2-1001, W912JD-19-2-1005, W912JD-20-2-1001, W912JD-20-2-1002, W912JD-20-2-1003, W912JD-20-2-1007, W912JD-20-2-1010, W912JD-21-2-1001, W912JD-21-2-1002, W912JD-21-2-1003, W912JD-21-2-1004, W912JD-21-2-1007, W912JD-21-2-1010, W912JD-21-2-1021, W912JD-21-2-1022, W912JD-21-2-1023, W912JD-21-2-1024, W912JD-21-2-1040, W912JD-22-2-1001, W912JD-22-2-1002, W912JD-22-2-1003, W912JD-22-2-1004, W912JD-22-2-1007, W912JD-22-2-1010, W912JD-22-2-1021, W912JD-22-2-1022, W912JD-22-2-1023, W912JD-22-2-1024, W912JD-22-2-1040, W912JD-22-2-2010 Compliance Area: Allowable costs/cost principles Type of Finding: Significant deficiency Questioned Costs: None Criteria: 2 CFR 200.303; 2 CFR 200.430 The Department must establish and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. Costs of compensation are allowable to the extent that personal services are rendered during the period of performance under the Federal award, total compensation is reasonable for the services rendered and conforms to the established written policy of the non-Federal entity, and follows an appointment made in accordance with a non-Federal entity?s laws and/or rules or written policies. Condition: The Bureau of Human Resources (BHR) employs Functional Job Analysis (FJA) reports to summarize each State employee?s position duties and responsibilities, and to assign the position to a classification and salary grade representing reasonable compensation for services rendered by the position. The assigned salary grade provides a basis for the allowability of compensation costs charged to Federal grant awards by documenting the reasonableness of compensation for services rendered by State employees, and that the position appointment was made and maintained in accordance with State statute. BHR maintains the position classification specifications and related compensation plan of State employees. Periodic review of position classifications, including required duties and responsibilities, are completed by individual agency personnel through the following processes: ? Annual performance reviews as required by the Performance Management System and related forms which include detail of position duties and responsibilities ? Hiring justification forms completed by agency heads to attest to the duties and responsibilities of positions being filled ? Review and approval of job vacancy announcements prior to advertisement which reflect the duties and responsibilities of the position?s FJA on file These processes have been established to ensure that documented duties and responsibilities of all State employee positions are accurate and up to date. These processes are the responsibility of individual agencies; however, BHR is responsible for the oversight to ensure that agencies are completing the established processes accurately and timely. BHR does not have policies and procedures that require a documented level of oversight or monitoring of agency-level activities. Context: During fiscal year 2022, $122 million of payroll expenditures were charged to Federal grants. This represents approximately 10 percent of fiscal year 2022 Statewide payroll expenditures, which totaled $1.2 billion. Cause: ? Competing priorities ? Lack of resources ? Lack of adequate policies and procedures Effect: ? State employee job classification and compensation may not accurately reflect current duties and responsibilities of each position. As a result, payroll costs charged to Federal awards may not be supported. ? Without documented evidence that these activities are occurring, BHR cannot ensure that the classification and compensation plan of all State employee positions is maintained and properly supported by documentation that accurately reflects the job duties and responsibilities of each position. Recommendation: We recommend that the Department implement additional policies and procedures to ensure proper oversight and monitoring of agency-level activities related to position duties and responsibilities and maintenance of the State classification and compensation plan. Corrective Action Plan: See F-18 Management?s Response: The Department partially agrees with this finding. In addition to the three bullets noting how BHR conducts reviews of position classifications, BHR also conducts the following: ? management submits a management-initiated FJA when a position's duties are being significantly changed, and that FJA is audited by BHR to determine the correct classification; ? an employee may submit an employee-initiated FJA if they believe they are working out of classification, and the FJA will be audited by BHR for determination of the correct classification; and ? classification specifications are reviewed periodically by BHR to determine accuracy and make any changes (this includes when BHR reviews a classification for recruitment and retention purposes). Contact: Breena D. Bissell, Director, Bureau of Human Resources, DAFS, 207-215-0886 Auditor?s Concluding Remarks: The Office of the State Auditor recognizes the additional processes conducted by BHR noted in Management?s Response; however, the existing policies and procedures do not ensure proper oversight and monitoring of agency-level activities related to position duties and responsibilities and maintenance of the State classification and compensation plan. The finding remains as stated. (State Number: 22-0111-01)

(2022-047) Confidential finding, see below for more information Title: over needs improvement Pursuant to paragraph 6.63 of the U.S. Government Accountability Office?s Government Auditing Standards (also known as the Yellow Book), we omitted details from this finding as they are confidential under the provisions of 5 MRSA 244-C (3). Though the content of this finding has been redacted, we provided the Department(s) with detailed information regarding the specific condition we identified, as well as the related criteria, context, causes, effects, and our specific recommendations for improvement. Prior Year Findings: See Schedule of Findings and Questioned Costs for chart/table Type of Finding: Significant deficiency Corrective Action Plan: See F-18 Contact: Shirley Browne, Deputy State Controller, Office of the State Controller, 207-626-8423 (State Number: 22-0902-02)

(2022-048) Title: Internal control over ERA Program special reporting needs improvement Prior Year Findings: See Schedule of Findings and Questioned Costs for chart/table State Department: Economic and Community Development State Bureau: Commissioner?s Office Federal Agency: U.S. Department of the Treasury Assistance Listing Title: Emergency Rental Assistance Program (COVID-19) Assistance Listing Number: 21.023 Federal Award Identification Number: ERA0299, ERA0434, ERAE0515, ERAE0563 Compliance Area: Reporting Type of Finding: Material weakness Material noncompliance Questioned Costs: None Criteria: 2 CFR 200.303; 2 CFR 170 The Department must establish and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. Agencies must report each subaward that equals or exceeds the first-tier subaward threshold of $30,000 in Federal funds in the public-facing Federal Funding Accountability and Transparency Act (FFATA) Subaward Reporting System. Condition: When an amount exceeding the first-tier subaward threshold is awarded to a subrecipient, the Department must collect and enter data into the FFATA Subaward Reporting System. The Department did not report its first-tier subaward under the Emergency Rental Assistance (ERA) Program in the FFATA reporting system for fiscal year 2022. Context: In fiscal year 2022, the Department was required to report a first-tier subaward totaling $152 million to the only subrecipient of the ERA Program. First-tier subawards account for 100 percent of the program?s fiscal year 2022 expenditures. Cause: ? Lack of supervisory oversight ? Lack of adequate policies and procedures Effect: ? Noncompliance with Federal regulations ? First-tier subaward information for the ERA Program was not reported to the Federal government. This information may be used for programmatic, policy, or statistical purposes. Recommendation: We recommend that the Department implement additional policies and procedures, including increased supervisory oversight, to ensure subawards meeting or exceeding the first-tier threshold are reported accurately, timely, and in accordance with Federal regulations. Corrective Action Plan: See F-19 Management?s Response: The Department agrees with this finding. Due to the evolving reporting requirements for the Emergency Rental Assistance program, the Department did not originally identify the FFATA requirements as applicable and did not submit accordingly. Currently, the existing policies and procedures have been modified to ensure that from this point forward, FFATA reporting is completed for all subawards that meet or exceed the first-tier threshold. Contact: Deborah Johnson, Director, Office of Community Development, DECD, 207-624-9817 (State Number: 22-1695-01)

(2022-049) Title: Internal control over ERA Program subrecipient monitoring needs improvement Prior Year Findings: None State Department: Economic and Community Development State Bureau: Commissioner?s Office Federal Agency: U.S. Department of the Treasury Assistance Listing Title: Emergency Rental Assistance Program (COVID-19) Assistance Listing Number: 21.023 Federal Award Identification Number: ERA0299, ERA0434, ERAE0515, ERAE0563 Compliance Area: Subrecipient monitoring Type of Finding: Material weakness Material noncompliance Questioned Costs: None Criteria: 2 CFR 200.303; 2 CFR 200.332 The Department must establish and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. The Department must monitor the activities of the subrecipient as necessary to ensure that subawards are used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward, and that subaward performance goals are achieved. When a subrecipient?s Federal award expenditures are expected to equal or exceed $750,000 during the fiscal year, the Department must verify that the subrecipient is audited as required. Condition: In fiscal year 2022, the Department passed through Emergency Rental Assistance (ERA) Program funds to one subrecipient. Subrecipient monitoring procedures included providing Federal award information in grant award agreements and frequent communication with the subrecipient; however, the Department: ? did not adequately design and document ongoing monitoring activities to ensure that the subaward was used for authorized purposes and in compliance with Federal regulations. ? could not provide a documented review of the subrecipient?s audit report to verify compliance with Subpart F of 2 CFR 200 and to ensure that the subrecipient took timely and appropriate action on all deficiencies pertaining to the Department?s subaward. The Office of the State Auditor reviewed the subrecipient?s audit report covering a portion of fiscal year 2022 and noted findings related to the subaward that should have been considered in relation to the risk of subrecipient noncompliance and planned monitoring procedures. ? did not require submission of detailed expenditure information with the subrecipient?s requests for reimbursement of ERA Program funds. A summary spreadsheet outlining actual and projected expenditures for second-tier subrecipients was the only support provided to the Department with each reimbursement request. Context: The Department provided $245.8 million to the ERA subrecipient during fiscal year 2022. Cause: ? Lack of supervisory oversight ? Lack of adequate policies and procedures Effect: ? Noncompliance with Federal regulations ? Lack of ongoing subrecipient monitoring procedures could result in subrecipient noncompliance. Recommendation: We recommend that the Department develop and implement additional policies and procedures to require: ? ongoing subrecipient monitoring during the use of the subaward; ? receipt and documented review of subrecipient audits in order to consider the effects of audit results on subrecipient risk assessment and planned monitoring procedures; and ? receipt of detailed documentation in support of subrecipient reimbursement requests prior to payment approval. Corrective Action Plan: See F-19 Management?s Response: The Department agrees with this finding. Due to the Emergency Rental Assistance Program coming to a close, the Department plans on utilizing a consultant to assist with close out procedures that will ensure these subrecipient funds were used for authorized purposes and in compliance with Federal regulations. Additionally, the Department will ensure that the review of subrecipient audit reports are sufficiently documented. Contact: Deborah Johnson, Director, Office of Community Development, DECD, 207-624-9817 (State Number: 22-1695-02)

(2022-050) Title: Internal control over ERA Program reporting needs improvement Prior Year Findings: None State Department: Economic and Community Development State Bureau: Commissioner?s Office Federal Agency: U.S. Department of the Treasury Assistance Listing Title: Emergency Rental Assistance Program (COVID-19) Assistance Listing Number: 21.023 Federal Award Identification Number: ERA0299, ERA0434, ERAE0515, ERAE0563 Compliance Area: Reporting Type of Finding: Material weakness Material noncompliance Questioned Costs: None Criteria: 2 CFR 200.303; Consolidated Appropriations Act, 2021, Section 501(g) The Department must establish and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. The Department must report the total number of participating households receiving Emergency Rental Assistance (ERA) of any kind and the total amount of ERA funds expended by the ERA grantee to or for participating households on behalf of eligible households on a monthly basis. Additionally, the Department must submit quarterly reports providing financial and performance data regarding grantee administration of their ERA projects and capture program design in addition to program status data elements. Condition: The Department contracts with a subrecipient to administer the ERA Program. A Memorandum of Understanding (MOU) between the Department and the subrecipient outlines the following: ? The subrecipient is responsible for preparation of all required reporting under the ERA Program. ? The Department is responsible for certification and submission of all reports prepared by the subrecipient. The Office of the State Auditor (OSA) reviewed ERA Program reporting and found that the subrecipient prepared, certified, and submitted 24 monthly and 9 quarterly performance reports during fiscal year 2022. The Department did not review, approve, or certify any of the fiscal year 2022 reports prior to submission to the Federal government. The reports were only provided to the Department subsequent to submission. The Department provided OSA with all monthly and quarterly reports for the fiscal year; however, the Department was unable to provide: ? documentation to support amounts reported on the State?s fiscal year 2022 ERA Program performance reports. ? documentation of review and approval of performance reports prepared by the subrecipient, as they were prepared, certified, and submitted with no oversight by the Department. The Department has no assurance that the ERA Program information prepared by the subrecipient and submitted to the Federal government on behalf of the State is accurate or properly supported. Context: In fiscal year 2022, the Department provided $245.8 million to the ERA subrecipient. Cause: ? Lack of supervisory oversight ? Lack of adequate policies and procedures Effect: The Department did not properly oversee the ERA Program as required by Federal regulations. ERA Program reports submitted to the Federal government are not properly supported and may not be accurate as documentation is not reviewed or maintained by the Department. Recommendation: We recommend that the Department implement additional policies and procedures to require a documented review and approval of all ERA Program reports prepared by the subrecipient prior to Department certification and submission. This will ensure that information reported to the Federal government is accurate and complete. Corrective Action Plan: See F-19 Management?s Response: The Department agrees with this finding. The Department will document the review and approval of all ERA program reports prepared by the subrecipient prior to Department certification and submission. Contact: Deborah Johnson, Director, Office of Community Development, DECD, 207-624-9817 (State Number: 22-1695-03)

(2022-051) Title: Internal control over CSLFRF expenditures needs improvement Prior Year Findings: None State Department: Labor Administrative and Financial Services State Bureau: Unemployment Compensation Commissioner?s Office Office of the State Controller Federal Agency: U.S. Department of the Treasury Assistance Listing Title: Coronavirus State and Local Fiscal Recovery Funds (COVID-19) Assistance Listing Number: 21.027 Federal Award Identification Number: SLFRP0144 Compliance Area: Activities allowed or unallowed Allowable costs/cost principles Type of Finding: Material weakness Material noncompliance Questioned costs Known Questioned Costs: $51,482,644 Likely Questioned Costs: $51,482,644 Criteria: 2 CFR 200.303; 2 CFR 200.403; 2 CFR 200.302; Coronavirus State and Local Fiscal Recovery Fund (CSLFRF) Interim Final Rule, Federal Register Volume 86, Issue 93 (May 17, 2021) The Department must establish and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. Costs must be adequately documented. The State?s financial management systems, including records documenting compliance with Federal statutes, regulations, and the terms and conditions of the Federal award, must be sufficient to determine that such funds have been used in accordance with Federal statutes, regulations, and the terms and conditions of the Federal award. The CSLFRF Interim Final Rule states that recipients may make deposits into the State account of the Unemployment Trust Fund up to the level needed to restore the pre-pandemic balances of such account as of January 27, 2020, or to pay back advances received for the payment of benefits between January 27, 2020, and May 17, 2021, given the close nexus between Unemployment Trust Fund costs, solvency of Unemployment Trust Fund systems, and pandemic economic impacts. Condition: As part of the American Rescue Plan Act, the State was advanced $997 million in Federal CSLFRF to support its response to and recovery from the COVID-19 public health emergency. In response, Public Law 2021, Chapter 483, Section D-1 was enacted and states that ?notwithstanding any provision of law to the contrary, the State Controller shall transfer $80 million from the Federal Expenditures Fund ? ARP State Fiscal Recovery balance to the Department of Labor, Unemployment Compensation Fund no later than November 30, 2021.? To support the allowability of the $80 million transfer under the Public Health and Economic Impacts use category, the Maine Department of Labor (MDOL) prepared an analysis that compared the balance between January 25, 2020 ($502,137,397) and September 30, 2021 ($405,167,938). Under this use category, transfers to the Unemployment Trust Fund are only allowable up to the level needed to restore the Trust Fund to the pre-pandemic balance as of January 27, 2020. The Department of Administrative and Financial Services (DAFS) reviewed and approved the calculation for reasonableness and allowability. As a result, DAFS transferred $80 million from the Federal Fund to the State Unemployment Trust Fund on November 30, 2021. Using the State?s Trust Fund Balance Reports, the Office of the State Auditor (OSA) compared the January 27, 2020, balance ($499,966,386) to the September 30, 2021, balance ($471,449,030). The $28,517,356 difference represents the amount allowed to restore the State Unemployment Trust Fund to the pre-pandemic balance as of January 27, 2020, under the Public Health and Economic Impacts use category. MDOL and DAFS were unable to provide: ? documentation supporting the $405.2 million balance on September 30, 2021, used to substantiate allowability of the $80 million transfer, and ? a justification of why the Trust Fund Balance Reports were not used in the calculation. Therefore, the $80 million transfer exceeds the amount needed to restore the State Unemployment Trust Fund to the pre-pandemic balance by $51,482,644 under the Public Health and Economic Impacts use category. Context: The $80 million transfer to the State?s Unemployment Trust Fund represents approximately 66 percent of the $121.5 million in CSLFRF expenditures during fiscal year 2022. Cause: Misinterpretation of Federal guidance Effect: ? Noncompliance with Federal regulations ? Known questioned costs and potential disallowances Recommendation: We recommend that MDOL and DAFS review expenditures charged to CSLFRF, including the above-noted expenditure, to ensure that costs are adequately documented to support that only allowable costs are funded by CSLFRF. Corrective Action Plan: See F-19 Management?s Response: We disagree with this finding. Likewise, we are unable to determine why the auditor has identified a questioned cost or includes a recommendation that only allowable costs are funded by CSLFRF. The transfer of $80 million to the Unemployment Trust Fund is completely allowable, with a portion categorized under the Public Health and Economic Impacts use category and a portion under the Revenue Loss - Provision of Government Services use category. Questioned costs are defined by the Uniform Guidance, 2CFR ? 200.1, Questioned cost means a cost that is questioned by the auditor because of an audit finding: (1) Which resulted from a violation or possible violation of a statute, regulation, or the terms and conditions of a Federal award, including for funds used to match Federal funds; In this case, there was no violation of statute, regulation or terms of the federal award for the SLFRF program (ALN 21.027). Regardless of category, the transfer of $80M to the UI Trust is considered an allowable cost under the program; thus, there is no portion of the transfer that is considered unallowable and no basis for a questioned cost. (2) Where the costs, at the time of the audit, are not supported by adequate documentation; or All parties agree that the transfer is allowable under the SLFRF program (ALN 21.027) and adequate documentation has been provided to support that determination. (3) Where the costs incurred appear unreasonable and do not reflect the actions a prudent person would take in the circumstances. All parties agree that the cost appears reasonable; consequently, there is no amount that should be questioned. All documentation to support the allowability of this transfer was provided to the auditor for review. There were errors in the original calculation of the total amount eligible under the Public Health and Economic Impacts category; however, we provided documentation to support that the total amount was eligible under the Revenue Loss - Provision of Government Services use category. Although we have identified a weakness in internal control over compliance, there was no actual noncompliance. Consequently, there is no cost that is considered unallowable; therefore, there should be no questioned cost. DOL Contact: Kimberly Smith, Deputy Commissioner, DOL, 207-621-5096 DAFS Contact: Frank Wiltuck, Director of Internal Audit, OSC, 207-626-8420 Auditor?s Concluding Remarks: Management asserts, ?The transfer of $80 million to the Unemployment Trust Fund is completely allowable, with a portion categorized under the Public Health and Economic Impacts use category and a portion under the Revenue Loss - Provision of Government Services use category.? However, OSC did not provide documentation to support this statement, as described below. OSA initially questioned the allowability of the $80 million transfer in November 2022. In the following months and in response to OSA?s request for all documentation to corroborate the allowability of the transfer, OSC only provided evidence to support the transfer under the CSLFRF Public Health and Economic Impacts use category. OSA reviewed this support and identified errors in the calculation for the allowable amount of the transfer under the CSLFRF Public Health and Economic Impacts use category. As a result of these errors, OSA notified the Department that a finding would be issued and costs of $51,482,644 would be questioned. In response to the finding communication from OSA, OSC initiated discussion of alternative use categories for CSLFRF under which the transferred amount would be considered allowable. OSC proposed recategorizing the unallowable portion of the transfer from the Public Health and Economic Impacts use category to the Provision of Government Services use category of CSLFRF. Though the unallowable portion of the transfer (the questioned costs) may ultimately be allowable under this alternative use category, the costs, at the time of the audit, were incurred under the Public Health and Economic Impacts use category. Management states, ?we are unable to determine why the auditor has identified a questioned cost? and has provided the definition of Questioned Costs as defined by 2 CFR 200.1. However, OSC?s interpretation implies that OSA should allow changes in supporting documentation that do not align with the original intent of the usage of funds. The recategorization of the unallowable costs to another use category may be part of OSC?s corrective action plan; however, the documentation provided as audit evidence does not properly support $51,482,644 in CSLFRF Public Health and Economic Impacts costs. OSA cannot allow the Department to alter supporting documentation to avoid questioned costs. If OSA permitted the State to alter supporting documentation whenever OSA identified unallowable costs, there would never be any questioned costs to report. This is not the intent of 2 CFR 200.1. Managements acknowledges ?there were errors in the original calculation of the total amount eligible under the Public Health and Economic Impacts category? and ?we have identified a weakness in internal control over compliance,? which is the basis of this finding. The finding remains as stated. (State Number: 22-1699-01)

(2022-052) Title: Internal control over ESF expenditures needs improvement Prior Year Findings: None State Department: Education State Bureau: Office of Federal Emergency Relief Programs Federal Agency: U.S. Department of Education Assistance Listing Title: Education Stabilization Fund (ESF) (COVID-19) Assistance Listing Number: 84.425D, 84.425U Federal Award Identification Number: S425C200004, S425C210004, S425D200004, S425D210004, S425U210004, S425W210020, S425R210044, S425B200039 Compliance Area: Activities allowed or unallowed Allowable costs/cost principles Type of Finding: Material weakness Material noncompliance Questioned costs Known Questioned Costs: $620,676 Likely Questioned Costs: Likely questioned costs totaling $6,364,627 were projected by dividing the known questioned costs in our sample by total expenditures tested to establish an error rate, then applying that error rate to total expenditures paid in fiscal year 2022. Criteria: 2 CFR 200.303; 2 CFR 200.403; Coronavirus Aid, Relief, and Economic Security (CARES) Act, Public Law No. 116-136; Coronavirus Response and Relief Supplemental Appropriations (CRRSA) Act, Public Law No. 116-260; American Rescue Plan (ARP) Act, Public Law No. 117-2 The Department must establish and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. To be allowable under Federal awards, costs must be necessary and reasonable for the performance of the Federal award and be adequately documented. The CARES Act, CRRSA Act, and ARP Act authorized the creation of the Education Stabilization Fund and its subprograms. Governors and State Education Agencies (SEAs) must demonstrate that costs incurred by governors, SEAs, and subrecipients are allowable under the relevant statutory and regulatory provisions, assurances, and certification and agreement, and consistent with the purpose of the Education Stabilization Fund, which is to prevent, prepare for, and respond to COVID-19. Condition: Education Stabilization Funds (ESF) were authorized by Federal legislation for use by school administrative units (SAUs) within the State to prevent, prepare for, and respond to the COVID-19 pandemic. SAUs were required to submit applications to the Office of Federal Emergency Relief Programs (OFERP) under the Department of Education outlining identified uses for ESF including planned projects. Applications included detail on costs and the necessity of costs as a result of the COVID-19 pandemic. Program coordinators within OFERP were responsible for reviewing and approving applications submitted by SAUs. Once there was an approved application on file, SAUs could submit reimbursement requests to the Department for expenditures identified and approved in the application. The Office of the State Auditor (OSA) tested 60 SAU reimbursement requests to ensure that only allowable costs were charged to ESF and found that: ? one request for reimbursement contained an invoice for the purchase and installation of a new hot water boiler. The boiler project description stated that the school was in need of a new hot water boiler because it was likely that the existing equipment would not pass inspection after the current year. The cost of the new boiler and installation totaled $154,800. Replacing a boiler that was likely not going to pass upcoming inspections would have been a necessary project of the SAU independent of the COVID-19 pandemic. ? one request for reimbursement contained an invoice for replacing two sections of roof at a district elementary school. The roofing project description stated that the roof replacement was needed because they had leaks that may start to impact air quality and a functioning roof was needed in order to have students in person full-time. The cost of the roofing job totaled $54,915. Replacing a leaking roof would have been a necessary project of the SAU independent of the COVID-19 pandemic. Both subrecipients had an approved application on file with OFERP listing these specific projects. OSA selected a non-statistical random sample. OSA expanded testing as a result of the exceptions noted above. OSA reviewed the applications on file for the two SAUs and found a roof replacement project totaling $410,961. The SAU documented the roofing project as necessary to address concerns that could contribute to the possible spread of COVID-19. Replacing a roof would have been a necessary project of the SAU independent of the COVID-19 pandemic. The supporting documentation provided by the SAUs and maintained by the State does not demonstrate that the above costs are consistent with the purpose of ESF which is to prevent, prepare for, and respond to COVID-19; as a result, questioned costs total $620,676. Context: In fiscal year 2022, ESF expenditures totaled $126.4 million, of which $120.6 million was paid to subrecipient SAUs. Cause: ? Misinterpretation of Federal regulations ? Lack of explicit Federal guidance surrounding ESF allowability Effect: ? Noncompliance with Federal regulations ? Known questioned costs ? Potential future questioned costs and disallowances Recommendation: We recommend that the Department review all ESF expenditures to ensure that only allowable costs are charged to the Federal program. Expenditures that do not meet ESF criteria for allowability should be transferred out of ESF. Corrective Action Plan: See F-20 Management?s Response: The Maine Department of Education (MDOE) disagrees with the identified questioned costs. The Office of Federal Emergency Relief Programs (OFERP) utilized guidance provided by the U.S. Department of Education (grantor) and conferred in writing with Maine?s assigned U.S. Department of Education program officer throughout the Education Stabilization Fund application review process. The Maine Department of Education?s OFERP provided the auditor with the grantor?s guidance which clearly states that the questioned costs were allowable, reasonable, and necessary to prepare, prevent, and respond to the COVID-19 pandemic. Throughout the application review process, OFERP utilized ESF federal statutory language and the grantor?s published guidance to determine allowability. Once funding applications were approved, SAUs requested reimbursement from the OFERP for the approved costs outlined in the school administrative unit (SAU) application. The OFERP reviewed SAU reimbursement requests and provided payment for approved expenses. The ESF costs outlined in this finding were allowable, reasonable, and necessary to prepare, prevent, and respond to the COVID-19 pandemic. Documentation provided by the grantor supports the determinations made by the Maine Department of Education. Contact: Shelly Chasse-Johndro, Director of OFERP, DOE, 207-458-3180 Auditor?s Concluding Remarks: Supporting documentation provided by the Department for the reimbursements totaling $620,676 related to two roof replacements and a boiler replacement did not provide adequate evidence that these expenditures were necessary and in line with the allowability criteria of ESF, which is to prevent, prepare for, or respond to COVID-19. While all subrecipients had approved applications on file listing these specific projects, additional allowability considerations should have been made and documented prior to reimbursement. All questioned costs reported by OSA are related to projects that, based on the support maintained by the Department, would have been necessary for the SAU to address independent of the COVID-19 pandemic. Without documentation and evidence to substantiate that the expenditures are for needs directly arising from the public health emergency, OSA cannot determine that the reimbursements were in fact to prepare for, prevent, and respond to COVID-19; therefore, OSA questions the allowability of these costs. The finding remains as stated. (State Number: 22-1235-04)

(2022-053) Title: Internal control over submission and review of ESF Schedule of Expenditures of Federal Awards information needs improvement Prior Year Findings: See Schedule of Findings and Questioned Costs for chart/table State Department: Education Administrative and Financial Services State Bureau: Commissioner?s Office Office of the State Controller Federal Agency: U.S. Department of Education Assistance Listing Title: Education Stabilization Fund (ESF) (COVID-19) Assistance Listing Number: 84.425B, 84.425C, 84.425D, 84.425R Federal Award Identification Number: S425C200004, S425C210004, S425D200004, S425D210004, S425U210004, S425W210020, S425R210044, S425B200039 Compliance Area: Reporting Type of Finding: Material weakness Questioned Costs: None Criteria: 2 CFR 200.303; 2 CFR 200.510 The Department must establish and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. The Department must prepare a Schedule of Expenditures of Federal Awards (SEFA) for the period covered by the State?s financial statements which must include the total Federal awards expended. At a minimum, the SEFA must provide total Federal awards expended for each individual Federal program and the Assistance Listing Number (ALN). Condition: The Department must complete and submit exhibits and related schedules to the Office of the State Controller (OSC) at the close of each fiscal year to report Federal award information for inclusion on the State?s SEFA. OSC is responsible for compiling this information on behalf of the State. In fiscal year 2022, the Department received funding from the Education Stabilization Fund (ESF) under ALN 84.425. The U.S. Department of Education awarded ESF funds to grantees, including the State, under 23 subprograms. An alphabetic character at the end of ALN 84.425 is used to delineate each subprogram. Each subprogram has its own funding requirements and compliance requirements. At the close of the fiscal year, the Department provided a summary of ESF expenditures to OSC; however, the summary did not properly identify ESF subprograms and related expenditures. This summary was then used by OSC to compile and prepare the SEFA. The summary of ESF expenditures resulted in the following errors: ? Expenditures under subprogram 84.425B Discretionary Grants: Rethink K-12 Education Model Grants, were erroneously reported under 84.425R Coronavirus Response and Relief Supplemental Appropriations Act, 2021 ? Emergency Assistance to Non-Public Schools. As a result, subprogram 84.425B was originally omitted from the SEFA. ? Subprogram 84.425C Governor?s Emergency Education Relief was originally missing its subprogram alphabetic character designation and was incorrectly labeled as 84.425. This alphabetic character designation is required for SEFA and Federal reporting purposes. ? The Department transferred allowable prior year ESF expenditures to the Coronavirus Relief Fund (CRF) during fiscal year 2022. These amounts reduced the current year expenditures of the program, and as a result, ESF program totals were understated on the SEFA by $1.4 million. Subsequent OSC review procedures were not designed to detect and correct the errors outlined above. As a result, the errors were included on the State?s fiscal year 2022 SEFA provided to the Office of the State Auditor (OSA) for audit purposes. Context: The 2022 SEFA originally reported expenditures under ESF subprograms totaling $125 million; however, this included the following errors: ? Subprogram 84.425R reported expenditures totaling $4.8 million. This amount incorrectly included $1.7 million of expenditures that should have been listed separately under 84.425B. ? $1.4 million of prior year ESF expenditures were transferred out of current year SEFA totals to the CRF, resulting in an understatement of fiscal year 2022 ESF expenditures. Cause: ? Lack of adequate internal control relating to Department SEFA submissions to OSC ? Lack of adequate review procedures by OSC Effect: Incomplete or inaccurate amounts by Federal program or subprogram and ALN on the SEFA would result in noncompliance with Federal regulations if undetected. The SEFA is submitted to the Federal government and may be used for programmatic, policy or statistical purposes. Recommendation: We recommend that the Department implement additional procedures to improve preparation and submission of SEFA information to OSC. We further recommend that OSC implement additional supervisory review procedures over the SEFA information compiled on behalf of the State. These control procedures will ensure that expenditures are reported accurately on the SEFA. Corrective Action Plan: See F-20 Management?s Response: DOE Response: The Department agrees with this finding. The Department will be mindful to detect typographical errors through an increased level of scrutiny when conducting the review. DOE Contact: Nicole Denis, Director of Finance, DOE, 207-530-2161 OSC Response: The Office of the State Controller partially agrees with this finding. Federal funds reporting is decentralized and agencies use different methods for tying amounts to specific federal programs in Advantage. The Management Representation letters received from the agencies acknowledge that the agencies are responsible for the fair presentation of the expenditures in conformity with and in compliance with the rules and regulations of 2 CFR ?200. OSC is responsible to compile the data and submit the SEFA. OSC will update or clarify guidance as necessary and will consult with service center and agency financial personnel to help ensure their compilation/review systems are designed to provide accurate information for the SEFA. OSC Contact: Sandra Royce, Director of Financial Reporting, OSC, 207-626-8451 Auditor?s Concluding Remarks: In reply to OSC?s Management Response, OSA recognizes that SEFA reporting is a decentralized process and that OSC receives Management Representation Letters from agencies acknowledging responsibility for the fair presentation of SEFA information; however, OSC is responsible for reviewing the SEFA before it is provided to OSA for audit purposes. OSC has established review procedures prior to submission to OSA and that review and approval is documented on agencies? submissions. This review process, as stated in the finding, was not designed to detect and correct the errors noted in this finding, and findings 2022-023, 2022-064, and 2022-092, which are all related to agency submissions and OSC review of SEFA information. In addition, the Department of Administrative and Financial Services and OSC provide a signed Engagement Letter and Management Representation Letter to OSA, acknowledging the following responsibilities related to the annual Single Audit: ? Understanding and complying with the requirements of 2 CFR 200, including requirements relating to preparation of the SEFA ? Preparing and fairly presenting the SEFA and related disclosures in accordance with the requirements of the Uniform Guidance, including full identification of all government programs and related activities subject to the Federal compliance audit and all SEFA expenditures made during the audit period for all awards provided by Federal agencies OSA asserts that a year-to-year SEFA comparison would have detected the errors identified in the aforementioned findings; therefore, we continue to recommend that OSC implement additional supervisory review procedures over the SEFA information compiled on behalf of the State. This will provide assurance relating to the responsibility for SEFA information as outlined above and attested to OSA at the commencement and conclusion of the annual Single Audit. The finding remains as stated. (State Number: 22-1235-01)

(2022-054) Confidential finding, see below for more information Title: over the needs improvement Pursuant to paragraph 6.63 of the U.S. Government Accountability Office?s Government Auditing Standards (also known as the Yellow Book), we omitted details from this finding as they are confidential under the provisions of 5 MRSA 244-C (3). Though the content of this finding has been redacted, we provided the Department(s) with detailed information regarding the specific condition we identified, as well as the related criteria, context, causes, effects, and our specific recommendations for improvement. Prior Year Findings: See Schedule of Findings and Questioned Costs for chart/table Type of Finding: Material weakness Corrective Action Plan: See F-21 Contact: Shirley Browne, Deputy State Controller, Office of the State Controller, 207-626-8423 (State Number: 22-0909-03)

(2022-055) Confidential finding, see below for more information Title: over the and needs improvement Pursuant to paragraph 6.63 of the U.S. Government Accountability Office?s Government Auditing Standards (also known as the Yellow Book), we omitted details from this finding as they are confidential under the provisions of 5 MRSA 244-C (3). Though the content of this finding has been redacted, we provided the Department(s) with detailed information regarding the specific condition we identified, as well as the related criteria, context, causes, effects, and our specific recommendations for improvement. Prior Year Findings: See Schedule of Findings and Questioned Costs for chart/table Type of Finding: Material weakness Corrective Action Plan: See F-21 Contact: Shirley Browne, Deputy State Controller, Office of the State Controller, 207-626-8423 (State Number: 22-0909-07)

(2022-056) Title: Internal control over ESF special reporting needs improvement Prior Year Findings: See Schedule of Findings and Questioned Costs for chart/table State Department: Education State Bureau: Commissioner?s Office Federal Agency: U.S. Department of Education Assistance Listing Title: Education Stabilization Fund (ESF) (COVID-19) Assistance Listing Number: 84.425U Federal Award Identification Number: S425C200004, S425C210004, S425D200004, S425D210004, S425U210004, S425W210020, S425R210044, S425B200039 Compliance Area: Reporting Type of Finding: Significant deficiency Questioned Costs: None Criteria: 2 CFR 200.303; 2 CFR 170 The Department must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the Department is managing the award in compliance with Federal statutes, regulations, and the terms and conditions of the award. Agencies must report each subaward that equals or exceeds the first-tier subaward threshold of $30,000 in Federal funds in the public-facing Federal Funding Accountability and Transparency Act (FFATA) Subaward Reporting System. Condition: When an amount exceeding the first-tier subaward threshold is awarded to a subrecipient, the Department must collect and enter data into the FFATA Subaward Reporting System (FSRS). In the Office of the State Auditor?s (OSA) test of 36 subawards that exceeded the first-tier subaward threshold, the following FFATA reporting exceptions were identified: ? One subaward listed an incorrect project description; and ? One subaward totaling $683,794 was incorrectly reported for Education in the Unorganized Territories (EUT). This is not a subrecipient award as the EUT is governed by the State. In addition, the Department could not provide evidence that a secondary review of FFATA reports occurred prior to submission in the FSRS to ensure that information entered was accurate and complete. The Department implemented a secondary review process in February 2022; however, this was not in place when ESF subawards were reported in September and October 2021. OSA selected a non-statistical random sample. Context: During fiscal year 2022, the Department obligated $371 million in first-tier subawards to 177 subrecipients of ESF. All 177 subrecipients had awards that exceeded the first-tier subaward threshold for reporting in the FSRS. Cause: ? Lack of supervisory review ? Lack of policies and procedures prior to February 2022 Effect: Inaccurate, incomplete, or untimely information was and may continue to be reported to the Federal government. This information may be used for programmatic, policy or statistical purposes. Recommendation: We recommend that the Department maintain policies and procedures to ensure all subawards that meet or exceed the first-tier threshold are reported accurately, timely, and in accordance with Federal regulations. Documentation of supervisory review for each FFATA report submitted in the FSRS should be retained as required by policies and procedures established in February 2022. Corrective Action Plan: See F-21 Management?s Response: The Department agrees with this finding. Beginning in February 2022, the Department implemented a procedure for reviewing FFATA reports for accuracy prior to submission. Where this finding relates to FFATA reports prior to February 2022, and the Department has taken steps to address the previous finding, management feels that no further corrective action is necessary. Contact: Nicole Denis, Director of Finance, DOE, 207-530-2161 (State Number: 22-1235-02)

(2022-057) Title: Internal control over ESF subrecipient monitoring procedures needs improvement Prior Year Findings: None State Department: Education State Bureau: Commissioner?s Office Federal Agency: U.S. Department of Education Assistance Listing Title: Education Stabilization Fund (ESF) (COVID-19) Assistance Listing Number: 84.425D, 84.425R, 84.425U Federal Award Identification Number: S425C200004, S425C210004, S425D200004, S425D210004, S425U210004, S425W210020, S425R210044, S425B200039 Compliance Area: Subrecipient monitoring Type of Finding: Significant deficiency Questioned Costs: None Criteria: 2 CFR 200.303; 2 CFR 200.313; 2 CFR 200.332 The Department must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the Department is managing the award in compliance with Federal statutes, regulations, and the terms and conditions of the award. For equipment acquired with Federal funding, records must be maintained that include: ? a description and identification number; ? the source of funding, including the Federal Award Identification Number; ? who holds title and the acquisition date; ? the cost of the property, including the percentage of Federal participation in the project costs for the Federal award under which the property was acquired; ? the location, use and condition; and ? any ultimate disposition data including the date of disposal and sale price of the property. A physical inventory of the property must be taken and the results reconciled with the property records at least once every two years. A control system must be developed to ensure adequate safeguards to prevent loss, damage, or theft of the property. Any loss, damage, or theft must be investigated. The Department must monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. Condition: The Education Stabilization Fund (ESF) provides funding to school administrative units (SAUs) to purchase equipment for use in preventing, preparing for, or responding to the COVID-19 pandemic. SAUs were required to submit applications to the Office of Federal Emergency Relief Programs (OFERP) under the Department of Education outlining identified uses for ESF including planned equipment purchases. Program coordinators within OFERP were responsible for reviewing and approving applications submitted by SAUs. Once there was an approved application on file, SAUs could submit reimbursement requests to the Department for equipment purchases identified and approved in the application. All SAU equipment purchases reimbursed with ESF are subject to applicable inventory control, log maintenance, and disposition requirements consistent with Federal regulations for equipment and real property management. During fiscal year 2022, the Department did not have policies and procedures in place to track SAU equipment purchases reimbursed with ESF; therefore, the Department does not have assurance that: ? a complete and accurate record of all equipment purchased with ESF funds was maintained by each SAU. ? proper monitoring activities surrounding subrecipient compliance with Federal regulations for equipment and real property management were conducted. Context: In fiscal year 2022, ESF expenditures totaled $126.4 million, of which $120.6 million was paid to subrecipient SAUs. Cause: ? Lack of policies and procedures ? Lack of supervisory oversight Effect: ? Noncompliance with Federal regulations ? Subrecipients may not be in compliance with equipment and real property management requirements. ? Assets purchased with ESF funds may not be properly safeguarded or maintained. Recommendation: We recommend that the Department implement policies and procedures to ensure that a complete and accurate record of all equipment purchased under ESF is maintained by the Department and by each SAU. This record should be utilized during subrecipient monitoring activities to verify subrecipient compliance with Federal regulations. Corrective Action Plan: See F-21 Management?s Response: The Department agrees with this finding. The Office of Federal Emergency Relief Programs will develop and implement policies and procedures so that complete and accurate records of all equipment purchased under ESF will be maintained by each SAU and the Department when collected during subrecipient monitoring. Contact: Shelly Chasse-Johndro, Director of OFERP, DOE, 207-458-3180 (State Number: 22-1235-06)

(2022-058) Title: Internal control over ICA program subrecipient monitoring procedures needs improvement Prior Year Findings: None State Department: Health and Human Services State Bureau: Maine Center for Disease Control & Prevention Federal Agency: U.S. Department of Health and Human Services Assistance Listing Title: Immunization Cooperative Agreements (COVID-19) Assistance Listing Number: 93.268 Federal Award Identification Number: NH23IP922604 Compliance Area: Subrecipient monitoring Type of Finding: Material weakness Material noncompliance Questioned Costs: None Criteria: 2 CFR 200.303; 2 CFR 200.332 The Department must establish and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. The Department must: ? include Federal award information in the subaward that enables subrecipients to identify the source of the Federal award, as well as certain subrecipient information. ? evaluate each subrecipient?s risk of noncompliance with Federal regulations for the purposes of determining the appropriate level of subrecipient monitoring to be performed. ? monitor the activities of the subrecipient as necessary to ensure that subawards are used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward, and that subaward performance goals are achieved. Condition: The Department is responsible for ensuring subrecipients comply with Federal requirements by: ? reviewing subrecipient grant awards to ensure accurate Federal award identification information is included to allow subrecipients to accurately identify the source of the subawards; ? utilizing risk evaluations to determine the appropriate level of monitoring activities to be performed that correspond to the results of those risk evaluations; and ? performing ongoing monitoring activities to ensure that the subaward was used for authorized purposes and in compliance with Federal regulations. The Office of the State Auditor (OSA) tested compliance with subrecipient monitoring requirements for 7 subrecipients and found that: ? 3 subawards did not properly identify required Federal award information: o 2 subawards were missing the subrecipient?s Data Universal Numbering System (DUNS) number. o 2 subawards reported the wrong Assistance Listing Number. ? 2 subrecipients were deemed ?higher risk? after the Department performed a risk evaluation; however, the Department could not provide documentation to support that additional monitoring activities were performed in response to the ?higher risk? designation. ? 80 performance reports were required to be completed and submitted for fiscal year 2022 to ensure subaward performance goals are achieved. o 47 reports were provided to the auditor but lacked evidence of supervisory review. o 33 reports could not be provided. ? 52 financial reports were required to be completed and submitted for fiscal year 2022 to ensure subawards are used for approved budgeted expenditures. o 32 reports were provided to the auditor but lacked evidence of supervisory review. o 20 reports could not be provided. The Department could not provide any further documentation to support subrecipient monitoring procedures occurred during fiscal year 2022 to ensure that the subaward was used for authorized purposes. OSA selected a non-statistical random sample. Context: The Department provided $2.5 million to 35 Immunization Cooperative Agreements (ICA) program subrecipients in fiscal year 2022. Cause: ? Lack of adequate policies and procedures ? Lack of supervisory oversight Effect: ? Noncompliance with Federal regulations ? Lack of ongoing subrecipient monitoring procedures could result in undetected subrecipient noncompliance. Recommendation: We recommend that the Department implement policies and procedures to ensure that: ? subaward agreements include all required information and are accurate; ? risk evaluations are utilized to determine the appropriate level of monitoring activities to be performed; and ? ongoing subrecipient monitoring is completed during the subaward and documented. This will ensure that the Department is in compliance with subrecipient monitoring requirements. Corrective Action Plan: See F-22 Management?s Response: The Department agrees with this finding. The Department initiated these subrecipient agreements to ensure equitable access to COVID-19 vaccines. As a result of these agreements, Maine had one of the best vaccine roll-outs in the country, including among Black, Indigenous, and People of Color. Some of the information requested by OSA was unable to be accessed because it was saved in individual staff files which were moved when an employee was transferred or left employment with the Department. The Department will implement processes in SFY23 to improve record keeping for these subawards including: 1) reviewing subaward agreements using a checklist to ensure they include all the required information and are accurate; 2) ensuring that risk evaluations are utilized to determine the appropriate level of monitoring; and 3) improving and centralizing subrecipient monitoring documentation within the Office of Population Health Equity (OPHE) at Maine CDC. Contact: Ian Yaffe, Director, Office of Population Health Equity, DHHS, 207- 592-1481 (State Number: 22-1118-03)

(2022-059) Confidential finding, see below for more information Title: over and needs improvement Pursuant to paragraph 6.63 of the U.S. Government Accountability Office?s Government Auditing Standards (also known as the Yellow Book), we omitted details from this finding as they are confidential under the provisions of 5 MRSA 244-C (3). Though the content of this finding has been redacted, we provided the Department(s) with detailed information regarding the specific condition we identified, as well as the related criteria, context, causes, effects, and our specific recommendations for improvement. Prior Year Findings: See Schedule of Findings and Questioned Costs for chart/table Type of Finding: Material weakness Corrective Action Plan: See F-22 Contact: Shirley Browne, Deputy State Controller, Office of the State Controller, 207-626-8423 (State Number: 22-0906-02)

(2022-060) Title: Internal control over the submission of ICA Schedule of Expenditures of Federal Awards reporting needs improvement Prior Year Findings: None State Department: Health and Human Services Administrative and Financial Services State Bureau: Maine Center for Disease Control & Prevention Health and Human Services Service Center Federal Agency: U.S. Department of Health and Human Services Assistance Listing Title: Immunization Cooperative Agreements (COVID-19) Assistance Listing Number: 93.268 Federal Award Identification Number: NH23IP922604 Compliance Area: Reporting Type of Finding: Significant deficiency Questioned Costs: None Criteria: 2 CFR 200.303; 2 CFR 200.510 The Department must establish and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. The Department must prepare a Schedule of Expenditures of Federal Awards (SEFA) for the period covered by the State?s financial statements which must include the total Federal awards expended. At a minimum, the SEFA must provide total Federal awards expended for each individual Federal program and the Assistance Listing Number (ALN). Condition: The Department must complete and submit exhibits and related schedules to the Office of the State Controller (OSC) at the close of each fiscal year to report Federal award information for inclusion on the State?s SEFA. OSC is responsible for compiling this information on behalf of the State. In fiscal year 2022, the Department received funding for the Immunization Cooperative Agreements (ICA) program. At the close of the fiscal year, the Department and its Service Center provided a summary of Federal ICA expenditures to OSC which included noncash vaccine awards; however, the summary included the wrong fiscal year?s noncash vaccine award data. This summary was then used by OSC to compile and prepare the SEFA and the related Notes to the SEFA. As a result, ICA expenditures were inaccurately reported on the State?s fiscal year 2022 SEFA and related Notes when provided to the Office of the State Auditor for audit purposes. Context: In fiscal year 2022, noncash flu vaccines totaling $169,070 were not reported to OSC by the Department for inclusion in the SEFA. Cause: Lack of adequate internal control relating to Department SEFA submissions to OSC Effect: ? Inaccurate reporting of expenditure amounts on the SEFA, which is submitted to the Federal government, may result in incorrect information used for programmatic, policy, or statistical purposes. ? Inaccurate information was reported in the fiscal year 2022 Annual Comprehensive Financial Report. Recommendation: We recommend that the Department and its Service Center implement additional procedures to improve preparation and submission of SEFA information to OSC. These control procedures will ensure that expenditures are reported accurately on the SEFA and in the related Notes to the SEFA. Corrective Action Plan: See F-22 Management?s Response: The DHHS and DHHS Financial Service Center agree with this finding. For the next SEFA for SFY 2023, when the request is sent from the Financial Service Center to the MIP Senior Health Program Manager (SHPM), the SHPM will request the information from the MIP Planning and Research Associate. The SHPM will be required to review the requested data prior to the response, which will include fiscal year accuracy of the reports. The Financial Service Center will then provide a summary and backup of what is being reported on the SEFA to CDC?s Immunization program for their written approval. The Financial Service Center will add to the reviewer?s checklist that the preparer has consulted and has proper backup with CDC?s Immunization?s program to verify that the information provided was accurate. This will be completed by 12/31/2023. Contact: Jessica Shiminski, Health Program Manager, Maine Center for Disease Control & Prevention, DHHS, 207-287-7087 (State Number: 22-1118-01)

(2022-061) Title: Internal control over ICA program cash management needs improvement Prior Year Findings: None State Department: Administrative and Financial Services State Bureau: Health and Human Services Service Center Federal Agency: U.S. Department of Health and Human Services Assistance Listing Title: Immunization Cooperative Agreements (COVID-19) Assistance Listing Number: 93.268 Federal Award Identification Number: NH23IP922604 Compliance Area: Cash management Type of Finding: Significant deficiency Questioned Costs: None Criteria: 2 CFR 200.303; 2 CFR 200.302; 31 CFR 205.33; State Administrative and Accounting Manual (SAAM) Section 50.40.80 The Department must establish and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. The Department must minimize the time between the drawdown of Federal funds and the disbursement of these funds for Federal program purposes. The timing and amount of fund transfers must be as close as administratively feasible to the Department?s actual cash outlay for program costs. Section 50.40.80 of the SAAM has defined administratively feasible as no more than seven business days. Condition: The Department of Health and Human Services Service Center (DHHS SC) is responsible for the drawdown of funds for the Immunization Cooperative Agreements (ICA) program. The DHHS SC requests Federal funds in order to reimburse ICA program expenditures. In December 2021, $478,459 of program expenditures that had previously been reimbursed under the ICA program were recategorized as eligible Coronavirus Relief Fund expenditures. The DHHS SC did not immediately return the funds that were received for these expenditures and continued to draw additional Federal funds under the ICA grant. As a result, the State?s Federal cash balances for the ICA program exceeded the State?s administratively feasible threshold of seven business days for approximately seven months. Context: In fiscal year 2022, there were approximately 160 Federal grant drawdowns totaling $8.7 million for the ICA program. Cause: ? Lack of adequate procedures to capture all program activity ? Lack of supervisory oversight Effect: The Federal government may impose more stringent program-specific cash management requirements based on noncompliance. Recommendation: We recommend that the DHHS SC develop and implement policies and procedures to address identification and timely return of excess grant funds to the Federal government. Corrective Action Plan: See F-23 Management?s Response: The DHHS and the DHHS Financial Service Center agree with this finding. Policies and procedures will be reviewed for CMIA, draw procedures and reconciliations. The grant daily files will be reconciled for the Immunization grants from 2021 through current by December 31, 2023 in order to timely identify and return excess grant funds. Contact: Sarah Gove, Director, DHHS Service Center, DAFS, 207-458-6626 (State Number: 22-1118-02)

(2022-062) Confidential finding, see below for more information Title: over the needs improvement Pursuant to paragraph 6.63 of the U.S. Government Accountability Office?s Government Auditing Standards (also known as the Yellow Book), we omitted details from this finding as they are confidential under the provisions of 5 MRSA 244-C (3). Though the content of this finding has been redacted, we provided the Department(s) with detailed information regarding the specific condition we identified, as well as the related criteria, context, causes, effects, and our specific recommendations for improvement. Prior Year Findings: See Schedule of Findings and Questioned Costs for chart/table Type of Finding: Significant deficiency Corrective Action Plan: See F-23 Contact: Shirley Browne, Deputy State Controller, Office of the State Controller, 207-626-8423 (State Number: 22-0906-01)

(2022-063) Title: Internal control over ELC program reporting needs improvement Prior Year Findings: See Schedule of Findings and Questioned Costs for chart/table State Department: Health and Human Services State Bureau: Maine Center for Disease Control & Prevention Federal Agency: U.S. Department of Health and Human Services Assistance Listing Title: Epidemiology and Laboratory Capacity for Infectious Diseases (ELC) (COVID-19) Assistance Listing Number: 93.323 Federal Award Identification Number: NU50CK000523 Compliance Area: Reporting Type of Finding: Material weakness Material noncompliance Questioned Costs: None Criteria: 2 CFR 200.303; Coronavirus Aid, Relief, and Economic Security (CARES) Act Section 18115; Paycheck Protection Program and Health Care Enhancement Act of 2020 (PL 116-139); Coronavirus Response and Relief Supplemental Appropriations Act of 2020 (PL 116-260) The Department must establish and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. The Department must ensure that every laboratory that performs or analyzes a test that is intended to detect or diagnose a possible case of COVID-19 reports the results from each test to the U.S. Department of Health and Human Services. Condition: During fiscal year 2022, the Maine Center for Disease Control & Prevention (MeCDC) was required to complete the following reports: ? Quarterly and annual performance reports for four separate Federal awards ? Quarterly special reports for jurisdictional testing and positive/negative test results MeCDC could not provide supporting documentation to verify the accuracy, completeness, and timeliness of the filed reports. In addition, all reports were filed without documentation of approval by a secondary person prior to submission. Context: During fiscal year 2022, 16 quarterly performance reports, four annual performance reports, and two quarterly special reports were required to be filed. Cause: ? Lack of adequate internal controls ? Lack of supervisory oversight ? Lack of staff resources due to a significant increase in workload Effect: ? Incorrect or incomplete data may be reported to the Federal government. ? Potential Federal noncompliance due to performance and special reports not filed timely Recommendation: We recommend that MeCDC implement a documented process over the completion, filing, review, and retention of performance and special reports. Corrective Action Plan: See F-23 Management?s Response: The Department agrees with this finding. The Division of Disease Surveillance, within the Maine Center of Disease Control and Prevention put into place a comprehensive process to ensure quarterly and annual performance reports and special reports are properly completed, reviewed, filed, and retained during the fall of 2022. In September 2022, the Division hired a Grants Manager who developed a report tracking system using Microsoft Project. The individuals completing the reports, now complete them in Microsoft Project and from there the Grant Manager reviews for completeness and uploads into the federal site. The Grants Manager sends an email to the Principal Investigator when reports are complete and have been submitted to the federal CDC. Contact: Sara Robinson, Senior Program Manager, MeCDC, DHHS, 207-287-4610 (State Number: 22-1156-01)

(2022-064) Title: Internal control over submission and review of ELC Schedule of Expenditures of Federal Awards information needs improvement Prior Year Findings: None State Department: Health and Human Services Administrative and Financial Services State Bureau: Maine Center for Disease Control & Prevention Health and Human Services Service Center Office of the State Controller Federal Agency: U.S. Department of Health and Human Services Assistance Listing Title: Epidemiology and Laboratory Capacity for Infectious Diseases (ELC) (COVID-19) Assistance Listing Number: 93.323 Federal Award Identification Number: NU50CK000523 Compliance Area: Reporting Type of Finding: Material weakness Material noncompliance Questioned Costs: None Criteria: 2 CFR 200.303; 2 CFR 200.510 The Department must establish and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. The Department must prepare a Schedule of Expenditures of Federal Awards (SEFA) for the period covered by the State?s financial statements which must include the total Federal awards expended. At a minimum, the SEFA must provide total Federal awards expended for each individual Federal program and the Assistance Listing Number (ALN). Condition: The Department must complete and submit exhibits and related schedules to the Office of the State Controller (OSC) at the close of each fiscal year to report Federal award information for inclusion on the State?s SEFA. OSC is responsible for compiling this information on behalf of the State. At the close of the fiscal year, the Department and its Service Center reported Federal expenditures of $45 million under the ELC program to OSC; however, current year expenditures actually totaled $59 million. This information was then used by OSC to compile and prepare the SEFA. Subsequent OSC review procedures were not designed to detect and correct this error. As a result, ELC expenditures were incorrect on the State?s fiscal year 2022 SEFA when provided to the Office of the State Auditor for audit purposes. Context: The 2022 SEFA originally reported total expenditures under ELC totaling $45 million; however, this included $14 million of prior year ELC expenditures that were transferred out of current year SEFA totals to the Coronavirus Relief Fund, resulting in an understatement of fiscal year ELC expenditures. Cause: ? Lack of adequate internal control relating to SEFA submissions to OSC ? Lack of adequate review procedures by OSC Effect: Incomplete or inaccurate amounts by Federal program on the SEFA would result in noncompliance with Federal regulations if undetected. The SEFA is submitted to the Federal government and may be used for programmatic, policy or statistical purposes. Recommendation: We recommend that the Department work with its Service Center to implement additional procedures to improve preparation and submission of SEFA information to OSC. We further recommend that OSC implement additional supervisory review procedures over the SEFA information compiled on behalf of the State. These control procedures will ensure that expenditures are reported accurately on the SEFA. Corrective Action Plan: See F-23 Management?s Response: DHHS and DHHS Financial Service Center Response: The DHHS and the DHHS Financial Service Center agree with this finding. The Financial Service Center will work with OSC to develop and implement additional procedures related to reporting of prior period adjustments beginning with the SEFA that is for the State Fiscal Year 2023, by December 31, 2023. DHHS Contact: Sarah Gove, Director, DHHS Service Center, DAFS, 207-458-6626 OSC Response: The Office of the State Controller partially agrees with this finding. Federal funds reporting is decentralized and agencies use different methods for tying amounts to specific federal programs in Advantage. The Management Representation letters received from the agencies acknowledge that the agencies are responsible for the fair presentation of the expenditures in conformity with and in compliance with the rules and regulations of 2 CFR ?200. OSC is responsible to compile the data and submit the SEFA. OSC will update or clarify guidance as necessary and will consult with service center and agency financial personnel to help ensure their compilation/review systems are designed to provide accurate information for the SEFA. OSC Contact: Sandra Royce, Director of Financial Reporting, OSC, 207-626-8451 Auditor?s Concluding Remarks: In reply to OSC?s Management Response, the Office of the State Auditor (OSA) recognizes that SEFA reporting is a decentralized process and that OSC receives Management Representation Letters from agencies acknowledging responsibility for the fair presentation of SEFA information; however, OSC is responsible for reviewing the SEFA before it is provided to OSA for audit purposes. OSC has established review procedures prior to submission to OSA and that review and approval is documented on agencies? submissions. This review process, as stated in the finding, was not designed to detect and correct the errors noted in this finding, and findings 2022-023, 2022-053, and 2022-092, which are all related to agency submissions and OSC review of SEFA information. In addition, the Department of Administrative and Financial Services and OSC provide a signed Engagement Letter and Management Representation Letter to OSA, acknowledging the following responsibilities related to the annual Single Audit: ? Understanding and complying with the requirements of 2 CFR 200, including requirements relating to preparation of the SEFA ? Preparing and fairly presenting the SEFA and related disclosures in accordance with the requirements of the Uniform Guidance, including full identification of all government programs and related activities subject to the Federal compliance audit and all SEFA expenditures made during the audit period for all awards provided by Federal agencies OSA asserts that a year-to-year SEFA comparison would have detected the errors identified in the aforementioned findings; therefore, we continue to recommend that OSC implement additional supervisory review procedures over the SEFA information compiled on behalf of the State. This will provide assurance relating to the responsibility for SEFA information as outlined above and attested to OSA at the commencement and conclusion of the annual Single Audit. The finding remains as stated. (State Number: 22-1156-02)

(2022-065) Title: Internal control over ELC program cash management needs improvement Prior Year Findings: None State Department: Health and Human Services Administrative and Financial Services State Bureau: Maine Center for Disease Control & Prevention Health and Human Services Service Center Federal Agency: U.S. Department of Health and Human Services Assistance Listing Title: Epidemiology and Laboratory Capacity for Infectious Diseases (ELC) (COVID-19) Assistance Listing Number: 93.323 Federal Award Identification Number: NU50CK000523 Compliance Area: Cash management Type of Finding: Material weakness Material noncompliance Questioned Costs: None Criteria: 2 CFR 200.303; 31 CFR 205.33; State Administrative and Accounting Manual (SAAM) Section 50.40.80 The Department must establish and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. The Department must minimize the time between the drawdown of Federal funds and the disbursement of these funds for Federal program purposes. The timing and amount of fund transfers must be as close as administratively feasible to the Department?s actual cash outlay for program costs. Section 50.40.80 of the SAAM has defined administratively feasible as no more than seven business days. Condition: The Department of Health and Human Services (DHHS) Service Center (SC) provides services including human resources, payroll, accounting, and finance to programs administered by DHHS, including the Epidemiology and Laboratory for Infectious Diseases (ELC) program. The DHHS SC requests Federal funds to reimburse ELC program expenditures utilizing a system report of expenditures. This report includes both expenditures that have been paid and expenditures that are pending payment. Expenditures that are pending payment can take a significant amount of time to process. In the Office of the State Auditor?s testing of 48 Federal drawdowns, four drawdowns of Federal funds for the ELC program were beyond the administratively feasible requirement for disbursement. Disbursements ranged from 8 to 63 days after the receipt of Federal funds. The Office of the State Auditor selected a non-statistical random sample. Context: In fiscal year 2022, there were 211 Federal grant draws for the ELC program totaling $43.7 million. The four draws beyond the administratively feasible requirement for disbursement totaled $5.9 million. Cause: ? Lack of adequate policies and procedures ? Lack of supervisory oversight Effect: ? Noncompliance with Federal regulations ? The Federal government may impose more stringent program-specific cash management requirements based on noncompliance. Recommendation: We recommend that the DHHS SC review and revise current policies and include guidance for drawing Federal funds to exclude pending expenditures to ensure that Federal cash is requested based on immediate cash needs. Corrective Action Plan: See F-24 Management?s Response: The DHHS and the DHHS Financial Service Center agree with this finding. Policies and procedures will be reviewed for CMIA, draw procedures and reconciliations. Due to the number of individual CDC COVID grants received, the volume of daily processes has increased. The DHHS Financial SC will work to obtain and/or increase estimated revenue within the COVID appropriations. With an approval of estimated revenue, expenses will process first, and federal cash will be drawn after, reducing the risk of CMIA as Federal cash will be instantly replenishing the account rather than waiting for invoices to process. Contact: Sarah Gove, Director, DHHS Service Center, DAFS, 207-458-6626 (State Number: 22-1156-05)

(2022-066) Title: Internal control over ELC program suspension and debarment needs improvement Prior Year Findings: None State Department: Health and Human Services State Bureau: Division of Contract Management Federal Agency: U.S. Department of Health and Human Services Assistance Listing Title: Epidemiology and Laboratory Capacity for Infectious Diseases (ELC) (COVID-19) Assistance Listing Number: 93.323 Federal Award Identification Number: NU50CK000523 Compliance Area: Procurement and suspension and debarment Type of Finding: Significant deficiency Questioned Costs: None Criteria: 2 CFR 200.303; 2 CFR 180.220 and .300; Division of Contract Management Policy The Department must establish and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. Non-Federal entities are prohibited from contracting with or making subawards under covered transactions to parties that are suspended or debarred. ?Covered transactions? include contracts for goods and services awarded under a non-procurement transaction (e.g., grant or cooperative agreement) that are expected to equal or exceed $25,000 or meet certain other criteria as specified in 2 CFR 180.220. The Division of Contract Management (DCM) requires all subrecipients to register in the System of Award Management (SAM) prior to awarding Federal funds to a recipient. DCM?s policy also requires annual verification, review and documentation of suspension and debarment compliance obtained from the SAM website. This document is required to be retained for each subrecipient that administers the Epidemiology and Laboratory Capacity for Infectious Diseases (ELC) grant. Condition: The Department of Health and Human Services? DCM administers subrecipient contracts for the ELC program. Included in all contracts is a Debarment, Performance, and Non- Collusion Certification. Annually, contract administrators are responsible for verifying that entities are not suspended or debarred on the SAM website. The Office of the State Auditor (OSA) selected eight subrecipients for testing compliance with suspension and debarment regulations. DCM could not provide documented support that: ? review and verification procedures were completed for five of the eight subrecipients tested. ? one subrecipient was registered on the SAM website. As a result, compliance with suspension and debarment could not be verified. The Department paid $54,423 to the subrecipient. OSA selected a non-statistical random sample. Context: The Department provided $5.9 million to the 43 subrecipients that administered the ELC program during fiscal year 2022. Cause: ? Lack of adequate procedures ? Lack of supervisory oversight Effect: ? Potential questioned costs and disallowances ? Noncompliance with Federal regulations Recommendation: We recommend that the Department implement additional procedures to ensure that verification of suspension and debarment procedures are performed, properly documented, and retained. This will ensure that the Department does not enter into an agreement with a suspended or debarred entity. Corrective Action Plan: See F-24 Management?s Response: The Department disagrees with this finding. The Uniform Guidance part 200.214 identifies that non-Federal entities are subject to the non-procurement debarment and suspension regulations in 2 CFR part 180. 2 CFR part 180 requires that ?when you enter into a covered transaction with another person at the next lower tier, you must verify that the person with whom you intend to do business is not excluded or disqualified. You do this by: (a) Checking SAM Exclusions; or (b) Collecting a certification from that person; or (c) Adding a clause or condition to the covered transaction with that person.? The Department meets this requirement as part of the contracting process by collecting certifications from the Community Agencies stating that they are not suspended or debarred. Therefore, we are in compliance with the Federal requirements for Suspension and debarment. The intent of the Department?s policy to utilize the System for Award Management Exclusions (SAM) is to be an optional and additional assurance to the required collection of certifications that the next lower tier persons are not suspended or debarred. The SAM is utilized as time and resources permit and is not intended to replace the certifications. Contact: Jim Lopatosky, Director, Division of Contract Management, DHHS, 207-287-5075 Auditor?s Concluding Remarks: DCM established the following policies to ensure compliance with Federal regulations: ? Subrecipients must register with the SAM prior to receiving Federal funds. ? Annual verification that the subrecipient is not suspended or debarred must be completed by obtaining and retaining such information from the SAM website. ? A Debarment, Performance, and Non-Collusion Certification is included in the subrecipient contract. One subrecipient was not registered with the SAM and the Department could not provide documentation to support that verification was performed for five subrecipients. It is the responsibility of the Department to implement policies and procedures to ensure compliance with Federal regulations. The Department has established such policies and identified these policies as the control mechanism to ascertain that the Department does not contract subrecipients who are suspended or debarred. To attest that a policy is optional negates the effectiveness of the control mechanism. The Department did not follow its established policies; therefore, a failure in the control process exists. The finding remains as stated. (State Number: 22-1156-03)

(2022-067) Title: Internal control over payments made to and on behalf of TANF clients needs improvement Prior Year Findings: See Schedule of Findings and Questioned Costs for chart/table State Department: Health and Human Services State Bureau: Office for Family Independence Federal Agency: U.S. Department of Health and Human Services Assistance Listing Title: Temporary Assistance for Needy Families (TANF) (COVID-19) Assistance Listing Number: 93.558 Federal Award Identification Number: 1901METANF, 2001METANF, 2101METANF Compliance Area: Activities allowed or unallowed Allowable costs/cost principles Type of Finding: Material weakness Material noncompliance Questioned costs Known Questioned Costs: $1,447 Likely Questioned Costs: Likely questioned costs totaling $35,002 were projected by dividing the identified known overpayment in our sample by total payments tested to establish an error rate, then applying that error rate to total payments to TANF clients for these services and payments to providers on behalf of TANF clients in fiscal year 2022. Criteria: 2 CFR 200.303; 2 CFR 200.403; 45 CFR 263.11 The Department must establish and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. To be allowable under Federal awards, costs must be necessary and reasonable for the performance of the Federal award and be adequately documented. The Department must use Federal TANF funds for expenditures that are reasonably calculated to accomplish the purposes of TANF. Use of funds in violation of this is considered misuse of funds. Condition: The Department issues TANF payments directly to a TANF client for various items and services. The Department also issues TANF payments directly to providers on behalf of TANF clients for services rendered such as child care and transportation. The Office of the State Auditor (OSA) tested 60 payments and found that: ? one payment issued in October 2021 overpaid a provider by $22 for Transitional Child Care. Upon further review, OSA found that an additional $506 was overpaid to the child- care provider during fiscal year 2022. The overpayment was identified by the Department in December 2021; however, as of audit testing, 14 months after the overpayment was identified, there has not been a recoupment. ? one payment overpaid a provider by $15 for Transitional Child Care. Upon further review, OSA found that an additional $555 was overpaid to the childcare provider during fiscal year 2022. The overpayment was identified by OSA during testing. ? one payment overpaid a provider by $17 for Transitional Child Care. Upon further review, OSA found that an additional $323 was overpaid to the childcare provider during fiscal year 2022. The overpayment was identified by OSA during testing. ? one payment issued in May 2022 overpaid a TANF client a total of $75 for clothing. An advance allowance was issued to the TANF client; however, the TANF client did not submit a receipt substantiating the purchase as required. The Department identified the overpayment in July 2022 and $66 of the overpayment was recouped on January 6, 2023. OSA selected a non-statistical random sample. Context: In fiscal year 2022, payments to TANF clients for services other than direct cash benefits and payments to providers on behalf of TANF clients totaled $6.8 million. Cause: ? Lack of adequate procedures ? Lack of supervisory oversight Effect: ? Known questioned costs ? Potential future questioned costs and disallowances ? Noncompliance with Federal regulations Recommendation: We recommend that the Department implement procedures to ensure that payments made to TANF clients and providers are accurate, allowable, and adequately documented. We further recommend that the Department increase monitoring procedures over these payments. Corrective Action Plan: See F-24 Management?s Response: The Department disagrees with this finding. The Department?s effective internal controls identified the overpayments, made the referrals, and followed procedures for two of the four exceptions noted. The two exceptions that we did not identify as overpayments we believe are in accordance with the reasonably calculated requirement to accomplish one or more of the four TANF purposes and should not be considered unallowable. The criteria cited do not indicate any requirement to recoup funds within a specific time frame and the exceptions noted demonstrate the effective internal controls rather than indicate any misuse of funds. Contact: Anthony Pelotte, Director, Office for Family Independence, DHHS, 207-624-4104 Auditor?s Concluding Remarks: The Department?s internal controls did not identify two overpayments in OSA?s sample. The Department did identify the other two overpayments in OSA?s sample; however, for one of those overpayments, no action had been taken by the Department 14 months after the overpayment was identified. Therefore, the Department?s internal controls do not provide reasonable assurance that the Federal award is being managed in compliance with Federal statutes, regulations, and the terms and condition of the award. In accordance with 2 CFR 200.403, for a cost to be allowable under a Federal award, the costs must be reasonable and necessary for the performance of the Federal award. Overpayments made to providers or clients with Federal funds are not a necessary cost for the performance of the Federal award; therefore, OSA questions the allowability of these costs. The finding remains as stated. (State Number: 22-1111-03)

(2022-068) Title: Internal control over Income Eligibility and Verification System procedures needs improvement Prior Year Findings: See Schedule of Findings and Questioned Costs for chart/table State Department: Health and Human Services State Bureau: Office for Family Independence Federal Agency: U.S. Department of Health and Human Services Assistance Listing Title: Temporary Assistance for Needy Families (TANF) (COVID-19) Assistance Listing Number: 93.558 Federal Award Identification Number: 1901METANF, 2001METANF, 2101METANF Compliance Area: Eligibility Special tests and provisions Type of Finding: Material weakness Material noncompliance Questioned Costs: None Criteria: 2 CFR 200.303; 45 CFR 205.56 The Department must establish and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. The Department is required to comply with Federal Income Eligibility and Verification System (IEVS) exchange rules and regulations in accordance with program agreements. The Department is required to resolve all discrepancies identified through IEVS reports within 45 days of receipt. Condition: IEVS is used to exchange information among State and Federal agencies to verify various information needed to determine eligibility for Federal financial assistance. This information is updated in the Automated Client Eligibility System (ACES) to ensure eligibility determinations are made based on current information. IEVS generates various discrepancy reports on a weekly, monthly, and quarterly basis. The Department is required to resolve all discrepancies identified through IEVS reports within 45 days of receipt. Federal guidance over the TANF program outlines audit procedures to ensure that the State has established and implemented the required IEVS exchange for data matching and verification of such data. These procedures include testing a sample of TANF cases subject to IEVS. OSA requested a list of TANF cases subject to IEVS for testing purposes; in response, the Department provided OSA with all IEVS discrepancy reports run in fiscal year 2022. The reports provided by the Department contain cases for TANF, SNAP, and Medicaid/Medicare, and do not have a specific Federal program indicator. The Department was unable to provide OSA with a report that isolates TANF-specific cases subject to IEVS. Without a population of TANF-specific cases, OSA is unable to verify that the program is in compliance with Federal requirements. Context: Approximately 195 IEVS reports are required to be generated annually. The number of discrepancies on each report can vary from zero to almost 20,000. The Department cannot determine the number of discrepancies related to TANF. Cause: ? Lack of resources ? Lack of adequate procedures to ensure that an accurate report of TANF cases subject to IEVS can be provided Effect: ? IEVS information may not be updated timely in ACES, which could result in incorrect eligibility determinations. ? Failure to maintain documentation to support compliance with required TANF exchange rules may result in the U.S. Department of Health and Human Services penalizing the State up to two percent of the grant award. Recommendation: We recommend that the Department establish procedures to ensure IEVS discrepancy reports can be provided for the identified Federal award program so that audit procedures can be performed in accordance with Federal regulations. Corrective Action Plan: See F-25 Management?s Response: The Department disagrees with this finding. The Office for Family Independence (OFI) has conducted the required IEVS eligibility verifications. Additionally, sufficient evidence of these efforts has been provided to the Office of the State Auditor so that audit procedures can be performed in accordance with Federal regulations. OFI utilizes the Federally provided IEVS system which integrates the three named population groups (Medicaid, SNAP, TANF). The IEVS discrepancy reports have not contained Federal program indicators since program inception over 20 years ago. This is consistent with the methodology utilized by the Social Security Administration, as they too group the OFI programs together in their discrepancy reports. These same reports have been provided for prior Single Audits without being considered an exception condition. Upon request, the Department provided OSA: 1. All IEVS discrepancy reports for State fiscal year 2022, containing cases for Medicaid, SNAP, and TANF. 2. A complete listing of all TANF cases subject to IEVS in State fiscal year 2022. 3. Access to our Automated Client Eligibility System, which documents all IEVS related case notes. Contact: Anthony Pelotte, Director, Office for Family Independence, DHHS, 207-624-4104 Auditor?s Concluding Remarks: As stated in the Condition, Federal guidance requires OSA to develop audit procedures in order to test a sample of TANF cases subject to IEVS. In an internal control meeting on January 9, 2023, between OSA and OFI, OFI management raised concerns regarding IEVS exceptions noted in finding 2021-043 in the fiscal year ending June 30, 2021 Single Audit Report. Management asserted that the exceptions listed in the finding were not TANF-specific as they related mainly to Medicaid and SNAP. In addition, in accordance with Federal guidelines, Assistance Listing Number 93.558, OSA is required to test a sample of TANF cases subject to IEVS in order to meet audit requirements. OSA requested a population of TANF cases subject to IEVS in order to draw a sample for testing purposes. OFI did not provide the information requested and therefore, OSA was unable to test compliance with 45 CFR 205.56. In response to the materials provided to OSA by OFI: 1. ?All IEVS discrepancy reports for State fiscal year 2022, containing cases for Medicaid, SNAP, and TANF.? The IEVS discrepancy reports provided by the Department contain cases for Medicaid, SNAP, and TANF, and do not have a specific Federal program indicator to delineate TANF-specific cases. OFI further informed OSA that they did not have the current bandwidth to manually cross-walk the complete list of all TANF eligible recipients against the IEVS discrepancy reports to identify TANF-only cases. OFI insisted that OSA perform the task. Suggesting that OSA crosswalk information to prepare a population for audit testing would impair auditor independence. Auditor independence is defined in Government Auditing Standards issued by the Comptroller General of the United States. Therefore, the reports provided cannot be utilized for audit testing. 2. ?A complete listing of all TANF cases subject to IEVS in State fiscal year 2022.? This list includes all TANF eligible clients for fiscal year 2022 subject to IEVS; however, not all TANF eligible clients will show up on an IEVS discrepancy report. Therefore, this listing cannot be utilized for audit testing. 3. ?Access to our Automated Client Eligibility System, which documents all IEVS related case notes.? This provides OSA with access to ACES for audit testing purposes. As noted above, OSA was not provided the information requested in order to complete audit testing. Therefore, as detailed in the finding, the Department cannot provide OSA with an accurate population in order to test compliance with 45 CFR 205.56. The finding remains as stated. (State Number: 22-1111-02)

(2022-069) Title: Internal control over subrecipient cash management needs improvement Prior Year Findings: See Schedule of Findings and Questioned Costs for chart/table State Department: Health and Human Services State Bureau: Division of Contract Management Federal Agency: U.S. Department of Health and Human Services U.S. Department of Agriculture Assistance Listing Title: Temporary Assistance for Needy Families (TANF) (COVID-19) Special Supplemental Nutrition Program for Women, Infants, and Children (WIC) (COVID-19) Immunization Cooperative Agreements (COVID-19) Assistance Listing Number: 93.558; 10.557; 93.268 Federal Award Identification Number: 1901METANF, 2001METANF, 2101METANF; 194ME743W5003, 204ME743W5003, 214ME743W5003, 224ME743W5003, 228ME000M2003, 214ME701W1003, 214ME701W1006, 224ME701W1003, 224ME701W1006, 214ME721W6003, 214ME721W6006, 214ME752W7003; NH23IP922604 Compliance Area: Cash management Subrecipient monitoring Type of Finding: Material weakness Material noncompliance Questioned Costs: None Criteria: 2 CFR 200.303; 2 CFR 200.305 The Department must establish and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. The Department is required to monitor cash drawdowns by their subrecipients to ensure that the time elapsing between the payment of Federal funds to the subrecipient and the subrecipient?s actual disbursement for program purposes is minimized. Condition: The Department did not monitor subrecipients to ensure they were drawing Federal funds in accordance with cash management requirements. For cost-settled subawards, Department procedures include making equal advance monthly payments and then reconciling those amounts to the quarterly financial reports submitted by the subrecipient. This procedure does not take into consideration the time elapsing between the payment of Federal funds to the subrecipient and the subrecipient?s actual disbursement for program purposes. For ?cost-settled by invoice? (reimbursement) subawards, Department procedures do not require obtaining documentation to support the monthly invoices submitted by the subrecipient for costs that were already paid by the subrecipient, thus verifying it was for reimbursement and not advance payment. Context: In fiscal year 2022, the Department provided: ? $17.9 million to subrecipients from TANF grant funds of $81.9 million. TANF?s subawards are either cost-settled, cost-settled by invoice, or fee for service. ? $3.6 million to subrecipients from WIC grant funds of $15 million. All of WIC?s subawards are cost-settled. ? $2.5 million to subrecipients from Immunization Cooperative Agreements grant funds of $23 million. Immunization Cooperative Agreement?s subawards are either cost-settled or cost-settled by invoice. Cause: ? Misinterpretation of Federal regulations. 2 CFR 200.305(b)(1) references that the timing and amount of advance payments must be as close as is administratively feasible to the actual disbursements by the non-Federal entity. The Department interpreted this Federal requirement to mean it applied to the State; however, the requirement is directed towards non-Federal entities other than states. ? Lack of adequate subrecipient monitoring procedures. In addition to monitoring the total amount paid to subrecipients, the Department is required to monitor the timing between when the subrecipient receives Federal funds from the Department and when the subrecipient disburses those funds for program purposes. Effect: ? Noncompliance with subrecipient cash management requirements ? Federal programs may not be effectively and efficiently administered. ? The Federal government may require the implementation of more stringent subrecipient cash management procedures. Recommendation: We recommend that the Department implement monitoring procedures to ensure that: ? the time elapsing between the payment of Federal funds to the subrecipient and the subrecipient?s actual disbursement for program purposes is minimized for cost-settled subawards. ? the payment of Federal funds to the subrecipient is for reimbursement purposes, and not for advance payment, for ?cost-settled by invoice? subawards. Corrective Action Plan: See F-25 Management?s Response: The Department disagrees with this finding. The Department reviews budgeted expenses to determine their timing and nature (one time, recurring, allowability); reviews quarterly expense reports and alters payments to meet immediate cash needs, and finally, monitors subrecipient single audits to ensure there are no cash management findings. The Department?s approach is administratively reasonable and does minimize the time elapsing between the payment of Federal funds to the subrecipient and the subrecipient?s actual disbursement for program purposes given administrative and operational needs. We believe we have procedures in place that can be corroborated by the fact that our subrecipients do not receive single audit findings related to cash management. Contact: Jim Lopatosky, Director, Division of Contract Management, DHHS, 207-287-5075 Auditor?s Concluding Remarks: The subrecipient monitoring procedures outlined in Management?s Response do not ensure that subrecipients are drawing funds in accordance with Federal cash management requirements, as follows: ? Reviewing budgeted expenses is not monitoring the subrecipient?s compliance with cash management requirements as the subrecipient has not disbursed the funds yet. ? The Department does not obtain documentation to support the timing of the subrecipient?s expenditures reported on the quarterly expense reports and to substantiate compliance. ? Though reviewing the subrecipient?s Single Audits for findings is beneficial: o the Single Audit is usually completed towards the end or after the grant award period. o it is not guaranteed that cash management will be selected for testing by the subrecipient?s auditor; therefore, relying on the subrecipient?s auditor to discover cash management issues is not an adequate procedure to monitor the subrecipient?s compliance with that requirement. Therefore, the Department was noncompliant with Federal regulation 2 CFR 200.305 that requires monitoring cash drawdowns of subrecipients to ensure that the time elapsing between the payment of Federal funds to the subrecipient and the subrecipient?s actual disbursement for program purposes is minimized. The finding remains as stated. (State Number: 22-1111-04)

(2022-070) Title: Internal control over TANF client child support sanction procedures needs improvement Prior Year Findings: See Schedule of Findings and Questioned Costs for chart/table State Department: Health and Human Services State Bureau: Office for Family Independence Federal Agency: U.S. Department of Health and Human Services Assistance Listing Title: Temporary Assistance for Needy Families (TANF) (COVID-19) Assistance Listing Number: 93.558 Federal Award Identification Number: 1901METANF, 2001METANF, 2101METANF Compliance Area: Special tests and provisions Type of Finding: Material weakness Material noncompliance Questioned Costs: None Criteria: 2 CFR 200.303; 45 CFR 264.30; 42 USC 608(a)(2) The Department must establish and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. If the Department determines that an individual is not cooperating with child support enforcement requirements, the Department is required to sanction the individual by deducting an amount equal to not less than 25 percent from the TANF assistance that would otherwise be provided to the family of the individual and may deny the family any TANF assistance. Condition: The Department?s Division of Support Enforcement and Recovery (DSER) is responsible for enforcing child support requirements. DSER sends email notifications (sanction requests) to TANF personnel when individuals not cooperating with child support enforcement requirements are identified. If TANF personnel determine that the individual needs to be sanctioned after reviewing the individual?s case, they will process the sanction request in the Automated Client Eligibility System (ACES). Federal guidance requires the Office of the State Auditor (OSA) to develop audit procedures in order to test a sample of cases referred to TANF by DSER. OSA requested a list of sanction requests from DSER for testing purposes. In response to this request, the Department provided 960 email notifications relating to child support sanction requests. OSA selected a random sample of 60 emails from the population for testing and determined the following: ? 35 emails were DSER requests to lift prior sanctions imposed. OSA was unable to determine if the sanction was requested and referred during the fiscal year. ? One email requested a child support affidavit which is not related to child support sanctions. ? One email contained a disability determination review application which is not related to child support sanctions. ? One email requested a child support sanction but omitted client identification information required to process the request. Therefore, OSA was unable to test compliance with sanction requirements for 38 of the 60 emails sampled from the population of sanction requests provided by the Department. OSA selected a non-statistical random sample. Context: DSER personnel transmit sanction requests through email to a general inbox that receives other notifications and collects approximately 400 emails per day. The sanction requests are then forwarded by a designated supervisor to the appropriate TANF personnel to be processed in ACES. Cause: ? Lack of resources. The Department is unable to obtain a complete listing of sanction requests from DSER without dedicating a significant amount of time and resources sorting through the general email inbox. ? Lack of supervisory oversight Effect: ? Noncompliant clients may be paid benefits that they are not entitled to receive. ? Failure to maintain appropriate documentation to demonstrate compliance with Federal program sanction requirements may result in the U.S. Department of Health and Human Services penalizing the State for up to five percent of the grant award. Recommendation: We recommend that the Department establish procedures to ensure that all sanction requests are maintained in a central repository so that they can be easily retrieved for tracking and review purposes. We further recommend that the Department increase oversight to ensure compliance with Federal requirements. Corrective Action Plan: See F-25 Management?s Response: The Department disagrees with this finding. The Office for Family Independence (OFI) has sufficient internal controls in place to ensure compliance with Federal requirements. Specifically, based on the finding?s stated condition, OSA did not take exception with the 22 items that were actually tested for compliance. Additionally, OFI has provided sufficient information for OSA to identify and conduct the audit and compliance testing of cases referred by DSER for sanction. The Department has provided OSA with the following material as requested: 1. The list of all sanction referrals generated by OFI-DSER, the Title IV-D agency. 2. The list of all OFI-TANF clients actually sanctioned by TANF Eligibility. 3. The list of all OFI-TANF clients 4. Copies of all emails pertaining to all sanction activity 5. Access to our Automated Client Eligibility System which includes all documented case notes. Contact: Anthony Pelotte, Director, Office for Family Independence, DHHS, 207-624-4104 Auditor?s Concluding Remarks: As stated in the Condition, Federal guidance requires OSA to develop audit procedures in order to test a sample of cases referred to TANF by the Title IV-D agency, DSER. In an internal control meeting held on January 11, 2023, between OSA and the Department, the Department identified the control process over sanction requests used by DSER staff after non- compliance by a Custodial Parent (CP) as an email generated by DSER staff that is sent to a general email box at OFI with the subject line of ?Sanction Request?. The Department established that the referral email alerts OFI Eligibility Specialists to the issue and requests OFI to sanction the CP. OSA requested the population of these emails in order to draw a sample for audit testing and was provided a listing of 960 emails from which OSA selected a random sample. OSA tested compliance with sanction requests from the random sample. As a result of this testing, OSA agrees that the population provided by the Department was incorrect. In response to the materials provided to OSA by the Department: 1. ?The list of all sanction referrals generated by OFI-DSER, the Title IV-D agency.? This list was generated based on noncooperation dates entered in the Child Support Enforcement of Maine (CSEME) system; however, the Department confirmed that noncooperation dates are not consistently entered into CSEME by DSER personnel. Therefore, this list cannot be relied upon. 2. ?The list of all OFI-TANF clients actually sanctioned by TANF Eligibility.? This list documents sanction requests that were processed by OFI Eligibility. The list omits requests where OFI eligibility determined a sanction request was not required. Therefore, this list cannot be relied upon. 3. ?The list of all OFI-TANF clients.? This list includes all TANF eligible clients for fiscal year 2022; however, not all TANF eligible clients are sanctioned for child support noncooperation. Therefore, this list cannot be relied upon. 4. ?Copies of all emails pertaining to all sanction activity.? The Department provided OSA with 960 emails that were both sanction and non-sanction related. Suggesting that OSA categorize emails to delineate sanction requests versus other emails in order to prepare a population for audit testing would impair auditor independence. Auditor independence is defined in Government Auditing Standards issued by the Comptroller General of the United States. Therefore, as noted above, this list cannot be relied upon. 5. ?Access to our Automated Client Eligibility System (ACES) which includes all documented case notes.? This provides OSA with access to ACES for audit testing purposes which OSA completed based on the information provided by the Department. Therefore, as detailed in this finding, the Department cannot provide OSA with an accurate population in order to test compliance with 45 CFR 264.30. The finding remains as stated. (State Number: 22-1111-01)

(2022-071) Title: Internal control over TANF subrecipient risk evaluation procedures needs improvement Prior Year Findings: See Schedule of Findings and Questioned Costs for chart/table State Department: Health and Human Services State Bureau: Office for Family Independence Office of Child and Family Services Division of Contract Management Division of Audit Federal Agency: U.S. Department of Health and Human Services Assistance Listing Title: Temporary Assistance for Needy Families (TANF) (COVID-19) Assistance Listing Number: 93.558 Federal Award Identification Number: 1901METANF, 2001METANF, 2101METANF Compliance Area: Subrecipient monitoring Type of Finding: Material weakness Material noncompliance Questioned Costs: None Criteria: 2 CFR 200.303; 2 CFR 200.332 The Department must establish and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. The Department is required to evaluate each subrecipient?s risk of noncompliance with Federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate subrecipient monitoring described in 2 CFR 200.332. Condition: The Department has established subrecipient monitoring procedures depending on whether the subaward is competitively bid or not. If a subaward is competitively bid, the Department seeks input from the Department of Health and Human Services Service Center, and the Department?s Division of Audit and Division of Contract Management regarding known issues with the provider who submitted the bid. Those responses are collected and provided to the evaluation team which consists of various program personnel. The subaward agreement is then drafted and the level of subrecipient monitoring is included in the agreement. If a subaward is not competitively bid, the subaward agreement is drafted based on the level of subrecipient monitoring that the Department has established for the provided services. The Office of the State Auditor (OSA) selected seven TANF subrecipients for testing and found: ? one subrecipient competitively bid on the subaward. The Department was able to provide evidence to support that feedback was solicited from other Bureaus for any known issues or prior noncompliance; however, documentary evidence could not be provided to support the level of subrecipient monitoring that was completed. ? six subrecipients did not competitively bid on the subaward. For those six subrecipients, no documentary evidence could be provided to support the level of subrecipient monitoring that was completed. OSA selected a non-statistical random sample. Context: The Department provided $17.9 million to TANF subrecipients during fiscal year 2022. Cause: Lack of adequate policies and procedures Effect: ? Without a documented process, subrecipient risk evaluation procedures may not be consistently followed, and documentation may not be adequately maintained. ? Subrecipients that are deemed higher risk may not be monitored on a more frequent basis. Conversely, subrecipients that are deemed lower risk may not be monitored on a less frequent basis, which would free resources and time to dedicate towards other higher risk subrecipients. Recommendation: We recommend that the Department: ? document procedures that outline the collaborative process with all Bureaus. ? implement policies and procedures that require evaluation of each subrecipient?s risk of noncompliance specifically for the purposes of determining the appropriate subrecipient monitoring to be performed. This will ensure subrecipients are monitored appropriately based on risk designation. Corrective Action Plan: See F-26 Management?s Response: The Department disagrees with this finding. The Department has subrecipient monitoring procedures for all of its subrecipients whether they were competitively bid or not. The first assessment of risk, as noted in the finding, is when a subaward is competitively bid. Secondly, another risk assessment built into the Maine Uniform Accounting and Auditing Practices for Community Agencies (MAAP) in which requires higher risk subrecipients to undergo a higher level of testing. Additionally, there are audit and review requirements at a much lower threshold than that of the Uniform Guidance (UG). Finally, the Social Service Unit of the Division of Audit performs a risk assessment and tests transactions for those subrecipients that have been determined to be higher risk. The Department?s subrecipient monitoring procedures ensures that we comply with the UG 200.332(d) Pass-through entity (PTE) monitoring of the subrecipient must include: 1) Review of financial and performance reports. 2) Following-up and ensuring that subrecipients take timely and appropriate action on all deficiencies. 3) Issues management decisions. 4) PTE is responsible for resolving audit findings specifically related to the subaward. Based on the Department?s MAAP rules we ensure we comply with UG 200.332(e). Depending on the PTE?s assessment of risk, the following tools may be useful: 1) Training and technical assistance. 2) On-site reviews. 3) Arranging for agreed upon procedures. The Department covers #3 by ensuring that all of our subrecipients have a requirement to submit to the Department a/an Audit, Review or Schedule of Expenditures of Department Awards (SEDA). Contact: Jim Lopatosky, Director, Division of Contract Management, DHHS, 207-287-5075 Auditor?s Concluding Remarks: The Department has misinterpreted the Federal regulation cited in this finding. The Department has responded to 2 CFR 200.332(d), which identifies monitoring procedures to be conducted during the subrecipient award period. OSA audited compliance with this during-the-award monitoring requirement and did not identify deficiencies. The Federal regulation that the Department failed to meet is 2 CFR 200.332(b). This regulation identifies procedures to be performed prior to monitoring procedures in order to determine the level of monitoring required for each subrecipient. 2 CFR 200.332(b) states that the Department must evaluate each subrecipient?s risk of noncompliance with Federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate subrecipient monitoring, which may include consideration of factors such as: ? the subrecipient?s prior experience with the same or similar subawards; ? the results of previous audits including whether or not the subrecipient receives a Single Audit, and the extent to which the same or similar subaward has been audited as a major program; ? whether the subrecipient has new personnel or new or substantially changed systems; and ? the extent and results of Federal awarding agency monitoring. The Department did not provide any documentation to support that monitoring procedures performed were based on an evaluation of the subrecipient?s risk of noncompliance. The finding remains as stated. (State Number: 22-1111-05)

(2022-072) Title: Internal control over special reporting needs improvement Prior Year Findings: See Schedule of Findings and Questioned Costs for chart/table State Department: Health and Human Services State Bureau: Division of Contract Management Federal Agency: U.S. Department of Health and Human Services U.S. Department of Agriculture Assistance Listing Title: Temporary Assistance for Needy Families (TANF) (COVID-19) Epidemiology and Laboratory Capacity for Infectious Diseases (ELC) (COVID-19) Immunization Cooperative Agreements (COVID-19) Special Supplemental Nutrition Program for Women, Infants, and Children (WIC) (COVID-19) Assistance Listing Number: 93.558; 93.323; 93.268; 10.557 Federal Award Identification Number: 1901METANF, 2001METANF, 2101METANF; NU50CK000523; NH23IP922604; 194ME743W5003, 204ME743W5003, 214ME743W5003, 224ME743W5003, 214ME701W1003, 214ME701W1006, 224ME701W1003, 224ME701W1006, 214ME721W6003, 214ME721W6006, 214ME752W7003, 228ME000M2003 Compliance Area: Reporting Type of Finding: Material weakness Material noncompliance Questioned Costs: None Criteria: 2 CFR 200.303; 2 CFR 170 The Department must establish and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. Agencies must report each subaward that equals or exceeds the first-tier subaward threshold of $30,000 in Federal funds in the public-facing Federal Funding Accountability and Transparency Act (FFATA) Subaward Reporting System. Condition: When an amount exceeding the first-tier subaward threshold is awarded to a subrecipient, the Department must collect and enter data into the FFATA Subaward Reporting System. The Department erroneously reported subaward data in the FFATA Subaward Reporting System based on individual Federal Award Identification Numbers (FAIN) within subawards; however, the required reporting threshold should have been based on the obligating action represented by the subaward. There can be numerous FAINs within one subaward. Additionally, the Department could not provide evidence that any of the FFATA reports were reviewed prior to submission in the FFATA Subaward Reporting System to ensure the information entered was accurate and complete. Context: During fiscal year 2022, the Department disbursed $35.3 million in first-tier subawards to 75 subrecipients from the TANF, ELC, Immunization Cooperative Agreements, and WIC programs. Of the 75 subrecipients, 62 subrecipients received subawards exceeding the first-tier subaward threshold. These 62 subawards totaled $35.1 million in fiscal year 2022. Cause: ? Misinterpretation of Federal regulations ? Lack of adequate policies and procedures ? Lack of supervisory review Effect: ? Inaccurate, incomplete, and untimely information was and may continue to be reported to the Federal government. This information may be used for programmatic, policy, or statistical purposes. ? Noncompliance with Federal regulations Recommendation: We recommend that the Department implement policies and procedures to ensure all subawards that meet or exceed the first-tier subaward threshold are reported accurately, timely, and in accordance with Federal regulations. We further recommend that the Department retain documentation of supervisory review for each FFATA report submitted in the FFATA Subaward Reporting System. Corrective Action Plan: See F-26 Management?s Response: The Department agrees with this finding. The Department implemented the corrective action plan from FY21, and it is currently in place. In summary, the Department revised the standard operating procedure and improved the technology to ensure data accuracy and added a layer of review to ensure accuracy of the FFATA reporting. This was finalized in November of 2022. Contact: Jim Lopatosky, Director, Division of Contract Management, DHHS, 207-287-5075 (State Number: 22-1100-01)

(2022-073) Title: Internal control over TANF reporting needs improvement Prior Year Findings: None State Department: Administrative and Financial Services State Bureau: Health and Human Services Service Center Federal Agency: U.S. Department of Health and Human Services Assistance Listing Title: Temporary Assistance for Needy Families (TANF) (COVID-19) Assistance Listing Number: 93.558 Federal Award Identification Number: 1901METANF, 2001METANF, 2101METANF Compliance Area: Reporting Type of Finding: Material weakness Material noncompliance Questioned Costs: None Criteria: 2 CFR 200.303; 2 CFR 200.302(b) The Department must establish and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. The Department must maintain accurate, current, and complete disclosure of the financial results of each Federal award or program in accordance with reporting requirements. Condition: The Department is required to submit accurate and complete financial reports to the Federal government. On the SF-425 financial report for the period ending December 31, 2021, cumulative Federal cash disbursements should have been reported in the amount of $54,898,345 instead of $32,885,310. Context: TANF program expenditures totaled $81.9 million in fiscal year 2022. Cause: Lack of supervisory oversight Effect: Noncompliance with Federal reporting requirements Recommendation: Although TANF is no longer required by the Federal government to submit SF-425 reports beginning with the period ending March 31, 2022, we recommend that the Department enhance their review procedures to ensure all financial reports are accurate and complete. Corrective Action Plan: See F-27 Management?s Response: The DHHS and the DHHS Financial Service Center agree with this finding. Effective April 1, 2022, the US Department of Health and Human Services grant recipients are no longer required to complete the quarterly Federal Cash Transaction Report ?FCTR? (also referred to as the FFR-425 or SF-425) to report cumulative Federal cash disbursements. Procedures are currently in place to ensure Federal financial reporting is reviewed accurately. Contact: Sarah Gove, Director, DHHS Service Center, DAFS, 207-458-6626 (State Number: 22-1100-03)

(2022-074) Confidential finding, see below for more information Title: over the needs improvement Pursuant to paragraph 6.63 of the U.S. Government Accountability Office?s Government Auditing Standards (also known as the Yellow Book), we omitted details from this finding as they are confidential under the provisions of 5 MRSA 244-C (3). Though the content of this finding has been redacted, we provided the Department(s) with detailed information regarding the specific condition we identified, as well as the related criteria, context, causes, effects, and our specific recommendations for improvement. Prior Year Findings: See Schedule of Findings and Questioned Costs for chart/table Type of Finding: Material weakness Corrective Action Plan: See F-27 Contact: Shirley Browne, Deputy State Controller, Office of the State Controller, 207-626-8423 (State Number: 22-0905-03)

(2022-075) Title: Internal control over TANF performance reporting and work participation procedures needs improvement Prior Year Findings: See Schedule of Findings and Questioned Costs for chart/table State Department: Health and Human Services State Bureau: Office for Family Independence Federal Agency: U.S. Department of Health and Human Services Assistance Listing Title: Temporary Assistance for Needy Families (TANF) (COVID-19) Assistance Listing Number: 93.558 Federal Award Identification Number: 1901METANF, 2001METANF, 2101METANF Compliance Area: Reporting Special tests and provisions Type of Finding: Significant deficiency Questioned Costs: None Criteria: 2 CFR 200.303; 45 CFR 261.60 through .62; 45 CFR 265.7 and .8 The Department must establish and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. The Department must maintain adequate documentation, perform adequate verification, and implement other control procedures for TANF client work participation. Work participation activities include unsubsidized employment, job search and job readiness, job skills training directly related to employment, vocational education, and other work-related programs. The Department must report the actual hours that a work-eligible TANF client participates in these work-related activities, on the ACF-199 TANF Data Report and the ACF-209 SSP-MOE Data Report on a quarterly basis. These reports are required by the Federal government. Condition: The Department reported incorrect work participation information on the ACF-199 and ACF-209 reports. Of the 120 clients tested, inaccurate work participation data was reported for 14 clients, including inaccurate: ? subsidized childcare, ? countable months towards the Federal time limit of 60 months, ? work participation status, ? unsubsidized employment hours, ? and vocational education training hours The Office of the State Auditor selected a non-statistical random sample. Context: The Department must maintain adequate documentation, verification, and internal control procedures to ensure the accuracy of information reported to the Federal government and used to calculate work participation rates. In fiscal year 2022, the number of clients reported on the ACF-199 report ranged from approximately 11,000 to 13,000 clients, and the number of clients reported on the ACF-209 report ranged from approximately 36,000 to 38,000 clients. Cause: ? Lack of adequate procedures to ensure work participation data is accurately reflected in the Automated Client Eligibility System (ACES) and Fedcap Customer Assistance for Re- employment and Economic Support (FedcapCARES) case management system, and reported correctly in the quarterly Federal performance reports ? Lack of supervisory oversight Effect: ? Incorrect work participation data reported to the Federal government may affect the Federal requirement for TANF?s State Maintenance of Effort. ? The Federal government may penalize the State by an amount not less than one percent and not more than five percent of the grant award for violation of work verification plan requirements. Recommendation: We recommend that the Department enhance existing procedures to ensure that the information reported on the ACF-199 and ACF-209 reports is accurate and complete prior to submission to the Federal government. This should include increased systemic monitoring to improve the reliability of work participation data that is reported to the Federal government. Corrective Action Plan: See F-27 Management?s Response: The Department agrees with this finding. The Department acknowledges eight of the fourteen cases cited as containing errors. Significant improvements have been made to the systemic monitoring of the ACF-199 and ACF-209 reports as evidenced by recent edits to the standard operating procedures governing this system in February and May of 2022. Due to the nature of corrective action plans, and the timing of the state audit, the Department does not believe a corrective action plan is warranted at this time. Contact: Anthony Pelotte, Director, Office for Family Independence, DHHS, 207-624-4104 (State Number: 22-1111-06)

(2022-076) Title: Internal control over TANF subrecipient audit procedures needs improvement Prior Year Findings: See Schedule of Findings and Questioned Costs for chart/table State Department: Health and Human Services State Bureau: Division of Audit Federal Agency: U.S. Department of Health and Human Services Assistance Listing Title: Temporary Assistance for Needy Families (TANF) (COVID-19) Assistance Listing Number: 93.558 Federal Award Identification Number: 1901METANF, 2001METANF, 2101METANF Compliance Area: Subrecipient monitoring Type of Finding: Significant deficiency Questioned Costs: None Criteria: 2 CFR 200.303; 2 CFR 200.332 The Department must establish and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. When a subrecipient?s Federal award expenditures are expected to equal or exceed $750,000 during the fiscal year, the Department must verify that the subrecipient is audited. Condition: The Department requires subrecipients to submit their Single Audit to the Department?s Division of Audit. The Division maintains a database to track when subrecipient Single Audit reports are due and ensures that they are received. The Office of the State Auditor (OSA) tested four TANF subrecipients that had a Single Audit due in fiscal year 2022 for compliance with Federal regulations and found that the Division did not obtain the Single Audit for one subrecipient. The Division could not provide documentation to support that they contacted the subrecipient when the Single Audit was late. OSA was able to confirm that the subrecipient did have a Single Audit as required. Context: A Single Audit was due in fiscal year 2022 for eight TANF subrecipients that received $28.2 million of Federal funds in fiscal year 2021. Cause: ? Lack of adequate procedures ? Lack of supervisory oversight Effect: Noncompliance with Federal regulations Recommendation: We recommend that the Department enhance existing procedures to ensure that subrecipients that expend $750,000 or more in Federal awards complete and submit a Single Audit within the required time requirements. Corrective Action Plan: See F-27 Management?s Response: The Department agrees with this finding. We will revise our standard operating procedures (SOP) to include the search for out of state subrecipients on the Federal Audit Clearinghouse. Contact: Herb Downs, Director, Division of Audit, DHHS, 207-287-2778 (State Number: 22-1100-02)

(2022-077) Title: Internal control over Child Support Enforcement expenditures needs improvement Prior Year Findings: None State Department: Administrative and Financial Services State Bureau: Health and Human Services Service Center Federal Agency: U.S. Department of Health and Human Services Assistance Listing Title: Child Support Enforcement Assistance Listing Number: 93.563 Federal Award Identification Number: 2001MECSES, 2101MECSES, 2201MECSES Compliance Area: Activities allowed or unallowed Allowable costs/cost principles Type of Finding: Significant deficiency Questioned Costs: None Criteria: 2 CFR 200.303; 2 CFR 200.302; 2 CFR 200.403; Cooperative Agreement Between State of Maine DHHS and Maine State Judicial Branch for State Fiscal Years 2022 and 2023, Section V (b)(1) The Department must establish and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. Costs must be adequately documented. The State?s financial management systems, including records documenting compliance with Federal statutes, regulations, and the terms and conditions of the Federal award, must be sufficient to determine that such funds have been used in accordance with Federal statutes, regulations, and the terms and conditions of the Federal award. Except where otherwise authorized by statute, costs must conform to any limitations or exclusions set forth in cost principles or in the Federal award as to types or amount of cost items. The Administrative Office of the Courts (AOC) under the Judicial Branch must provide a report to the Department of Health and Human Services? (DHHS) Division of Support and Recovery (DSER) for all Judicial Branch estimated expenditures. This report must detail costs that are eligible for Federal financial participation and must be provided within 35 calendar days after the close of the quarters ending in March, June, September, and December. These estimated expenditures are calculated using the per minute rate that was in effect for the prior fiscal year. Within 35 days after the close of the State fiscal year, the AOC will update the per minute rate and provide DSER a report with actual expenditures for the State fiscal year. Condition: The Child Support Enforcement (CSE) program is administered by DSER within DHHS. DHHS has a cooperative agreement with AOC that defines roles, relationships, and responsibilities of the parties, and sets forth a basis for financial reimbursement for court services provided to DHHS by AOC. These services include conducting paternity hearings; hearings to establish, modify, or enforce support orders; civil and criminal complaint hearings related to CSE; providing mediation services; and conducting proceedings related to income withholding responsibilities. AOC sends monthly invoices to the DHHS Service Center (DHHS SC) with estimated costs for work performed for the CSE program. DHHS SC is responsible for transferring funds from the CSE program to AOC. On a quarterly basis, AOC provides DHHS SC with a reconciliation of estimated costs to actual costs. This quarterly reconciliation utilizes the per minute rate that was in effect for the prior fiscal year and is due 35 days after the close of the quarter. Annually, the per minute rate is updated and AOC provides DHHS SC with a final report of actual costs with the updated per minute rate. This final report is due within 35 days after the close of the fiscal year. The Office of the State Auditor (OSA) selected six transfers from DHHS SC to AOC for testing and found that costs incurred for court services were not adequately supported. DHHS SC did not receive two quarterly reports from AOC; therefore, court expenditures were based on estimated costs rather than actual costs. Furthermore, the annual report and reconciliation of estimated costs to actual costs was not completed until five months after the fiscal year end. As a result, expenditure amounts reported by the CSE program are not based on actual costs. OSA reviewed the annual reconciliation and determined that the variance is not material to the program. OSA selected a non-statistical random sample. Context: The CSE program expended $18.8 million in Federal funds during fiscal year 2022, of which $2.2 million was used for court services. Cause: Management override of controls. The program elected to defer reconciling estimated costs to actual costs until the per minute rate was updated by AOC. Effect: CSE program expenditures for fiscal year 2022, specifically relating to AOC expenditures, were understated by the amount included in the annual reconciling invoice for AOC. Recommendation: We recommend that the Department enhance oversight of established procedures to ensure that CSE is in compliance with Federal regulations. Corrective Action Plan: See F-27 Management?s Response: The Department agrees with this finding. The Division of Support Enforcement and Recovery and the Judicial Branch will modify the language of the cooperative agreement to clarify that all allowable costs subject to federal financial participation are adequately and timely documented. Contact: Jerry Joy, Director, Division of Support Enforcement and Recovery, DHHS, 207-624-6985 (State Number: 22-1128-02)

(2022-078) Confidential finding, see below for more information Title: over and needs improvement Pursuant to paragraph 6.63 of the U.S. Government Accountability Office?s Government Auditing Standards (also known as the Yellow Book), we omitted details from this finding as they are confidential under the provisions of 5 MRSA 244-C (3). Though the content of this finding has been redacted, we provided the Department(s) with detailed information regarding the specific condition we identified, as well as the related criteria, context, causes, effects, and our specific recommendations for improvement. Prior Year Findings: None Type of Finding: Material weakness Corrective Action Plan: See F-28 Contact: Shirley Browne, Deputy State Controller, Office of the State Controller, 207-626-8423 (State Number: 22-0906-03)

(2022-079) Title: Internal control over the CCDF Cluster eligibility determination process needs improvement Prior Year Findings: None State Department: Health and Human Services State Bureau: Office of Child and Family Services Federal Agency: U.S. Department of Health and Human Services Assistance Listing Title: CCDF Cluster (COVID-19) Assistance Listing Number: 93.489, 93.575, 93.596 Federal Award Identification Number: 2101MECCDF, 2001MECCDF, 2101MECCC5, 2001MECCC3, 2101MECDC6, 2101MECSC6 Compliance Area: Allowable costs/cost principles Eligibility Type of Finding: Significant deficiency Questioned Costs: None Criteria: 2 CFR 200.303 The Department must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the Department is managing the award in compliance with Federal statutes, regulations, and the terms and conditions of the award. Condition: The Child Care and Development Fund (CCDF) provides child-care benefits to parents based on financial and program eligibility factors. Eligibility for benefits is determined based on application information from families that is manually entered into the Maine Automated Child Welfare Information System (MACWIS) by Department personnel. Once the application information has been entered, computerized eligibility determinations are processed through MACWIS. There is no secondary review of manually entered application information prior to initiation of computerized eligibility determinations. The Department does not have a process in place to ensure information entered into MACWIS is accurate and in agreement with paper application information prior to eligibility determinations and resulting benefit payments. While the Department does have subsequent monitoring procedures in place, this does not prevent the potential utilization of inaccurate information for eligibility determination. Context: In fiscal year 2022, the Department processed 6,862 family applications and provided $46.3 million in benefits under programs within the CCDF Cluster. Cause: ? Lack of adequate policies and procedures ? Lack of supervisory oversight Effect: Inaccurate information manually entered into MACWIS could result in individuals not eligible for services being deemed eligible or eligible individuals being deemed ineligible. Recommendation: We recommend that the Department implement policies and procedures that require a review of manually entered CCDF program application information prior to eligibility determinations. Corrective Action Plan: See F-28 Management?s Response: The Department of Health and Human Services (DHHS) management disagrees with the audit finding that the CCDF program is not meeting requirements identified in 2 CFR 200.303 Internal controls, (a). DHHS believes the current internal controls that are in place provide reasonable assurance that DHHS is managing federal funds in compliance with all regulations. Although ?reasonable? is not defined, DHHS believes it is effectively meeting the Administration for Children and Families? (ACF) expectations, as the funding source, as well as meeting the Child Care Development Fund (CCDF) grant goals and objectives. ACF approved Maine?s FFY22-24 CCDF State Plan which includes a description of OCFS? internal control activities. The potential effect or risk identified by OSA is that without implementing a secondary review of all data entry in the income field, individuals not eligible for services could be deemed eligible or eligible individuals could be deemed ineligible which would result in Improper Payments. In the last quarter of FFY 2022, the Improper Payments rate was 3.37%, well below the federal threshold of 10%. Inaccurate data entry was not noted as a significant cause of Improper Payments. Contact: Todd Landry, Director, Office of Child and Family Services, DHHS, 207-624-7900 Auditor?s Concluding Remarks: The monitoring procedures outlined in Management?s Response do not include specific controls to ensure that the information entered into MACWIS is accurate and in agreement with paper application information prior to making eligibility determinations. The risk that improper payments will be made or that benefits will be denied for families that should have been deemed eligible would be mitigated by establishing a secondary review of manually entered application information. As part of the fiscal year 2022 audit, OSA reviewed the ACF-404 State Improper Payments Report submitted in August 2021. This report identified a 14.49 percent improper payment rate in the cases reviewed. In addition, 24.64 percent of cases reviewed contained erroneous case information. In response to the significant error rates identified in the report, the Department was required to prepare and submit a comprehensive corrective action plan. As stated in the ACF-404, corrective action was initiated in October 2021; therefore, the control deficiencies existed for several months during fiscal year 2022. The improper payment rate of 3.37 percent included in Management?s Response relates to the quarter ending September 30, 2022, which was after the required corrective action and also outside of the audit period. The report submitted during the audit period, along with the required corrective action, validates the necessity for enhanced control procedures to prevent utilization of inaccurate case information in eligibility determinations. The finding remains as stated. (State Number: 22-1114-01)

(2022-080) Title: Internal control over Long Term Care Facility audits needs improvement Prior Year Findings: See Schedule of Findings and Questioned Costs for chart/table State Department: Health and Human Services State Bureau: Division of Audit Federal Agency: U.S. Department of Health and Human Services Assistance Listing Title: Medicaid Cluster (COVID-19) Assistance Listing Number: 93.775, 93.777, 93.778 Federal Award Identification Number: 2105ME5MAP, 2205ME5MAP Compliance Area: Special tests and provisions Type of Finding: Material weakness Material noncompliance Questioned Costs: None Criteria: 2 CFR 200.303; 42 CFR 447.253(g); MaineCare Benefits Manual, Chapter III, Sections 50 and 67 The Department must establish and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. The Department is required to provide for the periodic audits of the financial and statistical records of participating providers. The MaineCare Benefits Manual (MCBM) Chapter III, Sections 50 and 67 outline the documentation and support required to be included in a provider?s annual cost report filing submission to the Division of Audit. The Division of Audit?s requirements for reviewing the cost reports and performing uniform desk reviews is also outlined. Section 67 states that the Division of Audit must perform a uniform desk review on each Nursing Facility (NF) cost report submission within 365 days of receipt of an acceptable cost report filing. Condition: The Division of Audit did not issue Long Term Care Facility (LTCF) audits in accordance with Federal regulations. LTCF audits include both audits of NFs and Intermediate Care Facilities for Individuals with Intellectual Disabilities (ICF/IIDs). LTCF ? Nursing Facilities The MCBM states uniform desk reviews shall be completed within 365 days after receipt of an acceptable cost report filing, including financial statements and other information requested from the provider except in unusual situations including, but not limited to, delays in obtaining necessary information from a provider. Unless the Division of Audit intends to schedule an on- site audit or an unusual situation referenced above exists, a written summary report of findings and adjustments shall be issued upon completion of the uniform desk review. The population of NF uniform desk reviews due for issuance in fiscal year 2022 was 140. Of those 140 uniform desk reviews, one was issued timely, 49 were issued 47 to 487 days late, and 90 had not been issued at the time of audit testing. LTCF ? ICF/IIDs The MCBM requires providers to submit cost reports annually based on the facility?s fiscal year end. 42 CFR 447.253(g) states ?[the agency] must provide for the periodic audits of the financial and statistical records of participating providers.? Furthermore, 2 CFR 200.303 requires a non- Federal agency to ?establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award.? Neither 42 CFR nor the MCBM specifies a specific timeframe to complete an audit of a ICF/IID cost report. The Division of Audit has stated its understanding of the periodic requirement to be that all ICF/IID cost report audits must be completed ?at some point in time.? The Department has audit responsibilities over 16 ICF/IID facilities. The Division of Audit issued 12 audits during fiscal year 2022. Of those 12 audits, 9 were issued in under 365 days, and 3 were issued in a range of 497 to 505 days after receipt of the cost report. Context: The Department provided $316.1 million in Federal Medicaid funding and $84.5 million in State Medicaid funding to LTCFs during fiscal year 2022 as follows: ? Nursing Facilities: o $286.2 million in Federal funding o $84.5 million in State funding ? ICF/IID: o $29.9 million in Federal funding Cause: ? Lack of resources ? Lack of explicit guidance regarding the timeframe for LTCF audit issuance ? The Department asserts that the State is in compliance with timeframe requirements for ICF/IID audit issuance. Effect: Noncompliance with Federal and State regulations Recommendation: We recommend that the Department reallocate resources to address the backlog of audits and uniform desk reviews. Timely audit issuance will minimize the impact on providers of potential payables and receivables. We further recommend that the Department update the MCBM to provide an explicit timeframe for issuance of ICF/IID audits in line with NFs. Corrective Action Plan: See F-29 Management?s Response: The Department agrees with this finding in regard to LTCF - Nursing Facilities. The delay in completing the Nursing Facilities audits is the result of staff shortages and competing priorities due to COVID-19 activities, such as reconciling outbreak payments. Once the Public Health Emergency (PHE) officially ends, the staff assigned to COVID-19 related activities will be reassigned to LTCF audits, which will help with more timely processing. The Department disagrees with this finding in regard to LTCF - ICF/IID?s. The ICF/IID audits do not have a specific time requirement in the MBM for completion. The federal regulations only require that periodic audits of financial records occur. All ICF/IID cost reports submitted to the Department are recorded in a database and tracked for audit purposes. All cost reports are audited as resources are available. We have worked with our Federal partners who have agreed with our interpretation of the regulation and the timing of our audits for the ICF/IIDs. Contact: Herb Downs, Director, Division of Audit, DHHS, 207-287-2778 Auditor?s Concluding Remarks: 42 CFR 447.253(f-g) states ?[the agency] must provide for the periodic filing of uniform cost reports by each participating provider [and] periodic audits of the financial and statistical records of participating providers.? The Department is correct in its assertion that the regulation does not define a timeframe for either the filing of uniform cost reports by providers or the audit of financial and statistical records; however, the following factors must be considered: ? MCBM Chapter III, Section 50 (ICF/IIDs) states the following: o ?All long-term care facilities are required to submit annual cost reports,? and o ?The cost report and financial statements for each facility shall be filed no later than five (5) months after the fiscal year end of the provider.? ? MCBM Chapter III, Section 67 (NFs) states the following: o ?Each long-term care facility in Maine must submit an annual cost report within five (5) months of the end of the fiscal year,? o ?The Division of Audit shall perform a uniform desk review on each cost report submitted,? and o ?Uniform desk reviews shall be completed within three hundred and sixty-five (365) days after the receipt of an acceptable cost report filing.? ICF/IIDs are LTCFs. Though the language regarding audit timeframe is omitted from MCBM Chapter III, Section 50 (ICF/IIDs), it is reasonable to conclude that all LTCFs, including ICF/IIDs, must submit cost reports annually and the Department must perform LTCF audits annually. ? The Department?s interpretation that there is no deadline for performing audits of the financial and statistical records of certain classifications of LTCFs leads to an open-ended timeframe where audits of LTCF cost reports are never required to be completed. As noted in the preceding bullet, this is inconsistent with other LTCF sections of the MCBM. ? The Department requires that providers submit cost reports annually. The periodic audit of a facility?s financial and statistical records should follow the same pattern as the periodic submission of those financial and statistical records. Failure to do so leads to delays in identifying funds due to or due from the provider, which could lead to financial hardship for the facility and threaten the care Medicaid clients receive. o Delays in identifying funds due from a facility postpone recoupment of overpayments by the State and postpone Federal reimbursement for those funds. o Delays in performing audits prevents the Department from providing reasonable assurance that the Department is managing the Federal award as required by 2 CFR 200.303. In addition to reallocating resources to address the backlog of audits, OSA continues to recommend that the Department update the MCBM to align financial and statistical reporting and auditing requirements across all LTCFs, including ICF/IIDs. This will serve to mitigate the risks posed by these delays. The finding remains as stated. (State Number: 22-1106-04)

(2022-081) Title: Internal control over cases opened due to potential fraud, abuse, or questionable practices needs improvement Prior Year Findings: See Schedule of Findings and Questioned Costs for chart/table State Department: Health and Human Services State Bureau: Office of MaineCare Services Federal Agency: U.S. Department of Health and Human Services Assistance Listing Title: Medicaid Cluster (COVID-19) Assistance Listing Number: 93.775, 93.777, 93.778 Federal Award Identification Number: 2105ME5MAP, 2205ME5MAP Compliance Area: Special tests and provisions Type of Finding: Material weakness Material noncompliance Questioned Costs: None Criteria: 2 CFR 200.303; 42 CFR 455.13 through .15; MaineCare Benefits Manual, Sections 1.17 and 1.18 The Department must establish and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. When the State Medicaid Agency receives a complaint of Medicaid fraud or abuse, or identifies questionable practices, it must conduct a preliminary investigation to determine whether there is sufficient basis to warrant a full investigation. Additionally, if the preliminary investigation is indicative of fraud, waste, or abuse, the State Medicaid Agency must take appropriate actions to fully investigate the abuse and/or refer the case to the Medicaid Fraud Control Unit. Condition: The Office of the State Auditor (OSA) judgmentally selected 12 cases related to potential fraud, abuse, or questionable practices based upon the age of the case or the amount of identified recoupment. In OSA?s test of 12 cases, 7 cases were found to be inactive for an extended period, ranging from 314 to 1,738 days. Of the remaining population of cases, a non-statistical random sample of 60 cases was selected. In OSA?s test of 60 cases, 5 cases were found to be inactive for an extended period, ranging from 275 to 828 days. There was no evidence of monitoring or supervisory review during these extended periods. Context: In fiscal year 2022, the State paid $3.9 billion to providers, including $2.9 billion in Federal funds. Cause: ? Lack of resources ? Lack of procedures to ensure that cases are continually monitored Effect: ? Fraud, abuse or questionable practices may remain undetected. ? Costs that should be recovered may not be identified. Recommendation: We recommend that the Department establish procedures to identify inactive cases to ensure case reviews and investigations are completed in accordance with regulatory requirements and Department procedures. Corrective Action Plan: See F-29 Management?s Response: The Department agrees that the cases identified lacked documentation to support the reason for periods of non-activity. However, the Department notes that 7 of the 12 cases identified by the Auditor either had been closed or had findings issued prior to the Department?s receipt of the sample list from the Auditor. Two of the remaining five cases were cases where the assigned staffer left the unit. Those two cases have been reassigned to current staff and are presently being worked. The remaining three cases were instances where the Program Integrity reviewer left their position and were no longer available to handle the cases. Contact: Michelle Probert, Director, Office of MaineCare Services, DHHS, 207-287-2093 (State Number: 22-1106-06)

(2022-082) Title: Internal control over the eligibility determination process needs improvement Prior Year Findings: See Schedule of Findings and Questioned Costs for chart/table State Department: Health and Human Services State Bureau: Office for Family Independence Federal Agency: U.S. Department of Health and Human Services U.S. Department of Agriculture Assistance Listing Title: Medicaid Cluster (COVID-19) Children?s Health Insurance Program (CHIP) (COVID-19) SNAP Cluster (COVID-19) Temporary Assistance for Needy Families (TANF) (COVID-19) Assistance Listing Number: 93.775, 93.777, 93.778; 93.767; 10.551, 10.561; 93.558 Federal Award Identification Number: 2105ME5MAP, 2205ME5MAP; 2005ME5021, 2105ME5021; SNAP Benefits, Maine; 1901METANF, 2001METANF, 2101METANF Compliance Area: Allowable costs/cost principles Eligibility Type of Finding: Material weakness Questioned Costs: None Criteria: 2 CFR 200.303 The Department must establish and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. Condition: The Department did not have a documented process in place throughout fiscal year 2022 to ensure information entered into the Automated Client Eligibility System (ACES) is accurate and complete. Eligibility specialists manually enter information into ACES and initiate computerized eligibility determinations. Documentation supports that there is no process in place to ensure the accuracy of manually entered data used in eligibility determinations. Supervisors perform a case review of one eligibility determination per eligibility specialist per month. Supervisors and senior program management have the ability to monitor phone interactions between eligibility specialists and clients in real time. In June 2022, the Department fully implemented a new supervisory case reading system. Components of the formal case review include a review of the accuracy of data entry and resulting eligibility determinations, and appropriateness of processes. The system also serves as a formalized tracking tool for supervisory case readings. However, the Department does not have a process in place to review a random selection of cases, track specific issues identified in the reviews, identify common errors, and determine if those errors have a broader impact on eligibility determinations. Cases subject to review are judgmentally selected by supervisors. With approximately 300 eligibility specialists, case reviews are only performed for approximately one percent of all eligibility determinations. Identified errors are corrected in individual case files, but the results of case reviews are not monitored to identify common issues. In response to the COVID-19 Public Health Emergency (PHE) during fiscal year 2020, Federal oversight agencies waived the requirements for certain eligibility criteria and eligibility determination procedures. These waivers remained in effect throughout fiscal year 2022. As a result, the Department?s risk of noncompliance with eligibility determination criteria was significantly reduced. Conversely, as the PHE-related waivers expire, the risk of noncompliance will increase. The Office of the State Auditor (OSA) issued three other related findings: 2022-025, Internal control over automated SNAP eligibility determinations and benefit calculations needs improvement; 2022-083, over needs improvement; and 2022-085, Internal control over cost of care assessments needs improvement. Context: In fiscal year 2022, the State provided approximately: ? 421,000 Medicaid/CHIP clients with $2.9 billion in Federal benefits; ? 119,000 SNAP clients with $466 million in Federal benefits; and ? 16,000 TANF clients with $35 million in Federal benefits. Cause: Lack of adequate procedures to prevent, or detect and correct, errors and inaccuracies affecting the overall population of eligibility determinations Effect: ? Individuals not eligible for services could be determined eligible or eligible individuals could be deemed ineligible. ? Potential questioned costs and disallowances Recommendation: We recommend that the Department enhance formal case review procedures to include a systematic, random selection of cases for review. This will ensure that a representative sample of eligibility determinations are objectively reviewed. We further recommend that the Department implement procedures to track errors and inaccuracies identified through the review process, determine common issues and areas of concern, and apply those results to the broader population of eligibility determinations. This will ensure that eligibility determinations are performed accurately. Corrective Action Plan: See F-30 Management?s Response: The Department disagrees with this finding. The systems we have in place are both necessary and sufficient in meeting programmatic requirements to ensure accurate eligibility determinations are being made. There has been no citation of federal regulation provided by OSA during this review that contradicts this. The Department would like to note: 1. Supervisors do a minimum of 1 case reading per month and a minimum of 1 call monitoring per week for staff on phones. It is commonplace for them to do more, especially for a new employee, or known coaching issues. 2. These case readings were tracked by supervisors and units and were tracked centrally on our Streamline Management Y- Drive in SFY2022. 3. Phone calls can be referenced by Supervisors in real time or afterwards, via recording. 4. Specifics of case reading, and call monitoring were formalized with specific expectations in multiple categories, which were followed up on by coaching staff if not all of the expectations were met. With a goal of continuous improvement, it was also noted to the OSA that we formally implemented the Calabrio System which dramatically enhanced and further automated our ability to track Case Readings and Call Monitoring performance statewide in June of 2022. A corresponding user guide was also developed and implemented in June of 2022. This example of continuous quality improvement has led to a more holistic understanding of trends and training needs. Furthermore, SNAP cases are randomly selected and reviewed by USDA partially-funded SNAP Quality Control staff. These findings are reported monthly to FNS and OFI senior management. A team of QC, training, program, operations, business technology and senior management meet bi-weekly to review trends and implement solutions. These have included technological enhancements, reminder e-mails, targeted trainings, and pop quizzes. While this effort focuses on SNAP, the vast majority of SNAP cases also involve MaineCare, and some include TANF. Solutions for one program typically aid all. Contact: Anthony Pelotte, Director, Office for Family Independence, DHHS, 207-624-4104 Auditor?s Concluding Remarks: The Calabrio System was implemented in the final month of the fiscal year; therefore, the system was not in place for the majority of the fiscal year. OSA requested evidence to support the Department?s tracking of deficiencies identified through case reading and call monitoring procedures, the application of those results to the broader population of eligibility determinations to track the frequency and cause of deficiencies, and the implementation of broad-based corrective action taken in response to those findings. The Department did not provide evidence that this occurred. The Department did not demonstrate the establishment and maintenance of effective internal control over the Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards as required by 2 CFR 200.303. The finding remains as stated. (State Number: 22-1106-01)

(2022-083) Confidential finding, see below for more information Title: over needs improvement Pursuant to paragraph 6.63 of the U.S. Government Accountability Office?s Government Auditing Standards (also known as the Yellow Book), we omitted details from this finding as they are confidential under the provisions of 5 MRSA 244-C (3). Though the content of this finding has been redacted, we provided the Department(s) with detailed information regarding the specific condition we identified, as well as the related criteria, context, causes, effects, and our specific recommendations for improvement. Prior Year Findings: See Schedule of Findings and Questioned Costs for chart/table Type of Finding: Material weakness Corrective Action Plan: See F-30 Contact: Shirley Browne, Deputy State Controller, Office of the State Controller, 207-626-8423 (State Number: 22-0905-04)

(2022-084) Title: Internal control over Medicare Part B premium payments needs improvement Prior Year Findings: See Schedule of Findings and Questioned Costs for chart/table State Department: Health and Human Services Administrative and Financial Services State Bureau: Office for Family Independence Office of Information Technology Federal Agency: U.S. Department of Health and Human Services Assistance Listing Title: Medicaid Cluster (COVID-19) Assistance Listing Number: 93.775, 93.777, 93.778 Federal Award Identification Number: 2105ME5MAP, 2205ME5MAP Compliance Area: Allowable costs/cost principles Type of Finding: Significant deficiency Questioned Costs: None Criteria: 2 CFR 200.303; 42 CFR 431.625 The Department must establish and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. 42 CFR 431.625 outlines eligibility criteria which, if met, allows the State to pay a portion of the Federal Medicare Part B premium on behalf of the client and claim Federal financial participation in the payment. Clients may be deemed eligible by the Federal government as indicated by a Federal Buy-In code, or by the State as indicated by eligibility status in the Automated Client Eligibility System (ACES). Condition: The Department receives monthly invoices from the Centers for Medicare and Medicaid Services (CMS) for Medicare Part B premiums. CMS provides a separate detailed listing of Medicaid clients that supports the invoice to the Office of Information Technology (OIT). OIT produces a Monthly Reconciliation Report identifying potential discrepancies between the CMS detailed listing and the Department?s eligibility information recorded in ACES. Office for Family Independence personnel use this reconciliation report to identify clients for whom payment should not be made. In the Office of the State Auditor?s (OSA) test of the 12 Monthly Reconciliation Reports required in fiscal year 2022, completion of review or documentation of corrective action could not be provided for two reports. In OSA?s sample of 60 premium payments: ? two premiums were paid by the Department on behalf of clients who were coded eligible on the CMS invoice but were coded not eligible in ACES. ? two premiums were paid by the Department on behalf of clients who were coded eligible in ACES but were not included on the CMS invoice. ? one premium was paid by the Department on behalf of a client who was not coded eligible in ACES and was not included on the CMS invoice. ? seven premiums were paid by the Department on behalf of clients who were coded eligible on the CMS invoice and in ACES; however, discrepancies existed between their Federal and State Buy-In eligibility codes. The Monthly Reconciliation Report did not identify these discrepancies. However, additional OSA procedures determined that the clients were eligible and the payments were allowable. OSA selected a non-statistical random sample. Context: In fiscal year 2022, $121 million in Federal funds and $51 million in State funds were paid to CMS for Medicare Part B premiums. Cause: ? Lack of supervisory oversight ? The Monthly Reconciliation Report is not adequately designed to identify all discrepancies. Effect: ? Potential Medicare Part B premiums paid by the State for ineligible clients ? Potential questioned costs and disallowances ? Noncompliance with Federal regulations Recommendation: We recommend that the Department establish procedures to ensure the review and follow up to Monthly Reconciliation Reports, and that the Department improve procedures for the documentation of those reports. We further recommend that the Department design the Monthly Reconciliation Report to identify all discrepancies. Corrective Action Plan: See F-30 Management?s Response: The Departments agree with this finding. We continue to address this repeat finding as evidenced by substantial edits to our current business practice and the SOP governing Medicare Part B Buy-in reconciliation effective March 10, 2022. Existing work on the SOP development includes the incorporation of a recent CMS implemented web-portal tool to address Medicare Part B Buy-in discrepancies known as ELMO, a tool we are already leveraging. Work continues to include Information Technology processes in order to determine where system changes may enhance and further automate reconciliation for individuals with SSI and Medicare premium changes. Contact: Anthony Pelotte, Director, Office for Family Independence, DHHS, 207-624-4104 (State Number: 22-1106-03)

(2022-085) Title: Internal control over cost of care assessments needs improvement Prior Year Findings: See Schedule of Findings and Questioned Costs for chart/table State Department: Health and Human Services State Bureau: Office for Family Independence Federal Agency: U.S. Department of Health and Human Services Assistance Listing Title: Medicaid Cluster (COVID-19) Assistance Listing Number: 93.775, 93.777, 93.778 Federal Award Identification Number: 2105ME5MAP, 2205ME5MAP Compliance Area: Allowable costs/cost principles Type of Finding: Significant deficiency Questioned Costs: Undeterminable. Incorrectly calculated cost of care (COC) assessments may result in an overpayment or underpayment to the providers when the State makes a payment for long-term care. Since there is not always a claim for every assessment, a projection of questioned costs cannot be reasonably estimated. Criteria: 2 CFR 200.303; 42 CFR 435.725; MaineCare Eligibility Manual, Part 14, Section 6 The Department must establish and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. The Department must reduce its payment to an institution for service provided to an individual by the amount that remains after deducting certain amounts from the member?s total income. This remaining amount is the member?s maximum share of the cost, known as COC. Condition: A COC assessment represents the required contribution that a MaineCare recipient must pay toward care in a Long Term Care Facility. The Office for Family Independence (OFI) is responsible for calculating COC assessments for Medicaid for all members in the State. COC assessments are either calculated by the Automated Client Eligibility System (ACES) or calculated manually by eligibility specialists. System generated COC assessments are not subject to secondary review. A COC deduction represents the amount of assessment that was deducted from a paid claim. Members may have an assessment calculated but may never have a claim with a deduction utilizing that assessment. The Office of MaineCare Services (OMS) is responsible for applying assessments to submitted claims prior to payment. The Office of the State Auditor (OSA) tested a sample of 60 COC assessments and related deductions from paid claims. Two exceptions for COC assessments that were not adjusted correctly after notification of a change in income or expense were identified as follows: ? One COC was calculated correctly but had an incorrect end date. The COC should have ended on June 30, 2022, but was programmed to end on July 31, 2022. This error did not affect any claims in fiscal year 2022. ? One COC was lower than it should have been by $12. The assessment was $1,079 and should have been $1,091 for six months during the fiscal year. This member had six claims where the incorrect COC was applied. For both exceptions, the COC assessment was calculated correctly by ACES based on the data that was entered into the system; however, that data was entered incorrectly. OSA selected a non-statistical random sample. OSA issued two other related findings: 2022-082, Internal control over the eligibility determination process needs improvement; and 2022-083, improvement. over needs Context: In fiscal year 2022, approximately: ? 26,000 COC assessments were calculated by OFI; ? 9,500 members had COC assessments; and ? $495 million was paid to nursing facilities and residential care facilities. Cause: Lack of supervisory oversight Effect: ? Inaccurate COC assessments and retroactive changes may result in overpayments or underpayments for members or the State. ? Potential questioned costs and disallowances Recommendation: We recommend that the Department implement oversight procedures to ensure that data entered into ACES is accurate and can be relied upon for COC assessment calculations. This will ensure that MaineCare recipients are not overcharged or undercharged for their required contribution towards care in long-term care facilities. Corrective Action Plan: See F-31 Management?s Response: The Department agrees with the two exceptions found by the Office of the State Auditor. However, we believe that the Department has reasonable assurance with the controls in place that results in a 97% compliance rate with the COC calculations, which is a 2% increase from last year. In the prior year?s finding the Department committed to continuing to achieve a 95% compliance rate and CMS agreed with the Department and closed the prior finding. Contact: Anthony Pelotte, Director, Office for Family Independence, DHHS, 207-624-4104 (State Number: 22-1106-08)

(2022-086) Title: Internal control over deceased client cases and claims analysis needs improvement Prior Year Findings: See Schedule of Findings and Questioned Costs for chart/table State Department: Health and Human Services State Bureau: Office for Family Independence Office of MaineCare Services Federal Agency: U.S. Department of Health and Human Services Assistance Listing Title: Medicaid Cluster (COVID-19) Assistance Listing Number: 93.775, 93.777, 93.778 Federal Award Identification Number: 2105ME5MAP, 2205ME5MAP Compliance Area: Allowable costs/costs principles Eligibility Type of Finding: Significant deficiency Questioned Costs: None Criteria: 2 CFR 200.303; 2 CFR 200.403 The Department must establish and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. Costs must be necessary and reasonable for the performance of the Federal award. Condition: The Office for Family Independence (OFI) is responsible for maintaining complete and accurate client information in the Automated Client Eligibility System (ACES). Information entered into ACES is relied upon by the Office of MaineCare Services (OMS) to approve, deny, process, and analyze claims. OFI relies on numerous data sources for identifying and providing client date of death (DOD) information for input into ACES. In some cases where the exact DOD may not be immediately available, the DOD is entered as the last day of the month so that OFI can close the case of a known deceased client in a timely manner. OFI performs monthly crosswalks to compare the DOD entered in ACES to the reported DOD obtained from the Maine Center for Disease Control & Prevention (MeCDC) vital records. OMS has established procedures to identify claims paid with a service date after DOD. These procedures include staff review of claims and identification of appropriate action for any claim that was improperly paid, as certain claims with service dates after death are allowable. With regards to OMS claims identification procedures, OSA analyzed all claims paid for a client with a DOD in fiscal year 2022 and identified 110 claims paid on behalf of 75 clients that had service dates after death but were not identified by OMS procedures. Claims paid on behalf of these clients after DOD totaled $9,988 in fiscal year 2022. With regards to OFI eligibility procedures, OSA tested a sample of 60 clients with DOD in fiscal year 2022 and identified: ? four clients with a DOD in ACES that did not correspond to the actual DOD provided by MeCDC vital records; and ? one client with no DOD recorded in ACES. OSA selected a non-statistical random sample. Audit procedures also identified that: ? three clients for whom claims were paid after DOD had no DOD recorded in ACES; and ? 13 clients with an incorrect DOD identified by OSA during the fiscal year 2021 audit were still not corrected in ACES. Context: The Medicaid program processed $2.2 billion in paid claims in fiscal year 2022. Cause: ? Lack of adequate procedures to ensure DOD information is entered accurately and appropriately updated in ACES ? Lack of adequate procedures to ensure all claims paid after a client?s DOD are identified Effect: ? Claims paid on behalf of deceased clients may go undetected. ? Potential questioned costs and disallowances Recommendation: We recommend that OFI enhance existing procedures to identify and correct DOD information when a known DOD is not initially provided. We further recommend that OFI implement oversight to ensure DOD information is accurately entered into ACES. We recommend that OMS enhance existing procedures to ensure that all claims with service dates after a client?s DOD are identified for review to detect any claims that are not allowable. Corrective Action Plan: See F-31 Management?s Response: The Department partially agrees with this finding. OFI acknowledges a data mismatch of five clients. Edits were made to the standard operating procedures governing the date of death procedures in November of 2021 including articulation of responsible parties and expected timelines for processing. Additionally, OFI continues to process weekly IEVS discrepancy reports based on death data from our federal partners as well as conduct monthly crosswalks with Maine?s CDC Office of Vital Statistics. OMS worked with OSA to review the original population of over 600 claims that were made after a client?s DOD. The original claims identified by OSA were reduced to 110. OMS did not have sufficient time to perform a more detailed analysis into the underlying reasons that these 110 claims were made to clients after DOD. OMS will complete the in-depth review and then consider if additional updates to procedures are necessary. Contact: Anthony Pelotte, Director, Office for Family Independence, DHHS, 207-624-4104 Auditor?s Concluding Remarks: OFI indicates they have enhanced their procedures as of November 2021, implying these will prevent the types of errors identified in the finding. However, of the three clients for whom no DOD was entered into ACES, two occurred after OFI?s November 2021 standard operating procedures update. Though OSA initially identified approximately 600 claims paid after a client?s DOD that were not identified through OMS? procedures, OMS was able to provide additional documentation to remove approximately 500 claims from OSA?s list of exceptions. For the remaining 110 claims, OMS could not provide documentation to support that these claims were identified through OMS? procedures. The finding remains as stated. (State Number: 22-1106-11)

(2022-087) Title: Internal control over the outsourced medical claims coding process needs improvement Prior Year Findings: See Schedule of Findings and Questioned Costs for chart/table State Department: Health and Human Services State Bureau: Office of MaineCare Services Federal Agency: U.S. Department of Health and Human Services Assistance Listing Title: Medicaid Cluster (COVID-19) Assistance Listing Number: 93.775, 93.777, 93.778 Federal Award Identification Number: 2105ME5MAP, 2205ME5MAP Compliance Area: Special tests and provisions Type of Finding: Significant deficiency Questioned Costs: None Criteria: 2 CFR 200.303; Social Security Act Section 1903(r); National Correct Coding Initiative (NCCI) Medicaid Policy Manual; NCCI Medicaid Technical Guidance Manual The Department must establish and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. State Medicaid Agencies (SMAs) are required to incorporate National Correct Coding Initiative (NCCI) methodologies into State Medicaid programs. States are required to completely and correctly implement six Medicaid NCCI methodologies to ensure that only proper payment of allowable procedures is reimbursed, including the use of specific edit files. Condition: The NCCI was established by the Centers for Medicare and Medicaid Services (CMS) in an effort to promote correct coding by preventing coding errors and code manipulation, and reducing improper payments and improper payment rates. The CMS NCCI Policy Manual states that SMAs must download specific confidential NCCI edit files available on the secure portal, known as MII RISSNET, rather than using publicly available files. SMAs must ensure that they, or their vendors, are using the appropriate Medicaid NCCI edits to adjudicate Medicaid claims. The Office of MaineCare Services (OMS) contracts with a vendor to process medical claims. The vendor updates the claims processing system to incorporate the NCCI edit files; however, the vendor is not obtaining and applying the specific confidential files from MII RISSNET as required by CMS. Context: OMS processed $1.9 billion in Federal medical claims in fiscal year 2022. Cause: OMS determined that the benefit of utilizing the correct coding files did not support the time and expense required to implement the change. Effect: ? Incorrect coding could result in payment of unallowable claims or denial of allowable claims. ? Potential questioned costs and disallowances ? Noncompliance with Federal regulations Recommendation: We recommend that OMS devote the necessary resources to facilitate claims processing using the MII RISSNET files as required by CMS. Corrective Action Plan: See F-31 Management?s Response: The Department agrees with this finding. The State of Maine is now obtaining and forwarding the RISSNET files to Gainwell. The files for Calendar Year Q4 2022 and Calendar Year Q1 2023 were forwarded prior to the start of Q4 2022 and Q1 2023. Gainwell has provided the files to the vendor, Context, for formatting. Neither file was properly validated or applied. The state will work with Gainwell to ensure the previous files are corrected and to ensure current and future files are processed correctly. Contact: Michelle Probert, Director, Office of MaineCare Services, DHHS, 207-287-2093 (State Number: 22-1106-05)

(2022-088) Confidential finding, see below for more information Title: over needs improvement Pursuant to paragraph 6.63 of the U.S. Government Accountability Office?s Government Auditing Standards (also known as the Yellow Book), we omitted details from this finding as they are confidential under the provisions of 5 MRSA 244-C (3). Though the content of this finding has been redacted, we provided the Department(s) with detailed information regarding the specific condition we identified, as well as the related criteria, context, causes, effects, and our specific recommendations for improvement. Prior Year Findings: None Type of Finding: Significant deficiency Corrective Action Plan: See F-31 Contact: Shirley Browne, Deputy State Controller, Office of the State Controller, 207-626-8423 (State Number: 22-0904-01)

(2022-089) Confidential finding, see below for more information Title: over the needs improvement Pursuant to paragraph 6.63 of the U.S. Government Accountability Office?s Government Auditing Standards (also known as the Yellow Book), we omitted details from this finding as they are confidential under the provisions of 5 MRSA 244-C (3). Though the content of this finding has been redacted, we provided the Department(s) with detailed information regarding the specific condition we identified, as well as the related criteria, context, causes, effects, and our specific recommendations for improvement. Prior Year Findings: None Type of Finding: Significant deficiency Corrective Action Plan: See F-32 Contact: Shirley Browne, Deputy State Controller, Office of the State Controller, 207-626-8423 (State Number: 22-0904-02)

(2022-090) Title: Internal control over DG ? PA program cash management needs improvement Prior Year Findings: See Schedule of Findings and Questioned Costs for chart/table State Department: Defense, Veterans and Emergency Management State Bureau: Maine Emergency Management Agency Federal Agency: U.S. Department of Homeland Security Assistance Listing Title: Disaster Grants ? Public Assistance (Presidentially Declared Disasters) (COVID-19) Assistance Listing Number: 97.036 Federal Award Identification Number: 4354DRMEP00000001, 4367DRMEP00000001, 4522DRMEP00000001 Compliance Area: Cash management Type of Finding: Material weakness Material noncompliance Questioned Costs: None Criteria: 2 CFR 200.303; 2 CFR 200.302; 31 CFR 205.33; State Administrative and Accounting Manual (SAAM) Section 50.40.80 The Department must establish and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. Financial records must adequately identify the source and application of funds and provide accountability for all funds, property, and other assets related to the Federally funded activities. The Department must minimize the time between the drawdown of Federal funds and the disbursement of these funds for Federal program purposes. The timing and amount of fund transfers must be as close as is administratively feasible to the Department?s actual cash outlay for program costs. Section 50.40.80 of the SAAM has defined administratively feasible as no more than seven business days. Condition: The Maine Emergency Management Agency (MEMA) did not minimize the time between drawdown and disbursement of Federal funds. In the Office of the State Auditor?s (OSA) testing of 21 drawdowns: ? the cash balance was not taken into consideration when requesting any of the Federal drawdowns; and ? 11 of the disbursements for program costs ranged from 8 to 45 days after the Federal funds were received. OSA selected a judgmental and a non-statistical random sample. Context: During fiscal year 2022, MEMA expended $80.2 million in Disaster Grants ? Public Assistance (DG ? PA) grant funds. Cause: ? Lack of adequate policies and procedures ? Lack of staff resources available to process grant drawdowns, monitor cash balances, and process payments to subrecipients due to the increased number of COVID-19 grants managed by the agency Effect: ? The Federal government may impose more stringent program-specific cash management requirements based on noncompliance. ? Noncompliance with Federal and State regulations Recommendation: We recommend that the Department develop and implement policies and procedures to ensure that Federal cash is requested based on immediate cash needs which includes consideration of existing cash balances. We also recommend the Department review its staffing needs to ensure there are adequate resources to process and provide supervisory oversight over the increased workload from COVID-19 grants. Corrective Action Plan: See F-32 Management?s Response: The Department agrees with this finding. In State Fiscal Year 2023 MEMA started utilizing the Security and Employment Service Center to draw funds and to ensure the drawdown procedure addresses the need to (1) consider previous cash balances before making a drawdown and (2) ensure the period from drawdown to disbursement does not exceed seven days. The new procedure will provide for limited review and testing by MEMA as appropriate. Contact: Joe Legee, Deputy Director, MEMA, DVEM, 207-624-4400 (State Number: 22-1502-02)

(2022-091) Title: Internal control over DG ? PA program special reporting needs improvement Prior Year Findings: See Schedule of Findings and Questioned Costs for chart/table State Department: Defense, Veterans and Emergency Management State Bureau: Maine Emergency Management Agency Federal Agency: U.S. Department of Homeland Security Assistance Listing Title: Disaster Grants ? Public Assistance (Presidentially Declared Disasters) (COVID-19) Assistance Listing Number: 97.036 Federal Award Identification Number: 4354DRMEP00000001, 4367DRMEP00000001, 4522DRMEP00000001 Compliance Area: Reporting Type of Finding: Material weakness Material noncompliance Questioned Costs: None Criteria: 2 CFR 200.303; 2 CFR 170 The Department must establish and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. Agencies must report each subaward that equals or exceeds the first-tier subaward threshold of $30,000 in Federal funds in the public-facing Federal Funding Accountability and Transparency Act (FFATA) Subaward Reporting System. Condition: When an amount exceeding the first-tier subaward threshold is awarded to a subrecipient, the Department must collect and enter data into the FFATA Subaward Reporting System. The Department did not report any of its first-tier subawards under the Disaster Grants ? Public Assistance (DG ? PA) program in the FFATA reporting system for fiscal year 2022. Context: First-tier subawards totaled $56 million under the DG ? PA program in fiscal year 2022. First-tier subawards account for approximately 70 percent of the program?s expenditures. Cause: ? Competing priorities related to an increase in aid requests as a result of COVID-19 ? Lack of resources Effect: ? Noncompliance with Federal regulations ? First-tier subaward information for the DG ? PA program was not reported to the Federal government. This information may be used for programmatic, policy, or statistical purposes. Recommendation: We recommend that MEMA allocate resources to fully implement newly established procedures to ensure that subrecipient awards are properly reported as required by Federal program regulations. Corrective Action Plan: See F-32 Management?s Response: The Department agrees with this finding. MEMA will ensure FY23 subawards are entered into the FFATA reporting system. Contact: Joe Legee, Deputy Director, MEMA, DVEM, 207-624-4400 (State Number: 22-1502-04)

(2022-092) Title: Internal control over the submission and review of DG ? PA Schedule of Expenditures of Federal Awards information needs improvement Prior Year Findings: See Schedule of Findings and Questioned Costs for chart/table State Department: Defense, Veterans and Emergency Management Administrative and Financial Services State Bureau: Maine Emergency Management Agency Office of the State Controller Federal Agency: U.S. Department of Homeland Security Assistance Listing Title: Disaster Grants ? Public Assistance (Presidentially Declared Disasters) (COVID-19) Assistance Listing Number: 97.036 Federal Award Identification Number: 4354DRMEP00000001, 4367DRMEP00000001, 4522DRMEP00000001 Compliance Area: Reporting Type of Finding: Significant deficiency Questioned Costs: None Criteria: 2 CFR 200.303; 2 CFR 200.510; 2 CFR 200, Appendix XI, Assistance Listing Number 97.036; OMB M-20-26 The Department must establish and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. The Department must prepare a Schedule of Expenditures of Federal Awards (SEFA) for the period covered by the State?s financial statements which must include the total Federal awards expended. To maximize the transparency and accountability of COVID-19 related award expenditures, OMB M-20-26 (June 18, 2020) instructed recipients and subrecipients to separately identify the COVID- 19 Emergency Acts expenditures on the SEFA. Therefore, non-federal entities should separately identify COVID-19 expenditures on the SEFA. For existing programs that have both COVID-19 expenditures and non-COVID-19 expenditures, this may be accomplished by identifying COVID- 19 expenditures on the SEFA on a separate line by Assistance Listing number with ?COVID-19? as a prefix to the program name. Condition: The Department must complete and submit exhibits and related schedules to the Office of the State Controller (OSC) at the close of each fiscal year to report Federal award information for inclusion on the State?s SEFA. OSC is responsible for compiling this information on behalf of the State. In fiscal year 2022, the Department received funding for the Disaster Grants ? Public Assistance (DG ? PA) program, which had both COVID-19 expenditures and non-COVID-19 expenditures during the fiscal year. At the close of the fiscal year, the Department provided a summary of Federal DG ? PA expenditures to OSC; however, the summary did not specifically identify COVID-19 related expenditures under this program. This summary was then used by OSC to compile and prepare the SEFA. Upon preparation, COVID-19 related expenditures were not identified as such in the SEFA. Subsequent OSC review procedures were not designed to detect and correct this error. As a result, DG ? PA COVID-19 related expenditures were not identified on the State?s fiscal year 2022 SEFA when provided to the Office of the State Auditor for audit purposes. Context: During fiscal year 2022, DG ? PA program expenditures totaled $80.2 million. Of that amount, $79.5 million were COVID-19 related expenditures. Cause: ? Lack of adequate internal control relating to Department SEFA submissions to OSC ? Lack of adequate review procedures by OSC Effect: Inaccurate reporting of expenditure amounts on the SEFA, which is submitted to the Federal government, may result in incorrect information used for programmatic, policy, or statistical purposes. Recommendation: We recommend that the Department implement additional procedures to improve preparation and submission of SEFA information to OSC. We further recommend that OSC implement additional supervisory review procedures over the SEFA information compiled on behalf of the State. These control procedures will ensure that expenditures are reported accurately on the SEFA. Corrective Action Plan: See F-32 Management?s Response: MEMA Response: The Department agrees with this finding. MEMA will implement controls to ensure the accuracy of Assistance Listing Numbers before SEFA data is submitted to OSC. MEMA Contact: Joe Legee, Deputy Director, MEMA, DVEM, 207-624-4400 OSC Response: The Office of the State Controller partially agrees with this finding. Federal funds reporting is decentralized and agencies use different methods for tying amounts to specific federal programs in Advantage. The Management Representation letters received from the agencies acknowledge that the agencies are responsible for the fair presentation of the expenditures in conformity with and in compliance with the rules and regulations of 2 CFR ?200. OSC is responsible to compile the data and submit the SEFA. OSC will update or clarify guidance as necessary and will consult with service center and agency financial personnel to help ensure their compilation/review systems are designed to provide accurate information for the SEFA. OSC Contact: Sandra Royce, Director of Financial Reporting, OSC, 207-626-8451 Auditor?s Concluding Remarks: In reply to OSC?s Management Response, the Office of the State Auditor (OSA) recognizes that SEFA reporting is a decentralized process and that OSC receives Management Representation Letters from agencies acknowledging responsibility for the fair presentation of SEFA information; however, OSC is responsible for reviewing the SEFA before it is provided to OSA for audit purposes. OSC has established review procedures prior to submission to OSA and that review and approval is documented on agencies? submissions. This review process, as stated in the finding, was not designed to detect and correct the errors noted in this finding, and findings 2022-023, 2022-053, and 2022-064, which are all related to agency submissions and OSC review of SEFA information. In addition, the Department of Administrative and Financial Services and OSC provide a signed Engagement Letter and Management Representation Letter to OSA, acknowledging the following responsibilities related to the annual Single Audit: ? Understanding and complying with the requirements of 2 CFR 200, including requirements relating to preparation of the SEFA ? Preparing and fairly presenting the SEFA and related disclosures in accordance with the requirements of the Uniform Guidance, including full identification of all government programs and related activities subject to the Federal compliance audit and all SEFA expenditures made during the audit period for all awards provided by Federal agencies OSA asserts that a year-to-year SEFA comparison would have detected the errors identified in the aforementioned findings; therefore, we continue to recommend that OSC implement additional supervisory review procedures over the SEFA information compiled on behalf of the State. This will provide assurance relating to the responsibility for SEFA information as outlined above and attested to OSA at the commencement and conclusion of the annual Single Audit. The finding remains as stated. (State Number: 22-1502-01)

(2022-093) Title: Internal control over expenditure processing needs improvement Prior Year Findings: None State Department: Administrative and Financial Services State Bureau: Security and Employment Service Center Federal Agency: U.S. Department of Homeland Security Assistance Listing Title: Homeland Security Grant Program Emergency Management Performance Grant Assistance Listing Number: 97.067; 97.042 Federal Award Identification Number: EMW2018SS00049S01; EMB2019EP00004 Compliance Area: Allowable costs/cost principles Type of Finding: Significant deficiency Questioned costs Known Questioned Costs: $59,759 under ALN 97.067, Homeland Security Grant Program Likely Questioned Costs: Likely questioned costs cannot be determined due to the variety of expenditures within the population. The projection of questioned costs utilizing the error rate related to the known exception and amounts tested would not produce a reasonable estimate of likely questioned costs. Criteria: 2 CFR 200.303; 2 CFR 200.403 The Department must establish and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. To be allowable under Federal awards, costs must be necessary and reasonable for the performance of the Federal award and be adequately documented. Condition: The Security and Employment Service Center is responsible for processing invoices for multiple State agencies. The Office of the State Auditor (OSA) tested a sample of 60 Federal expenditure transactions to ensure that the expenditure was accurately recorded. OSA found that one quarterly lease payment totaling $59,759 was processed incorrectly. The coding on the invoice indicated that the expenditure should be split coded utilizing Federal and State funds, and that the Federal share should be paid utilizing funds from the Emergency Management Performance Grant. Instead, Homeland Security Grant Program funds were erroneously charged. OSA selected a non-statistical random sample. Context: In fiscal year 2022, the Department reported expenditures of $2.6 million for the Emergency Management Performance Grant and $4.7 million for the Homeland Security Grant Program. Cause: Lack of supervisory oversight Effect: ? Questioned costs and potential disallowances ? Inaccurate reporting of expenditures Recommendation: We recommend that the Department improve oversight procedures to ensure staff are properly recording expenditures in the correct accounts with the proper utilization of grant funds. Corrective Action Plan: See F-33 Management?s Response: The Department agrees with this finding. The Security and Employment Service Center will continue to provide training for data entry and invoice approval processes. Contact: Marilyn Leimbach, Director, Service and Employment Service Center, DFPS, DAFS, 207-248-2556 (State Number: 22-1000-01

(2021-011) Confidential finding, see below for more information Title: ________ over the ________ system needs improvement Pursuant to paragraph 6.63 of the U.S. Government Accountability Office?s Government Auditing Standards (also known as the Yellow Book), we omitted details from this finding as they are confidential under the provisions of 5 MRSA 244-C (3). Though the content of this finding has been redacted, which appears as blank underlining, we provided the Department(s) with detailed information regarding the specific condition we identified, as well as the related criteria, context, causes, effects, and our specific recommendations for improvement. Prior Year Findings: See Schedule of Findings and Questioned Costs for chart/table State Department: Labor State Bureau: Unemployment Compensation Federal Agency: U.S. Department of Labor U.S. Department of Homeland Security Assistance Listing Title: Unemployment Insurance (UI) (COVID-19) Presidential Declared Disaster Assistance to Individuals and Households - Other Needs (COVID-19) Assistance Listing Number (CFDA): 17.225; 97.050 Federal Award Identification Number: Unemployment Insurance Trust Fund, Maine; 4522DRMESPLW Compliance Area: Allowable costs/cost principles Eligibility Type of Finding: Material weakness Questioned Costs: None Criteria: ________ Condition: ________ Context: ________ Cause: ________ Effect: ________ Recommendation: ________ Corrective Action Plan: See F-9 Management?s Response: ________ Contact: Kimberly Smith, Deputy Commissioner, Department of Labor, 207-621-5096 Auditor?s Concluding Remarks: ________ (State Number: 21-0907-01)

(2021-012) Confidential finding, see below for more information Title: ________ over the ________ system needs improvement Pursuant to paragraph 6.63 of the U.S. Government Accountability Office?s Government Auditing Standards (also known as the Yellow Book), we omitted details from this finding as they are confidential under the provisions of 5 MRSA 244-C (3). Though the content of this finding has been redacted, which appears as blank underlining, we provided the Department(s) with detailed information regarding the specific condition we identified, as well as the related criteria, context, causes, effects, and our specific recommendations for improvement. Prior Year Findings: See Schedule of Findings and Questioned Costs for chart/table State Department: Health and Human Services State Bureau: Office for Family Independence Federal Agency: U.S. Department of Agriculture U.S. Department of Health and Human Services Assistance Listing Title: SNAP Cluster Temporary Assistance for Needy Families (TANF) Assistance Listing Number (CFDA): 10.551, 10.561; 93.558 Federal Award Identification Number: SNAP Benefits, Maine; 1801METANF, 1901METANF, 2001METANF, 2101METANF Compliance Area: Allowable costs/cost principles Reporting Special tests and provisions Type of Finding: Significant deficiency Questioned Costs: None Criteria: ________ Condition: ________ Context: ________ Cause: ________ Effect: ________ Recommendation: ________ Corrective Action Plan: See F-9 Management?s Response: ________ Contact: Anthony Pelotte, Director, Office for Family Independence, DHHS, 207-624-4104 Auditor?s Concluding Remarks: ________ (State Number: 21-0905-01)

(2021-013) Confidential finding, see below for more information Title: ________ over the Office of Information Technology?s ________ procedures needs improvement Pursuant to paragraph 6.63 of the U.S. Government Accountability Office?s Government Auditing Standards (also known as the Yellow Book), we omitted details from this finding as they are confidential under the provisions of 5 MRSA 244-C (3). Though the content of this finding has been redacted, which appears as blank underlining, we provided the Department(s) with detailed information regarding the specific condition we identified, as well as the related criteria, context, causes, effects, and our specific recommendations for improvement. Prior Year Findings: See Schedule of Findings and Questioned Costs for chart/table State Department: Administrative and Financial Services State Bureau: Office of Information Technology Federal Agency: U.S. Department of Health and Human Services Assistance Listing Title: Medicaid Cluster (COVID-19) Assistance Listing Number (CFDA): 93.775, 93.777, 93.778 Federal Award Identification Number: 2005ME5MAP, 2105ME5MAP Compliance Area: Allowable costs/cost principles Type of Finding: Significant deficiency Questioned Costs: None Criteria: ________ Condition: ________ Context: ________ Cause: ________ Effect: ________ Recommendation: ________ Corrective Action Plan: See F-9 Management?s Response: ________ Contact: Nathan Willigar, Chief Information Security Officer, OIT, 207-458-1320 Auditor?s Concluding Remarks: ________ (State Number: 21-0900-02)

(2021-014) Confidential finding, see below for more information Title: ________ over ________ needs improvement Pursuant to paragraph 6.63 of the U.S. Government Accountability Office?s Government Auditing Standards (also known as the Yellow Book), we omitted details from this finding as they are confidential under the provisions of 5 MRSA 244-C (3). Though the content of this finding has been redacted, which appears as blank underlining, we provided the Department(s) with detailed information regarding the specific condition we identified, as well as the related criteria, context, causes, effects, and our specific recommendations for improvement. Prior Year Findings: See Schedule of Findings and Questioned Costs for chart/table State Department: Administrative and Financial Services State Bureau: Office of Information Technology Federal Agency: U.S. Department of Health and Human Services Assistance Listing Title: Medicaid Cluster (COVID-19) Assistance Listing Number (CFDA): 93.775, 93.777, 93.778 Federal Award Identification Number: 2005ME5MAP, 2105ME5MAP Compliance Area: Allowable costs/cost principles Eligibility Type of Finding: Significant deficiency Questioned Costs: None Criteria: ________ Condition: ________ Context: ________ Cause: ________ Effect: ________ Recommendation: ________ Corrective Action Plan: See F-10 Management?s Response: ________ Contact: Nathan Willigar, Chief Information Security Officer, OIT, 207-458-1320 (State Number: 21-0900-01)

(2021-015) Title: Internal control over the issuance of SNAP benefits needs improvement Prior Year Findings: See Schedule of Findings and Questioned Costs for chart/table State Department: Health and Human Services State Bureau: Office for Family Independence Federal Agency: U.S. Department of Agriculture Assistance Listing Title: SNAP Cluster Assistance Listing Number (CFDA): 10.551, 10.561 Federal Award Identification Number: SNAP Benefits, Maine Compliance Area: Allowable costs/cost principles Eligibility Type of Finding: Significant deficiency Questioned Costs: None Criteria: 2 CFR 200.303; 2 CFR 200.403 The Department must establish and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. Costs must be necessary and reasonable for the performance of the Federal award. Condition: The Department receives date of death (DOD) information from the Maine Center for Disease Control & Prevention (MeCDC) on a quarterly basis and from the Social Security Administration on a weekly basis. The Office of the State Auditor (OSA) obtained DOD information from MeCDC and compared it to clients who received Supplemental Nutrition Assistance Program (SNAP) benefits during fiscal year 2021. Of the cases that had benefit issuances after the client?s DOD, OSA identified 665 cases where SNAP benefits were issued in excess of 30 days following the client?s DOD. In 16 of the 665 cases, the benefits were issued 140 days or more after the client?s DOD. Context: In fiscal year 2021, the State provided approximately 117,000 SNAP eligible clients with $374 million in Federal benefits. Of the 117,000 SNAP eligible clients, approximately 1,400 had a DOD in fiscal year 2021. Cause: ? Lack of adequate procedures ? Lack of supervisory oversight Effect: ? Benefits paid on behalf of deceased clients may go undetected. ? Potential questioned costs and disallowances Recommendation: We recommend that the Department improve procedures to ensure that DOD information is received, reviewed, and updated in the eligibility system on a biweekly or monthly basis to prevent incorrect issuances of benefits. Corrective Action Plan: See F-10 Management?s Response: Although we agree with this finding, it should be noted that all of the exceptions found were prior to the implementation of a revised standard operating procedure governing the Date of Death processing which was implemented near the end of the audit period, on April 26, 2021. This repeat finding has been fully addressed. Contact: Anthony Pelotte, Director, Office for Family Independence, DHHS, 207-624-4104 (State Number: 21-1108-02)

(2021-016) Title: Internal control over EBT reconciliation procedures needs improvement Prior Year Findings: None State Department: Health and Human Services State Bureau: Office for Family Independence Federal Agency: U.S. Department of Agriculture Assistance Listing Title: SNAP Cluster Assistance Listing Number (CFDA): 10.551, 10.561 Federal Award Identification Number: SNAP Benefits, Maine Compliance Area: Special tests and provisions Type of Finding: Significant deficiency Questioned Costs: None Criteria: 2 CFR 200.303; 7 CFR 274.4 The Department must establish and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. The Department shall account for all electronic benefits transfer (EBT) issuance through a reconciliation of total funds entered into, exiting from, and remaining in the EBT system each day. Condition: SNAP benefit information is transmitted to Electronic Payment Processing and Information Control (EPPIC), the EBT system. When EBT purchases are completed by Supplemental Nutrition Assistance Program (SNAP) clients, Federal funds are automatically drawn by EPPIC using the Automated Standard Application for Payments (ASAP) system to pay retailers. The Department could not provide evidence that daily reconciliation procedures were performed during fiscal year 2021 for total funds entered into, exiting from, and remaining in EPPIC. Context: In fiscal year 2021, the State provided approximately 117,000 SNAP clients with $374 million in Federal benefits. Cause: ? Lack of supervisory oversight to ensure required reconciliations are completed ? The staff member responsible for performing this Federal requirement does not have access to the ASAP system which is needed to perform the daily reconciliation. Access to the ASAP system was requested but was never granted to the staff member. Effect: Discrepancies between systems could go undetected which could result in an overdraw or underdraw of Federal funds. Recommendation: We recommend that the Department implement procedures and provide oversight to ensure that all required reconciliations are completed daily. Corrective Action Plan: See F-10 Management?s Response: The Department agrees with this finding. These reconciliations were not completed during the audit period. The Department has been and will continue to work with our Federal partners to gain access to the ASAP system for both the EBT manager and Assistant Director of Business Technology to ensure business continuity in the event of planned or unplanned absences. Once both have access, those reconciliations will be completed, and reconciliations will be documented daily in accordance with Federal Regulations. Contact: Don Ellis, Assistant Director of Business Technology, DHHS, 207-624-4155 (State Number: 21-1108-01)

(2021-017) Confidential finding, see below for more information Title: ________ over the ________ system needs improvement Pursuant to paragraph 6.63 of the U.S. Government Accountability Office?s Government Auditing Standards (also known as the Yellow Book), we omitted details from this finding as they are confidential under the provisions of 5 MRSA 244-C (3). Though the content of this finding has been redacted, which appears as blank underlining, we provided the Department(s) with detailed information regarding the specific condition we identified, as well as the related criteria, context, causes, effects, and our specific recommendations for improvement. Prior Year Findings: See Schedule of Findings and Questioned Costs for chart/table State Department: Health and Human Services State Bureau: Office for Family Independence Federal Agency: U.S. Department of Agriculture U.S. Department of Health and Human Services Assistance Listing Title: SNAP Cluster Temporary Assistance for Needy Families (TANF) Assistance Listing Number (CFDA): 10.551, 10.561; 93.558 Federal Award Identification Number: SNAP Benefits, Maine; 1801METANF, 1901METANF, 2001METANF, 2101METANF Compliance Area: Special tests and provisions Type of Finding: Significant deficiency Questioned Costs: None Criteria: ________ Condition: ________ Context: ________ Cause: ________ Effect: ________ Recommendation: ________ Corrective Action Plan: See F-10 Management?s Response: ________ Contact: Anthony Pelotte, Director, Office for Family Independence, DHHS, 207-624-4104 Auditor?s Concluding Remarks: ________ (State Number: 21-0905-04)

(2021-018) Title: Internal control over cash balances needs improvement Prior Year Findings: See Schedule of Findings and Questioned Costs for chart/table State Department: Health and Human Services Administrative and Financial Services State Bureau: Maine Center for Disease Control & Prevention Health and Human Services Service Center Federal Agency: U.S. Department of Agriculture Assistance Listing Title: Special Supplemental Nutrition Program for Women, Infants, and Children (WIC) (COVID-19) Assistance Listing Number (CFDA): 10.557 Federal Award Identification Number: 204ME743W5003, 204ME701W1003, 204ME701W1006, 214ME7435003, 214ME701W1003, 214ME701W1006, 214ME721W6006, 214ME721W6003 Compliance Area: Cash management Type of Finding: Material weakness Material noncompliance Questioned Costs: None Criteria: 2 CFR 200.303; 2 CFR 200.302; 31 CFR 205.33; State Administrative and Accounting Manual (SAAM) Section 50.40.80 The Department must establish and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. Financial records must adequately identify the source and application of funds and provide accountability for all funds, property, and other assets related to the Federally-funded activities. The Department must minimize the time between the drawdown of Federal funds and the disbursement of these funds for Federal program purposes. The timing and amount of fund transfers must be as close as administratively feasible to the Department?s actual cash outlay for program costs. Section 50.40.80 of the SAAM has defined administratively feasible as no more than seven business days. Condition: The Department of Health and Human Services (DHHS) Service Center assumed responsibility for the drawdown of funds for the WIC Breastfeeding Peer Counsel grant and the WIC Nutrition Services Administration (NSA) Administrative grant in October 2020. The WIC Finance Manager retained responsibility for the drawdown of Federal funds for the WIC Food grant. The Service Center also assumed responsibility of grant tracking for all WIC grants in October 2020. The Service Center utilizes a cash on hand analysis to ensure that the WIC program complies with Federal and State regulations. The analysis used by the Service Center combined all WIC grants into one analysis. The Office of the State Auditor performed a separate analysis for each WIC grant which resulted in: ? the Breastfeeding Peer Counsel and WIC NSA Administrative grants having a negative cash balance ranging from $10,000 to $1.1 million throughout the fiscal year; and ? the WIC Food grant having an excess cash balance ranging from $900,000 to $1.2 million throughout the fiscal year. Context: In fiscal year 2021, the average business days cash on hand for the WIC grants were as follows: ? The Breastfeeding Peer Counsel and WIC NSA Administrative grants had an average business days cash on hand of negative 22 days. ? The WIC Food grant had an average business days cash on hand of 24 days. Cause: ? Lack of adequate procedures to ensure that the cash balances for each individual grant are considered before requesting Federal funds ? Lack of staff resources available to reconcile and remediate prior year cash balances ? Lack of supervisory oversight Effect: ? The Federal government may impose more stringent program-specific cash management requirements based on noncompliance. ? The State could potentially incur an interest liability on excess Federal cash balances. ? Until a reconciliation of related financial activity is completed, the Department will not know whether funds need to be returned to the Federal government for all, a portion, or none of the excess cash balance, and the Department will not know whether a General Fund appropriation is needed to clear the negative cash balance for administrative costs in the Federal Fund. ? Noncompliance with Federal and State regulations Recommendation: We recommend that the Department: ? implement procedures and establish oversight to ensure that the individual grant cash balances are considered separately for the WIC NSA Administrative and WIC Food grants when requesting Federal funds in accordance with 31 CFR 205.33; ? complete a separate reconciliation of the cash balances for all grants issued for the WIC program to determine the cause and remediation for both the negative and excess cash balances; and ? review its staffing needs to ensure there are adequate resources allocated to the reconciliation and remediation of both the negative and excess cash balances. Corrective Action Plan: See F-10 Management?s Response: The Department and its Service Center agree with this finding. The Service Center will modify the current grant cash balance analysis to include separating the WIC NSA Admin and the WIC Food grants. This will be completed by March of 2022. They will also finalize grant reconciliations for the WIC Food grants from 2017 to present. This will be completed by December of 2022. Contact: Sarah Gove, Director, DHHS Service Center, DAFS, 207-458-6626 (State Number: 21-1113-03)

(2021-019) Title: Internal control over subrecipient monitoring needs improvement Prior Year Findings: See Schedule of Findings and Questioned Costs for chart/table State Department: Health and Human Services State Bureau: Maine Center for Disease Control & Prevention Federal Agency: U.S. Department of Agriculture Assistance Listing Title: Special Supplemental Nutrition Program for Women, Infants, and Children (WIC) (COVID-19) Assistance Listing Number (CFDA): 10.557 Federal Award Identification Number: 204ME743W5003, 204ME701W1003, 204ME701W1006, 214ME7435003, 214ME701W1003, 214ME701W1006, 214ME721W6006, 214ME721W6003 Compliance Area: Subrecipient monitoring Type of Finding: Material weakness Material noncompliance Questioned Costs: None Criteria: 2 CFR 200.303; 7 CFR 246.19 The Department must establish and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. The Department shall establish an ongoing management evaluation system which includes the monitoring of local agency operations, the review of local agency financial and participation reports, the development of corrective action plans to resolve program deficiencies, the monitoring of implementation of the corrective action plans, and on-site visits. The results of such actions must be documented. Monitoring of local agencies must encompass evaluation of management, certification, nutrition education, breastfeeding promotion and support, participant services, civil rights compliance, accountability, financial management systems, and food delivery systems. The Department must conduct monitoring reviews of each local agency at least once every two years. Monitoring must include on-site reviews of a minimum of 20 percent of the clinics in each local agency, or one clinic, whichever is greater. Condition: The Department is required to perform management evaluation reviews (MERs) of each local agency at least once every two years. The Department performed full-year MERs for five of the eight local agencies during fiscal year 2021. In the Office of the State Auditor?s (OSA?s) testing: ? one local agency MER due in May 2019 was not performed until September 2020; ? one local agency MER due in August 2019 was not performed until July 2020; ? one local agency MER due in October 2019 was not performed until December 2020; ? one local agency MER due in February 2020 was not performed until April 2021; and ? one local agency MER due in April 2020 was not performed until May 2021. For all exceptions noted above, the finance portion of the review was not completed. Two local agency MERs due to be performed in fiscal year 2021 were completed subsequent to fiscal year end. OSA did not perform audit testing on these two local agency MERs. Prior year follow-up procedures over one local agency MER that was due but not fully completed in fiscal year 2020 found that the finance portion of the review had not been completed as of audit testing in February 2022. Context: The Department provided $5 million to eight local agencies in fiscal year 2021. Cause: ? Unfilled vacancies from fiscal year 2019 created a backlog of reviews. ? Lack of staff resources available to perform the financial portion of the MERs ? Lack of supervisory oversight Effect: ? The Federal program may not be effectively and efficiently administered. ? Potential questioned costs and disallowances Recommendation: We recommend that the Department: ? implement a process to ensure that the backlog of reviews are completed; ? review its staffing needs to ensure there are adequate resources allocated to the MER process to ensure all portions of the reviews are fully completed; and ? implement additional oversight procedures to ensure all portions of the reviews are fully completed. Corrective Action Plan: See F-11 Management?s Response: The Department agrees with this finding. The Department will implement a process to complete the MERs as time allows and prioritize current year MERs to ensure compliance with the regulation. The Department has hired additional staff to assist with the completion of the MERs. The Department will meet at least quarterly to check on the progress of the MERs. Contact: Ginger Roberts-Scott, Senior Health Program Manager, DHHS, 207-287-5342 (State Number: 21-1113-04)

(2021-020) Title: Internal control over subrecipient awards needs improvement Prior Year Findings: See Schedule of Findings and Questioned Costs for chart/table State Department: Health and Human Services State Bureau: Maine Center for Disease Control & Prevention Division of Contract Management Federal Agency: U.S. Department of Agriculture Assistance Listing Title: Special Supplemental Nutrition Program for Women, Infants, and Children (WIC) (COVID-19) Assistance Listing Number (CFDA): 10.557 Federal Award Identification Number: 204ME743W5003, 204ME701W1003, 204ME701W1006, 214ME7435003, 214ME701W1003, 214ME701W1006, 214ME721W6006, 214ME721W6003 Compliance Area: Subrecipient monitoring Type of Finding: Significant deficiency Questioned Costs: None Criteria: 2 CFR 200.303; 2 CFR 200.332 The Department must establish and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. Awards to subrecipients must include Federal award information that enables subrecipients to identify the source of the Federal award. Condition: The Division of Contract Management (DCM) is responsible for the preparation of subrecipient grant awards. The program information in the awards provided to subrecipients is the responsibility of the Maine Center for Disease Control & Prevention (MeCDC). MeCDC communicates the award information by providing it for upload to the Department of Health and Human Services grants database. DCM then utilizes that database to prepare subrecipient awards and sends drafted subrecipient awards to program personnel at MeCDC for final review. The subrecipient awards must include accurate Federal award identification information to ensure that subrecipients can properly identify the source of the subrecipient awards. For the eight subrecipients who administer the WIC program, all eight subrecipient awards: ? incorrectly identified the Center for Disease Control and Prevention as the Federal awarding agency for the WIC Administrative grant. The U.S. Department of Agriculture is the Federal awarding agency. ? incorrectly identified the Federal Award Identification Number for the WIC Breastfeeding Peer Counsel grant. For one subrecipient who administers the WIC program, the subrecipient award incorrectly identified the Federal Award Identification Number for the WIC Administrative grant. Context: In fiscal year 2021, the Department provided $5 million to the eight subrecipients that administer the WIC program. Cause: ? Lack of adequate internal controls ? Lack of supervisory oversight Effect: Federal pass-through funds may not be correctly reported by subrecipients. Recommendation: We recommend that DCM and MeCDC collaborate on implementation of additional procedures to ensure subrecipient awards are complete, accurate and in accordance with Federal regulations. Corrective Action Plan: See F-11 Management?s Response: The Department agrees with this finding. The Division of Contract Management will collaborate with MeCDC to implement controls to ensure subrecipient awards are complete, accurate and in accordance with Federal regulations. Contact: Jim Lopatosky, Director, Division of Contract Management, DHHS, 207-287-5075 (State Number: 21-1113-02)

(2021-021) Title: Internal control over Unemployment Insurance claim payments needs improvement Prior Year Findings: See Schedule of Findings and Questioned Costs for chart/table State Department: Labor State Bureau: Unemployment Compensation Federal Agency: U.S. Department of Labor Assistance Listing Title: Unemployment Insurance (UI) (COVID-19) Assistance Listing Number (CFDA): 17.225 Federal Award Identification Number: Unemployment Insurance Trust Fund, Maine Compliance Area: Allowable costs/cost principles Eligibility Type of Finding: Material weakness Material noncompliance Questioned costs Questioned Costs: Known questioned costs totaling $2,032,324 in Federal Unemployment Insurance (UI) benefit payments were identified in audit procedures. The details of these totals are included in the Effect section. Likely questioned costs totaling $29.1 million were projected within each entitlement program by dividing the identified ineligible benefit payments by the total benefit payments tested to establish an error rate. The individual error rates were then applied to each entitlement program?s benefit payment totals for fiscal year 2021 to project likely questioned costs. Criteria: 2 CFR 200.303; 20 CFR 615.8; Middle Class Tax Relief and Job Creation Act of 2012; Social Security Act (SSA) Title III, Section 303; Unemployment Insurance Program Letter (UIPL) No. 5-13; Coronavirus Aid, Relief, and Economic Security (CARES) Act; 26 MRSA 1190 through 1199; Emergency Unemployment Insurance Stabilization & Access Act, Section 4102; Unemployment Insurance Program Letter (UIPL) No. 13-20; Continued Assistance for Unemployed Workers Act of 2020; Consolidated Appropriations Act, 2021; American Rescue Plan Act of 2021 The Department must establish and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. A State administering UI must have State laws and policies in place that are consistent with Federal provisions and required by 20 CFR 615.8; the Middle Class Tax Relief and Job Creation Act of 2012; SSA Title III, Section 303; and UIPL No. 5-13, as follows: ? Standards for claim filing and processing including appeals and reviews, communication with claimants and employers, eligibility standards and disqualifications, and Interstate Benefit Payments and agreements ? Standards for reasonable work search criteria and policies requiring performance of internal audits of work search activity ? Standards for program integrity outlining procedures for identification and recovery of overpayments and penalties, including recovery through offset of future benefit payments In March 2020, as a nationwide response to the effects of the COVID-19 pandemic, including rapidly increasing unemployment rates, the Federal Coronavirus Aid, Relief, and Economic Security (CARES) Act was signed into law. The CARES Act created three temporary Federal unemployment compensation entitlement programs that continued in fiscal year 2021, as follows: ? Pandemic Unemployment Assistance (PUA) provides UI benefits for individuals who are not eligible for regular UI benefits and are unemployed, partially unemployed, or unable or unavailable to work due to COVID-19. Covered individuals include the self-employed, independent contractors, part-time workers, and others not normally eligible to receive regular UI benefits. ? Pandemic Emergency Unemployment Compensation (PEUC) provides an additional 13 weeks of UI benefits for unemployed workers who have exhausted regular UI benefits. This was extended to 24 weeks through enactment of the Consolidated Appropriations Act signed into law at the end of December 2020. ? Federal Pandemic Unemployment Compensation (FPUC) initially provided an additional $600 weekly to all unemployed workers receiving traditional UI benefits, PUA or PEUC. This was changed to $300 weekly in December 2020 through enactment of the Consolidated Appropriations Act. On March 17, 2020, the Governor of Maine signed emergency legislation that defines exceptions and waivers to requirements of the State?s UI program. The legislation established as 26 MRSA 1199: ? waives the requirement for the ability and availability to work in order to provide benefits to individuals who are under medical quarantine or temporary layoff due to mandated pandemic-related closures; ? waives the usual one week waiting period for individuals dislocated or temporarily laid off due to mandated pandemic-related closures; and ? expands temporary leaves of absence qualifications to include medical quarantine or isolation restrictions, a COVID-19 exposure or infection, or pandemic-related dependent care needs as long as claimants maintain contact with employers and are expected to return to work. Subsequent to the establishment of 26 MRSA 1199, Section 4102 of the Emergency Unemployment Insurance Stabilization and Access Act (EUISAA) was enacted. This provides states with the ability to modify or waive certain aspects of their unemployment compensation law as needed to respond to the spread of COVID-19. These provisions include work search, waiting week, good cause, and employer experience rating. A state?s regular eligibility requirements regarding work search, waiting week, good cause, and employer experience rating may be modified or waived for a temporary period of time in response to the spread of COVID-19, so long as the state has supporting documentation of the waivers or modifications, such as emergency legislation and Executive Orders in effect for the given period. This is also outlined in Section 5 of UIPL No. 13-20 for emergency flexibilities in response to COVID-19. On September 17, 2020, the Governor of Maine signed additional emergency legislation that reinstated the requirement to conduct work search activities for all UI claimants as of October 4, 2020. The legislation reestablished eligibility requirements set forth in 26 MRSA 1192 Sections (2) and (3) except for individuals in quarantine or isolation due to COVID-19. The Federal Consolidated Appropriations Act signed into law at the end of December 2020 granted extensions of the PUA, PEUC, and FPUC programs to March 2021. This Act also included the Continued Assistance for Unemployed Workers Act which extended the emergency flexibilities identified above; extended the PEUC benefit period to 24 weeks; decreased the FPUC weekly benefit from $600 to $300; and established several new requirements for the CARES Act programs, including identity verification and submission of documentation substantiating employment or self-employment for PUA claims. The Federal American Rescue Plan Act signed into law in March 2021 granted additional extensions of the PUA, PEUC, and FPUC programs through September 2021. Condition: ReEmployME System: Internal control over UI benefit claim payments includes reliance on controls within the ReEmployME information system. The Maine Department of Labor (MDOL) has a service agreement with a vendor for the management and operation of ReEmployME. ReEmployME is used by MDOL to process claims and store claimant information. The Office of the State Auditor (OSA) identified a material weakness for the ReEmployME system as issued in finding number 2021-011. This finding has been redacted in accordance with paragraph 6.63 of the U.S. Government Accountability Office?s Government Auditing Standards as the details are confidential under the provisions of 5 MRSA 244-C(3). The system?s embedded controls over claimant eligibility include, but are not limited to: ? verification that all information is submitted as required by the UI benefit application, ? automated application of the required one week waiting period prior to providing benefits, ? automated generation of employer verification forms for initial claimant applications, ? automated processing of monetary determinations of benefit amounts, and ? a requirement for weekly certifications by the claimant of the ability and availability to work and submission of work search information prior to weekly claim payment processing. ReEmployME?s system controls only verify that there is input into required fields which does not ensure that benefit payments to ineligible claimants are prevented or detected prior to the issuance of benefits. The system is also programmed to proceed with claims processing even when a claimant certifies that all requirements have not been met. In addition, the system cannot verify that employer information entered for verification or work search requirements is legitimate or reasonable. The ReEmployME system generates reports to identify claims requiring follow-up procedures by Department personnel; however, formal review and completion of such procedures is at the Department?s discretion. Department Controls: The Department has complementary controls in place over claimant eligibility, including: ? internal work search audits performed by MDOL personnel required for one percent of weekly claims, and ? establishment of a Benefits Quality Control (BQC) Unit who is tasked with investigating a prescribed number of UI paid claims and denied claims each week. The establishment of new Federal entitlement programs and the enactment of emergency legislation required extensive claims processing modifications by MDOL. In an effort to expedite benefit payments to the citizens of Maine, the Department suspended the following controls over eligibility for all UI entitlement programs starting in March 2020: ? Requirements for weekly certifications of claimant ability and availability for work and work search information ? Requirement for a one week waiting period prior to payment of benefits ? Work search audits ? Weekly BQC Unit investigations of paid and denied claims The Federal government provided authorization to suspend operations of the BQC Unit in fiscal year 2020 and into fiscal year 2021 to realign resources for fraudulent claim investigations. MDOL also suspended other embedded system controls and work search audits. Written authorization from the Federal government was not received prior to suspension; however, Federal legislation was subsequently enacted to authorize the Department?s suspension of controls. In accordance with the State and Federal legislation noted above, MDOL reimplemented controls surrounding eligibility throughout fiscal year 2021, including full reinstatement of traditional work search requirements in May 2021. Audit Testing Results: As part of the initial eligibility determination process, State UI law requires MDOL to confirm claimant separation from employment through correspondence with a claimant?s most recent employer. OSA?s test of 60 regular UI claimants? initial eligibility noted the following exceptions: ? For two claimants, letters to confirm separation were not sent to former employers. ? For two claimants, separation letters were sent to former employers, but were not sent to the claimants? most recent employers as required by State UI law. o In both cases, it was subsequently discovered that the claimant was working while collecting UI benefits, but not self-reporting wages to MDOL as required by program guidelines for use in calculating and issuing partial benefit payments. OSA recognizes that MDOL has established a quarterly wage crossmatch with employer-reported wage data; however, this is not effective in preventing weekly benefit payments to ineligible claimants for the extended periods leading up to quarterly crossmatches. o One of these claimants was deemed ineligible to receive benefits as a result of fraudulent claims activity that was identified by MDOL subsequent to the issuance of benefits. In OSA?s test of 60 regular UI claimants? continuing eligibility, two claimants were deemed ineligible to receive benefits, one of which was identified by MDOL subsequent to the issuance of benefit payments. In addition, noncompliance with work search requirements was identified for two claimants. MDOL fully reimplemented the requirements for traditional work search activities in May 2021. This reimplementation prohibited submission of part-time employment to satisfy work search requirements; however, these two claimants submitted part-time employment as work search activities in June 2021. In OSA?s test of 60 PUA claimants, nine claimants were deemed ineligible to receive benefits. MDOL stopped benefit payments and established overpayments for all nine claimants. The nine exceptions included: ? eight claimants who did not provide proof of employment prior to issuance of benefits and were later deemed ineligible. OSA recognizes that MDOL received guidance from U.S. DOL stating that benefit payments should not be held while awaiting documentation; however, benefits were ultimately issued to ineligible claimants and therefore, are considered exceptions. ? one claimant who was identified as fraudulent subsequent to the issuance of benefits. In OSA?s test of 60 PEUC claimants, one claimant was deemed ineligible to receive benefits and was identified as a fraudulent claim by MDOL subsequent to the issuance of benefits. Benefit payments were stopped and an overpayment was established. The Office of the State Auditor selected non-statistical random samples. Data Analytics: Additional audit procedures included data analytics relating to claimant eligibility. These procedures revealed that: ? 10 ineligible claimants received UI benefit payments from various entitlement programs after their dates of death. These benefit payments totaled over $38,000 through the end of fiscal year 2021. ? based on an analysis of claimant dates of birth, the following claimants received UI benefits during fiscal year 2021: ? 8 claimants under the age of 10; and ? 638 claimants over the age of 80, including: o 608 claimants between the ages of 80 and 89; o 27 claimants between the ages of 90 and 99; and o 3 claimants over the age of 100. MDOL does not have adequate procedures in place to identify and review claimant dates of death as well as the reasonableness of claimant age prior to the issuance of benefit payments. Context: The UI program provided $323 million in State UI benefits and $1 billion in Federal UI benefits during fiscal year 2021. Total UI benefits increased by $261 million from the prior year, which is a direct result of the COVID-19 pandemic. Cause: ? Lack of resources due to the COVID-19 pandemic response prioritization ? Lack of adequate controls over initial and continuing claimant eligibility determinations ? Lack of adequate supervisory oversight over information system application controls ? Lack of adequate policies and procedures to identify and review claimant dates of death and questionable claimant ages prior to the issuance of benefit payments Effect: ? Known Federal questioned costs of $2.03 million comprised of: ? $1.96 million in fraudulent benefit payments; ? approximately $39,000 in benefit payments to claimants deemed ineligible in audit testing; and ? approximately $31,000 in Federal UI benefit payments to claimants after dates of death. ? Potential liability, and applicable interest, due to the Federal government for claims paid to ineligible or fraudulent Federal UI benefit claimants ? Potential questioned costs and disallowances ? The Federal government may impose stricter requirements or eliminate Federal funding available to the State. ? Noncompliance with Federal regulations Recommendation: We recommend that the Department implement additional control procedures, including information system application controls and data analytics procedures, to ensure that eligibility requirements are met and adequately supported prior to issuance of benefit payments. While OSA recognizes the efforts of the Department to maintain program integrity while responding to the extraordinary impacts of a global pandemic, the existing control environment does not provide, and has not historically provided, assurance that all eligibility requirements are met and adequately supported prior to the issuance of benefit payments. Corrective Action Plan: See F-11 Management?s Response: The Department partially agrees with this finding. The finding states that the Department?s system does not ensure that benefit payments to ineligible claimants are prevented or detected prior to the issuance of payments. The Department collects the necessary information to determine initial and ongoing eligibility. It is important to note that both federal and state law prohibit the withholding of payment from someone who is already receiving benefits when a potential eligibility issue is identified. The Department must gather additional information and issue a written determination, which also includes notification of the right to appeal the determination. In the meantime, payments must be made. If the Department issues a determination that the individual was ineligible, an overpayment is created, and repayment is required. The finding further states that the Department has insufficient controls in place to detect possible unreported employment or wages when a transitional (back-to-back) benefit year is filed. The Department will research the availability of any additional tools or programming needed to detect wages reported by employers that have not been reported by claimants when a transitional benefit year is filed. Given the time difference that occurs between when a claim is filed and when an employer is statutorily required to report wages or employment, overpayments that occur when the claimant willfully misrepresents facts cannot be completely avoided. In those circumstances, the repayment of benefits also includes interest and penalties. The finding also states that working part-time should not have been considered as a work search activity after the Department?s return to more traditional work search activities in May 2021. Maine was one of the first states to restore a work search requirement under the Pandemic ? many continued a work search waiver through all of 2021. The Department began partially lifting a work search in 2020, and then moved closer to pre-Pandemic allowed work search activities in May 2021. Though working part-time was not considered a qualified work search activity prior to the pandemic, continued concerns regarding COVID-19 infection, lack of childcare, remote schooling, and businesses opening but not immediately returning to full employment, informed the Department?s decision to continue our earlier decision to allow acceptance of part-time work to satisfy the work search requirement beyond May 2021. This encouraged those who had been unemployed for an extended period to maintain a connection to the workforce by accepting part time work. Neither Maine law nor rules fully define what constitutes a work search, this is set by the Department. People were notified of the change in the activities that would be accepted as satisfying the work search by email, website, and the press. The finding furthermore states that the Department erred in paying benefits to individuals collecting on the Pandemic Unemployment Assistance (PUA) program pending receipt of required proof of employment documentation (POE). When the guidance around PUA POE was released in UIPL 16-20, change 4, the Department reached out via e-mail to USDOL through their dedicated COVID-19 inbox to ask whether claimants should be paid pending receipt of PUA POE. The response from USDOL clearly stated the Department should not hold up benefits pending receipt of PUA POE. States are required to follow federal guidance on these federal programs. The finding states the Department needs additional controls for claims filed after a claimant?s date of death, as well around the claimant?s age when filing a claim for benefits. The Department agrees that the current crossmatch with the state?s Vital Records office that identifies deceased claimants should be enhanced. As with reporting of quarterly wages, there are timing differences that cannot be avoided, and overpayments cannot be completely ruled out. Overpayments, penalties, and prosecutions are all considered when it is determined someone falsely filed for benefits using a deceased person?s information. Regarding the age of the individual filing for benefits, controls will be reviewed and enhanced where appropriate. Of the three claimants identified as being over 100 years old, two were eligible for the benefits they received. The third required a correction to the person?s date of birth. Contact: Laura Boyett, Director, Bureau of Unemployment Compensation, DOL, 207-621-5156 Auditor?s Concluding Remarks: Management?s Response states that the Department collects necessary information to determine initial and continuing claimant eligibility prior to benefit issuance; however, several exceptions included in the finding were the result of a failure to solicit or collect required documentation in support of eligibility for claimants across multiple entitlement programs. Regarding Management?s Response relating to transitional benefit years, this finding identified four claimants where correspondence was not sent to former employers, including two with transitional benefit year filings. Management?s Response further states that Maine law does not fully define what constitutes work search activities. OSA recognizes that 26 MRSA 1192 Section (2) states that claimants must ?provide evidence of work search efforts in a manner and form as prescribed by the Department of Labor.? In September 2020, the Governor of Maine signed emergency legislation that reinstated the requirement to conduct work search activities for all UI claimants as of October 4, 2020. The legislation restored all eligibility requirements set forth in 26 MRSA 1192 except for individuals in quarantine or isolation due to COVID-19. While the emergency legislation specifically addresses an expanded definition of ?work search? to include work-related activities such as attending skill development seminars or networking events, part-time employment is not addressed. Part-time employment was not a permissible work search activity prior to the COVID-19 pandemic; therefore, it would not be included in the full reinstatement of eligibility requirements ordered by the Governor and effective October 4, 2020. For PUA eligibility, OSA acknowledges that MDOL received guidance from U.S. DOL stating that benefit payments should not be held while awaiting documentation; however, benefits were ultimately issued to claimants who did not provide proof of employment prior to issuance of PUA and were later determined to be ineligible. MDOL did not have controls in place to prevent payments to ineligible claimants and/or detect and correct such payments in a timely manner. Timing differences for weekly claim filings and claimant dates of death cannot be entirely prevented; however, existing controls can be enhanced to prevent overpayments, including an increased frequency and review of the crossmatch with State Vital Records. Regarding ages of individuals filing for benefits, implementation of additional controls such as routine data analytics to identify outliers would assist in preventing, or detecting and correcting, payments to ineligible claimants. The finding remains as stated. (State Number: 21-1302-01)

(2021-022) Title: Internal control over agency Schedule of Expenditures of Federal Awards submissions needs improvement Prior Year Findings: None State Department: Labor Administrative and Financial Services State Bureau: Unemployment Compensation Security and Employment Service Center Office of the State Controller Federal Agency: U.S. Department of Labor U.S. Department of Homeland Security Assistance Listing Title: Unemployment Insurance (UI) (COVID-19) Presidential Declared Disaster Assistance to Individuals and Households - Other Needs (COVID-19) Assistance Listing Number (CFDA): 17.225; 97.050 Federal Award Identification Number: Unemployment Insurance Trust Fund, Maine; 4522DRMESPLW Compliance Area: Reporting Type of Finding: Material weakness Material noncompliance Questioned Costs: None Criteria: 2 CFR 200.303; 2 CFR 200.510 The Department must establish and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. The Department must prepare a Schedule of Expenditures of Federal Awards (SEFA) for the period covered by the State?s financial statements which must include the total Federal awards expended. At a minimum, the SEFA must provide total Federal awards expended for each individual Federal program and the Assistance Listing Number (ALN). Condition: The Department must complete and submit exhibits and related schedules to the Office of the State Controller (OSC) at the close of each fiscal year to report Federal award information for inclusion on the State?s SEFA. OSC is responsible for compiling this information on behalf of the State. In fiscal year 2021, the Department received funding for Lost Wages Supplemental Payment Assistance (LWSPA) under ALN 97.050 Presidential Declared Disaster Assistance to Individuals and Households - Other Needs. At the close of the fiscal year, the Department and its Service Center provided a summary of Federal expenditures to OSC that identified amounts as LWSPA. In compiling and preparing the SEFA, OSC erroneously reported LWSPA as ALN 17.225 Unemployment Insurance (UI) expenditures. Subsequent supervisory review procedures did not detect this error. As a result, LWSPA funding from the U.S. Department of Homeland Security was omitted from the State?s fiscal year 2021 SEFA when provided to the Office of the State Auditor (OSA) for audit purposes. This error was discovered by OSA while reviewing UI program activity and was subsequently corrected by OSC. Context: LWSPA expenditures totaling $106.9 million were incorrectly reported on the SEFA as UI expenditures, resulting in an omission of a Federal program and an overstatement of UI expenditures. Cause: ? Lack of adequate internal control relating to Department SEFA submissions to OSC ? Lack of adequate review procedures Effect: Incomplete or inaccurate amounts by Federal program and ALN on the SEFA would result in noncompliance with Federal regulations if undetected. The SEFA is submitted to the Federal government and may be used for programmatic, policy or statistical purposes. Recommendation: We recommend that the Department and Service Center work with the Office of the State Controller to improve SEFA submission and subsequent review procedures to ensure Federal program expenditures are reported accurately. Corrective Action Plan: See F-12 Management?s Response: The Departments agree with this finding. An administrative oversight resulted in the reporting of one grant?s expenditures as part of another grant on the SEFA. It is important to note that these expenditures were appropriately recorded separately under each ALN in the state?s accounting system. The element of completeness for the total of expenditures was considered; however, the completeness by grant was not adequately reviewed. Going forward an additional control will be implemented, verifying that each ALN is accurately presented on the SEFA. Contact: Thomas Randall, Financial Coordinator/Audit Analyst, OSC, 207-626-8492 (State Number: 21-1302-02)

(2021-023) Title: Internal control over education expenditures charged to the Coronavirus Relief Fund needs improvement Prior Year Findings: None State Department: Education State Bureau: Office of Federal Emergency Relief Programs Federal Agency: U.S. Department of the Treasury Assistance Listing Title: Coronavirus Relief Fund (COVID-19) Assistance Listing Number (CFDA): 21.019 Federal Award Identification Number: SLT0029, SLT0081 Compliance Area: Allowable costs/cost principles Type of Finding: Significant deficiency Questioned costs Questioned Costs: The Office of the State Auditor (OSA) tested a sample of 60 payments to subrecipients and contractors charged to the Coronavirus Relief Fund (CRF). OSA identified one exception with known questioned costs totaling $27,169. Likely questioned costs cannot be determined due to the variety of activity within the subrecipient expenditure population. The projection of questioned costs utilizing the error rate related to the known exception and amounts tested would not produce a reasonable estimate of likely questioned costs. Criteria: 2 CFR 200.303; Coronavirus Aid, Relief, and Economic Security (CARES) Act Section 5001; Consolidated Appropriations Act, 2021; Federal Register Volume 86, Issue 10 (January 15, 2021) The Department must establish and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. Section 5001 of the CARES Act outlines the following criteria for use of funds from CRF: ? Costs must be necessary expenditures incurred due to the public health emergency with respect to Coronavirus Disease 2019 (COVID-19); ? Costs were not accounted for in the State?s budget most recently approved as of the date of enactment of the CARES Act (March 27, 2020 for the State of Maine); and ? Costs must be incurred during the period that begins on March 1, 2020, and ends on December 31, 2020. The original period of performance for CRF as established by the CARES Act was extended to December 31, 2021, through enactment of the Consolidated Appropriations Act in December 2020. Final Treasury Guidance for the CRF was published in the Federal Register, Volume 86, Issue 10 in January 2021. The guidance includes information specific to real property and equipment acquisitions, by stating that the use of payments to acquire or improve property is limited to that which is necessary due to the COVID-19 public health emergency. Condition: In April 2020, the State was advanced $1.25 billion in Federal funds from the CRF as part of the CARES Act. The Department of Education (DOE) requested and received Federal Coronavirus Relief Funding from the Department of Administrative and Financial Services and the Governor?s Office to administer DOE programs in response to the COVID-19 pandemic. DOE receives, reviews, and approves funding requests and subsequent reimbursements of CRF for Local Education Agencies (LEAs). OSA tested a sample of 60 payments to CRF subrecipients and contractors, which included 33 reimbursements to LEAs. Included in the 33 reimbursements was an April 2021 reimbursement of $27,169 for the purchase of a new 2020 GEM e6 electric vehicle for school campus athletics. Supporting documentation for the reimbursement did not provide adequate evidence to support that this was a necessary expenditure incurred due to the public health emergency as required by Federal guidance. The Office of the State Auditor selected a non-statistical random sample. OSA completed additional procedures over LEA funding requests in December 2020, which was the original end of the CRF period of performance prior to an extension. Through these procedures, OSA identified $1.9 million in approved CRF reimbursements to LEAs for property and equipment acquisitions, including a truck, tractor, utility vehicles, snow removal equipment, permanent buildings, and building expansions. Supporting documentation for the reimbursements may or may not provide adequate evidence to support that these were necessary expenditures incurred due to the public health emergency. Context: DOE?s CRF payments to LEAs accounted for $259 million of the $777.4 million in CRF expenditures in fiscal year 2021. Cause: ? Lack of established policies and procedures to ensure that only necessary expenditures are charged to the Federal program ? Lack of explicit Federal guidance surrounding CRF allowability Effect: ? Potential noncompliance with Federal regulations ? Known and potential questioned costs and disallowances Recommendation: We recommend that DOE review expenditures reimbursed to LEAs using CRF, including the above noted expenditures, to ensure that documentation supports the necessity of the costs in relation to the public health emergency and that only allowable costs are funded by the CRF. All unallowable costs should be transferred out of the CRF. Corrective Action Plan: See F-12 Management?s Response: The Department partially agrees with this finding. The Office of Federal Emergency Relief Programs has written justification of the projects and expenses that were proposed by the school administrative units to prepare, prevent, and respond to the COVID-19 pandemic. Each written justification was reviewed and discussed to determine allowability, reasonableness, and necessity during our team review sessions. The Office of Federal Emergency Relief Programs conferred with the guidance and with our US. Department of Education?s program officer throughout the review process. The Office of Federal Emergency Relief Programs made the required determination related to the statutory requirements and nature of the funding but failed to document those decisions separately from the application approvals. We acknowledge that the discussions to determine allowability, reasonableness, and necessity for the intended use may not have been fully documented due to the emergency needs and time-sensitive nature of the funding. Once the applications were approved, the school may submit for reimbursement to cover approved costs that were incurred between March 1, 2020 and June 30, 2021. The reimbursement requests were reviewed by the Office of Federal Emergency Relief Programs and only purchases that aligned to the projects in the approved application were processed for payment. The process complied with US Treasury guidance on use of CRF in the following ways: The expenses to be covered through CRF reflect critical and time sensitive needs; the expenses are directly due to the Covid-19 pandemic; the expenses were not previously budgeted items and will not supplant existing resources; and the expenses will not be reimbursed by any other funding source. The approved projects and expenses were the documented justification for the expenses that were approved in the invoice review process. While the Office of Federal Emergency Relief Programs acknowledges that documentation of the discussion about the determination for allowability, reasonableness and necessity should have been maintained, the Office can confirm that these expenses were: to prepare, prevent, and respond to COVID-19; for an allowable use; and, were reasonable and necessary. Contact: Shelly Chasse-Johndro, Director of OFERP, DOE, 207-458-3180 Auditor?s Concluding Remarks: Supporting documentation provided by the State?s Office of Federal Emergency Relief Programs for the reimbursement of $27,169 for a campus athletics vehicle did not provide adequate evidence that this was a necessary, reasonable, and allowable expenditure incurred due to the public health emergency. Without documentation and evidence to substantiate that the expenditures noted in the Condition are for critical and time sensitive needs directly arising from the public health emergency, OSA cannot determine that the reimbursements were in fact to prepare for, prevent, and respond to COVID-19; were allowable; and were reasonable and necessary. The finding remains as stated. (State Number: 21-1690-05)

(2021-024) Title: Internal control over payroll transfers to the Coronavirus Relief Fund needs improvement Prior Year Findings: None State Department: Administrative and Financial Services State Bureau: Corrections Service Center Security and Employment Service Center Office of the State Controller Federal Agency: U.S. Department of the Treasury Assistance Listing Title: Coronavirus Relief Fund (COVID-19) Assistance Listing Number (CFDA): 21.019 Federal Award Identification Number: SLT0029, SLT0081 Compliance Area: Allowable costs/cost principles Period of performance Type of Finding: Significant deficiency Questioned costs Questioned Costs: The Office of the State Auditor (OSA) tested a sample of 60 payroll transactions charged to the Coronavirus Relief Fund (CRF). OSA identified known questioned costs totaling $4,867. Likely questioned costs cannot be determined. The known questioned costs were a result of a nonroutine component included in the audit test sample; therefore, the projection of questioned costs utilizing the error rate related to the known exceptions and amounts tested would not produce a reasonable estimate of likely questioned costs. Criteria: 2 CFR 200.303; Coronavirus Aid, Relief, and Economic Security (CARES) Act Section 5001; Federal Register Volume 86, Issue 10 (January 15, 2021); Consolidated Appropriations Act, 2021 The Department must establish and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. Section 5001 of the CARES Act outlines the following criteria for use of funds from CRF: ? Costs must be necessary expenditures incurred due to the public health emergency with respect to Coronavirus Disease 2019 (COVID-19); ? Costs were not accounted for in the State?s budget most recently approved as of the date of enactment of the CARES Act (March 27, 2020 for the State of Maine); and ? Costs must be incurred during the period that begins on March 1, 2020 and ends on December 31, 2020. The U.S. Department of the Treasury (Treasury) published final guidance for CRF in the Federal Register, Volume 86, Issue 10, dated January 15, 2021. The Federal Register?s CRF Guidance establishes the following: ? Payments from the CRF are not administered as part of a traditional grant program and thus the Cost Principles provisions of the Uniform Guidance applicable to grant agreements do not apply. As a result, the authoritative guidance for allowability of CRF costs falls to the Treasury?s Guidance as published in the Federal Register. ? A cost is considered incurred when the performance or delivery of services related to an obligation occurs, and payment of funds need not be made at that time. ? The intent behind the Fund was not to provide general fiscal assistance to state governments but rather to assist them with COVID-19 related necessary expenditures. The original period of performance for CRF as established by the CARES Act was extended to December 31, 2021, through enactment of the Consolidated Appropriations Act in December 2020. Condition: In April 2020, the State was advanced $1.25 billion in Federal funds from the CRF as part of the CARES Act. The Governor?s Office administers the CRF in conjunction with the Office of the State Controller (OSC) and other State agencies. During fiscal year 2021, on behalf of the Department of Corrections and the Department of Public Safety, the Corrections Service Center (CSC) and the Security and Employment Service Center (SESC) prepared and processed journal transfers of payroll expenditures from the General Fund to CRF. In OSA?s test of 60 payroll transactions within the journal transfers to CRF, the following exceptions were noted: ? In November 2020, CSC prepared and processed a journal transfer of payroll expenditures to the CRF which included a vacation time and compensatory time payout to an employee upon termination. This termination payout included $3,421 for vacation time and compensatory time earned and accrued by the employee prior to March 1, 2020. ? In December 2020, SESC prepared and processed a journal transfer of payroll expenditures to the CRF which included a compensatory time payout to a current employee. This payout totaled $1,446 and represented compensatory time earned and accrued by the employee prior to March 1, 2020. The leave payouts noted above relate to obligations that the State incurred as leave time was earned by the employee. Leave time earned throughout employment and incurred prior to March 1, 2020, is not within the covered period of performance for CRF allowability. The reporting of such leave payout expenses in other Federal grant award programs would be allowable under the Uniform Guidance, but where CRF payments are not classified as such, special consideration must be given to the required period of performance and related allowability. The Office of the State Auditor selected a haphazard sample. Context: CSC transferred $72.8 million Department of Corrections payroll expenditures and SESC transferred $22.1 million Department of Public Safety payroll expenditures to CRF during fiscal year 2021. Payroll expenditures accounted for $118.5 million of the $777.4 million in CRF expended during fiscal year 2021. Cause: ? Controls were not adequate to ensure that payroll transfers were in compliance with evolving Federal guidance for the newly established CRF program. ? The State believes the above noted exceptions were allowable based on its interpretation of Federal guidance surrounding CRF payroll costs. Effect: ? Known questioned costs that the State may be required to repay to the Federal government if it is not able to replace such costs with allowable costs incurred by December 31, 2021 ? Noncompliance with Federal regulations Recommendation: We recommend that SESC, CSC and OSC review payroll expenditures transferred to the CRF to ensure that only allowable costs are funded by the CRF. All unallowable costs, including the vacation time and compensatory time payouts noted above, should be transferred out of the CRF and charged to the originating fund. Corrective Action Plan: See F-12 Management?s Response: The Departments disagree with this finding. Payroll costs are incurred when the service is provided; however, the cost of leave benefits (including vacation, sick and compensatory time) is not incurred until claimed by the employee. The cost of benefits in question were claimed by substantially dedicated public safety employees during the period of performance in accordance with CRF guidance. Contact: Shirley Browne, Deputy State Controller, Office of the State Controller, 207-626-8423 Auditor?s Concluding Remarks: The State is liable for and obligated to pay the cost of leave benefits as leave is earned by employees. The leave benefit payouts noted as exceptions and reported as questioned costs were earned throughout employment prior to March 1, 2020; therefore, the obligations existed prior to the start of the CRF period of performance and do not meet allowability requirements. The finding remains as stated. (State Number: 21-1690-02)

(2021-025) Title: Internal control over subrecipient risk evaluation procedures needs improvement Prior Year Findings: None State Department: Health and Human Services State Bureau: Division of Audit Division of Contract Management Federal Agency: U.S. Department of the Treasury Assistance Listing Title: Coronavirus Relief Fund (COVID-19) Assistance Listing Number (CFDA): 21.019 Federal Award Identification Number: SLT0029, SLT0081 Compliance Area: Subrecipient monitoring Type of Finding: Significant deficiency Questioned Costs: None Criteria: 2 CFR 200.303; 2 CFR 200.332 The Department must establish and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. The Department is required to evaluate each subrecipient?s risk of noncompliance with Federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate subrecipient monitoring procedures described in 2 CFR 200.332. Condition: In April 2020, the State was advanced $1.25 billion in Federal funds from the Coronavirus Relief Fund (CRF) as part of the Coronavirus Aid, Relief, and Economic Security (CARES) Act. The Department requested and received Federal Coronavirus Relief Funding from the Department of Administrative and Financial Services and the Governor?s Office to administer Health and Human Services (HHS) programs in response to the COVID-19 pandemic. The Department then passed through CRF to subrecipients to help support these HHS programs. The Office of the State Auditor tested a sample of 60 subrecipients paid by various State agencies under the CRF program, including three HHS subrecipients, to ensure that proper subrecipient monitoring was performed as required by Federal regulations. HHS subrecipient monitoring procedures included providing Federal award information in grant award agreements, communicating program guidelines, establishing reporting requirements, providing technical assistance, and communicating with the subrecipients to discuss program performance; however, the Department could not provide evidence to demonstrate that monitoring procedures were established in response to an evaluation of the subrecipient?s risk of noncompliance with CRF subrecipient awards for the three HHS subrecipients tested. The Office of the State Auditor selected a non-statistical random sample. Context: The State passed through $564 million in CRF to subrecipients in fiscal year 2021, which included $14.1 million to 161 HHS subrecipients. Cause: ? Competing priorities related to an increase in aid requests as a result of COVID-19 ? Lack of adequate procedures Effect: ? Without a documented process, subrecipient risk evaluation procedures may not be consistently followed and documentation may not be adequately maintained. ? Subrecipients that are deemed higher risk may not be monitored on a more frequent basis. Conversely, subrecipients that are deemed lower risk may not be monitored on a less frequent basis, which would free resources and time to dedicate towards other higher risk subrecipients. Recommendation: We recommend that the Department implement procedures to maintain adequate documentation of subrecipient risk assessments, including the evaluation of each subrecipient?s risk of noncompliance specifically for the purposes of determining the appropriate subrecipient monitoring to be performed. Corrective Action Plan: See F-13 Management?s Response: The Department disagrees with this finding. In the middle of a pandemic the Department contracted with many new providers in order to prevent the spread of COVID-19 infections by creating local prevention plans and providing education to businesses and towns. Many of these contracts were limited period contracts (4 months) and guidance from the Federal government was to promote flexibility in the disbursement of these funds. The Department, knowing that the timing of contracting and disbursing these funds was critical and that many of these providers were new to contracting with the State, recognized these providers as "high risk". Recognizing these providers as "high risk", the Department utilized 2 of the 3 suggested monitoring tools in the Uniform Guidance based on the assessment of risk posed by the subrecipients. Those tools, 1) providing subrecipients with training and technical assistance and 2) arranging for agreed-upon procedures engagements, which is built into the Department's Maine Uniform Accounting and Auditing Practices for Community Agencies (MAAP) were required and performed for all of these subrecipients. The third monitoring tool identified in the Uniform Guidance related to high risk subrecipients, performing on-site visits of subrecipient's program operations, was not practical in the middle of the pandemic. Contact: Tony Madden, Deputy Director, Division of Audit, DHHS, 207-287-2834 Auditor?s Concluding Remarks: The Department disagrees with the finding; however, the deficiencies identified in the Condition are not disputed in Management?s Response. Despite the COVID-19 pandemic and its impact on HHS programs, Federal regulations requiring pass-through entities to evaluate each subrecipient's risk of noncompliance with Federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate subrecipient monitoring remained in effect. In addition, the Department asserts that subrecipients were recognized as ?high risk? in relation to noncompliance with CRF subrecipient awards. The Department did not provide evidence, including subrecipient risk evaluations demonstrating a high risk designation, to support this assertion. The finding remains as stated. (State Number: 21-1690-04)

(2021-026) Confidential finding, see below for more information Title: ________ over ________ needs improvement Pursuant to paragraph 6.63 of the U.S. Government Accountability Office?s Government Auditing Standards (also known as the Yellow Book), we omitted details from this finding as they are confidential under the provisions of 5 MRSA 244-C (3). Though the content of this finding has been redacted, which appears as blank underlining, we provided the Department(s) with detailed information regarding the specific condition we identified, as well as the related criteria, context, causes, effects, and our specific recommendations for improvement. Prior Year Findings: None State Department: Administrative and Financial Services State Bureau: Office of the State Controller Office of Information Technology Federal Agency: U.S. Department of the Treasury U.S. Department of Health and Human Services Assistance Listing Title: Coronavirus Relief Fund (COVID-19) Immunization Cooperative Agreements (COVID-19) Epidemiology and Laboratory Capacity for Infectious Diseases (ELC) (COVID-19) Assistance Listing Number (CFDA): 21.019; 93.268; 93.323 Federal Award Identification Number: SLT0029, SLT0081; NH23IP922604; NU50CK000523 Compliance Area: Allowable costs/cost principles Type of Finding: Significant deficiency Questioned Costs: None Criteria: ________ Condition: ________ Context: ________ Cause: ________ Effect: ________ Recommendation: ________ Corrective Action Plan: See F-13 Management?s Response: ________ Contact: Soumia Tber, Payroll, Personnel Authorization Supervisor, OSC, 207-626-8420 (State Number: 21-0902-01)

(2021-027) Confidential finding, see below for more information Title: ________ over the ________ system needs improvement Pursuant to paragraph 6.63 of the U.S. Government Accountability Office?s Government Auditing Standards (also known as the Yellow Book), we omitted details from this finding as they are confidential under the provisions of 5 MRSA 244-C (3). Though the content of this finding has been redacted, which appears as blank underlining, we provided the Department(s) with detailed information regarding the specific condition we identified, as well as the related criteria, context, causes, effects, and our specific recommendations for improvement. Prior Year Findings: None State Department: Education State Bureau: School Finance and Operations Federal Agency: U.S. Department of Education Assistance Listing Title: Education Stabilization Fund (ESF) (COVID-19) Title I Grants to Local Educational Agencies Coronavirus Relief Fund (COVID-19) Assistance Listing Number (CFDA): 84.425D; 84.010; 21.019 Federal Award Identification Number: S425D200004, S425D210004; S010A180019, S010A190019 S010A200019; SLT0081, SLT0029 Compliance Area: Allowable costs/cost principles Reporting Type of Finding: Significant deficiency Questioned Costs: None Criteria: ________ Condition: ________ Context: ________ Cause: ________ Effect: ________ Recommendation: ________ Corrective Action Plan: See F-13 Management?s Response: ________ Contact: Katherine Warren, Education Data Systems Manager, DOE, 207-592-1793 (State Number: 21-0909-03)

(2021-028) Confidential finding, see below for more information Title: ________ over ________, ________, and ________ needs improvement Pursuant to paragraph 6.63 of the U.S. Government Accountability Office?s Government Auditing Standards (also known as the Yellow Book), we omitted details from this finding as they are confidential under the provisions of 5 MRSA 244-C (3). Though the content of this finding has been redacted, which appears as blank underlining, we provided the Department(s) with detailed information regarding the specific condition we identified, as well as the related criteria, context, causes, effects, and our specific recommendations for improvement. Prior Year Findings: None State Department: Education State Bureau: School Finance and Operations Federal Agency: U.S. Department of Education Assistance Listing Title: Education Stabilization Fund (ESF) (COVID-19) Title I Grants to Local Educational Agencies Coronavirus Relief Fund (COVID-19) Assistance Listing Number (CFDA): 84.425D; 84.010; 21.019 Federal Award Identification Number: S425D200004, S425D210004; S010A180019, S010A190019 S010A200019; SLT0081, SLT0029 Compliance Area: Allowable costs/cost principles Reporting Type of Finding: Significant deficiency Questioned Costs: None Criteria: ________ Condition: ________ Context: ________ Cause: ________ Effect: ________ Recommendation: ________ Corrective Action Plan: See F-14 Management?s Response: ________ Contact: Katherine Warren, Education Data Systems Manager, DOE, 207-592-1793 (State Number: 21-0909-04)

(2021-029) Title: Internal control over special reporting needs improvement Prior Year Findings: None State Department: Economic and Community Development State Bureau: Commissioner?s Office Federal Agency: U.S. Department of the Treasury Assistance Listing Title: Emergency Rental Assistance Program (COVID-19) Assistance Listing Number (CFDA): 21.023 Federal Award Identification Number: ERA0299, ERA0434 Compliance Area: Reporting Type of Finding: Material weakness Material noncompliance Questioned Costs: None Criteria: 2 CFR 200.303; 2 CFR 170 The Department must establish and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. Agencies must report each subaward that equals or exceeds the first-tier subaward threshold of $30,000 in Federal funds in the public-facing Federal Funding Accountability and Transparency Act (FFATA) Subaward Reporting System. Condition: When a subaward exceeding the first-tier threshold is awarded to a subrecipient, the Department must collect and enter data into the FFATA Subaward Reporting System. The Department did not report its subawards under the Emergency Rental Assistance (ERA) program in the reporting system in fiscal year 2021. Context: In fiscal year 2021, the Department disbursed $66.7 million in first-tier subawards from the ERA program to a subrecipient. First-tier subawards account for 100 percent of the program?s fiscal year expenditures. Cause: ? Competing priorities related to an increase in aid requests as a result of COVID-19 ? Lack of resources ? Lack of policies and procedures Effect: Noncompliance with Federal regulations Recommendation: We recommend that the Department implement policies and procedures to ensure that FFATA reporting is completed for all subawards that meet or exceed the first-tier threshold. Corrective Action Plan: See F-14 Management?s Response: The Department agrees with this finding. Due to the evolving reporting requirements for the Emergency Rental Assistance program the Department did not identify the FFATA requirements and did not submit accordingly. Existing policies and procedures will be modified to ensure FFATA reporting is completed for all subawards that meet or exceed the first-tier threshold. Contact: Denise Garland, Deputy Commissioner, DECD, 207-624-7496 (State Number: 21-1695-01)

(2021-030) Title: Internal control over suspension and debarment procedures needs improvement Prior Year Findings: None State Department: Economic and Community Development State Bureau: Commissioner?s Office Federal Agency: U.S. Department of the Treasury Assistance Listing Title: Emergency Rental Assistance Program (COVID-19) Assistance Listing Number (CFDA): 21.023 Federal Award Identification Number: ERA0299, ERA0434 Compliance Area: Procurement and suspension and debarment Type of Finding: Significant deficiency Questioned Costs: None Criteria: 2 CFR 200.303; 2 CFR 180.220; 2 CFR 180.300 The Department must establish and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. Non-Federal entities are prohibited from contracting with or making subawards under covered transactions to parties that are suspended or debarred. ?Covered transactions? include contracts for goods and services awarded under a non-procurement transaction (e.g., grant or cooperative agreement) that are expected to equal or exceed $25,000 or meet certain other criteria as specified in 2 CFR 180.220. When a non-Federal entity enters a covered transaction with an entity at a lower tier, the non-Federal entity must verify that the entity is not suspended or debarred or otherwise excluded from participating in the transaction. This verification may be accomplished by (1) checking the System for Award Management (SAM) Exclusions, (2) collecting a certification from the entity, or (3) adding a clause or condition to the covered transaction with that entity. Condition: In fiscal year 2021, the Department entered into a Memorandum of Understanding with one subrecipient to administer the Emergency Rental Assistance (ERA) program. The Department did not obtain assurance that the subrecipient was not suspended or debarred before entering into the covered transaction. Context: The Department advanced this subrecipient $66.7 million to administer the ERA program in fiscal year 2021. Cause: The Department does not have procedures in place to ensure that subrecipients are not suspended or debarred from receiving Federal assistance. Effect: The State could enter into a covered transaction with a suspended or debarred party, which could result in Federal disallowances. Recommendation: We recommend that the Department establish procedures to verify that subrecipients are not suspended, debarred, or otherwise excluded from participating in Federal programs prior to issuing subawards. Corrective Action Plan: See F-14 Management?s Response: The Department agrees with this finding. The arrangement with the subrecipient was made through a Memorandum of Understanding that failed to incorporate the standard suspension and debarment language included in the normal State of Maine contract. The Department will implement policies and procedures to ensure that future engagements made with subrecipients through the use of a Memorandum of Understanding will incorporate the required suspension and debarment language. The Department will update the Memorandum of Understanding with the subrecipient administering the Emergency Rental Assistance program to obtain assurance that the subrecipient is not suspended or debarred. Contact: Denise Garland, Deputy Commissioner, DECD, 207-624-7496 (State Number: 21-1695-02)

(2021-031) Title: Internal control over Title I, Part A award allocations needs improvement Prior Year Findings: None State Department: Education State Bureau: Learning Systems Federal Agency: U.S. Department of Education Assistance Listing Title: Title I Grants to Local Educational Agencies Assistance Listing Number (CFDA): 84.010 Federal Award Identification Number: S010A200019 Compliance Area: Eligibility Matching, level of effort, earmarking Special tests and provisions Type of Finding: Significant deficiency Questioned Costs: None Criteria: 2 CFR 200.303; 34 CFR 200.70 through 78; 34 CFR 200.100 The Department must establish and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. The Department is responsible for adjusting the U.S. Department of Education (DOE) grant allocations to school districts for eligible charter schools, to reserve funds for school improvement activities, and to maintain hold harmless protection limits. Condition: Title I Grants to Local Educational Agencies (Title I, Part A) funds are distributed to school districts to support the education of Maine?s economically disadvantaged students. The allocation of grant funds is calculated annually utilizing a spreadsheet. The allocation spreadsheet adjusts the U.S. DOE?s grant allocations to account for eligible new districts, set aside funds for school improvement activities, and to maintain hold harmless protection limits. Department procedures require a supervisory review of the allocation spreadsheet using a reviewer checklist to ensure the spreadsheet formulas are calculating correctly and certain programmatic requirements are met. The Title I, Part A grant allocation spreadsheet for the 2020-2021 school year was not reviewed by a supervisor as required by Department procedures. Context: The Department provided $48 million of Title I, Part A funds to Maine school districts in fiscal year 2021. Cause: ? Lack of supervisory oversight due to management turnover ? Established policies and procedures were not adhered to due to a change in the control environment resulting from the COVID-19 pandemic. Effect: ? Undetected errors in the grant allocation spreadsheet could negatively impact the ability of school districts to respond to the unique needs of economically disadvantaged students. ? Other Federal programs rely on Title I, Part A grant allocations to determine school district funding. An undetected error in the grant allocation spreadsheet could impact school district funding over multiple Federal programs. ? Potential noncompliance with eligibility and earmarking requirements Recommendation: We recommend that the Department enhance existing policies and procedures to ensure supervisory review of the Title I, Part A grant allocation prior to finalizing allocations of grant funding to school districts. Corrective Action Plan: See F-14 Management?s Response: The Department agrees with this finding. The ESEA Federal Programs Department has policies and procedures in place to complete a comprehensive supervisory review checklist, which verifies the accuracy of Title I funding, prior to school district allocations. This finding was the result of turnover in management and the need for Department employees to work remotely due to the COVID-19 pandemic. Based on these causes, the ESEA team is reviewing and updating the policies and procedures, where necessary, regarding the supervisory review of all Title allocations, including Title I, prior to finalizing allocations of grant funding to school districts. Contact: Cheryl L. Lang, ESEA Federal Programs Director, DOE, 207-441-8059 (State Number: 21-1208-01)

(2021-032) Title: Internal control over special reporting needs improvement Prior Year Findings: None State Department: Education State Bureau: Commissioner?s Office Learning Systems Federal Agency: U.S. Department of Education Assistance Listing Title: Education Stabilization Fund (ESF) (COVID-19) Title I Grants to Local Educational Agencies Assistance Listing Number (CFDA): 84.425D; 84.010 Federal Award Identification Number: S425D210004; S010A200019 S010A190019, S010A180019 Compliance Area: Reporting Type of Finding: Significant deficiency Questioned Costs: None Criteria: 2 CFR 200.303; 2 CFR 170 The Department must establish and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. Agencies must report each subaward that equals or exceeds the first-tier subaward threshold of $30,000 in Federal funds in the public-facing Federal Funding Accountability and Transparency Act (FFATA) Subaward Reporting System. Condition: When a subaward exceeding the first-tier subaward threshold is awarded to a subrecipient, the Department must collect and enter data into the FFATA subaward Reporting System. In the Office of the State Auditor?s test of 60 subawards that exceeded the first-tier subaward threshold, the following FFATA reporting exceptions were identified: ? 27 subawards under the Education Stabilization Fund program listed an incorrect project description. ? One subaward totaling $147,794 was reported with an incorrect Data Universal Numbering System (DUNS) number. ? Two subawards totaling $397,174 were incorrectly reported for Education in the Unorganized Territories (EUT). These are not subrecipient subawards as the EUT is governed by the State. ? One subaward totaling $162,266 was reported twice. Additionally, the Department could not provide evidence that the FFATA reports were reviewed by a secondary person prior to submission in the FFATA Subaward Reporting System to ensure that information entered was accurate and complete. The Office of the State Auditor selected a non-statistical random sample. Context: During fiscal year 2021, the Department obligated $219.4 million in first-tier subawards to 188 subrecipients from the Education Stabilization Fund and Title I Grants to Local Educational Agencies programs. Of the 188 subrecipients, 182 subrecipients had subawards that exceeded the first-tier subaward threshold. These 182 subawards totaled approximately $218.2 million in fiscal year 2021. Cause: ? Lack of supervisory review ? Lack of policies and procedures Effect: Inaccurate, incomplete, or untimely information was and may continue to be reported to the Federal government. This information may be used for programmatic, policy or statistical purposes. Recommendation: We recommend that the Department implement policies and procedures to ensure all subawards that meet or exceed the first-tier threshold are reported accurately, timely, and in accordance with Federal regulations. We also recommend that the Department retain documentation of supervisory review for each FFATA report submitted in the FFATA Subaward Reporting System. Corrective Action Plan: See F-15 Management?s Response: The Department agrees with this finding. The Department will implement a procedure to ensure subawards that meet or exceed the first-tier threshold are reported accurately, timely and in accordance with Federal regulations. Additionally, FFATA reports will be reviewed by a second party for completeness and accuracy and documentation of the review will be retained. Contact: Nicole Denis, Director of Finance, DOE, 207-530-2161 (State Number: 21-1235-03)

(2021-033) Title: Internal control over cash management needs improvement Prior Year Findings: None State Department: Administrative and Financial Services State Bureau: General Governmental Service Center Federal Agency: U.S. Department of Education Assistance Listing Title: Education Stabilization Fund (ESF) (COVID-19) Assistance Listing Number (CFDA): 84.425C Federal Award Identification Number: S425C200004; S425C210004 Compliance Area: Cash management Type of Finding: Significant deficiency Questioned Costs: None Criteria: 2 CFR 200.303; 2 CFR 200.302; 31 CFR 205.33; State Administrative and Accounting Manual (SAAM) Section 50.40.80 The Department must establish and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. Financial records must adequately identify the source and application of funds and provide accountability for all funds, property, and other assets related to the Federally funded activities. The Department must minimize the time between the drawdown of Federal funds and the disbursement of these funds for Federal program purposes. The timing and amount of fund transfers must be as close as administratively feasible to the Department?s actual cash outlay for program costs. Section 50.40.80 of the SAAM has defined administratively feasible as no more than seven business days. Condition: The General Government Service Center (GGSC) provides services including human resources, payroll and accounting and finance to the Department of Education (DOE). The GGSC requests Federal funds in order to reimburse ESF program expenditures multiple times each week. In December 2020, $6 million of program expenditures that had previously been reimbursed under the ESF Governor?s Emergency Education Relief program were recategorized as eligible Coronavirus Relief Fund expenditures. The GGSC did not immediately return the funds that were received for these expenditures and continued to draw additional Federal funds under the ESF. As a result, the State?s Federal cash balances for the ESF program exceeded the State?s administratively feasible threshold of seven business days for approximately two months. Context: In fiscal year 2021, there were approximately 236 Federal grant drawdowns totaling $26 million for the ESF. Cause: ? Lack of adequate policies and procedures ? Lack of staff resources available to process grant drawdowns and monitor cash balances due to the increased number of COVID-19 grants managed ? Lack of supervisory oversight Effect: The Federal government may impose more stringent program-specific cash management requirements based on noncompliance. Recommendation: We recommend that the Department develop and implement policies and procedures to address the identification and timely return of excess grant funds to the Federal government. We also recommend the Department review its staffing needs to ensure there are adequate resources to process and provide supervisory oversight over the increased workload from COVID-19 grants. Corrective Action Plan: See F-15 Management?s Response: The Department agrees with this finding. The Department will implement additional policies and procedures to ensure the timely return of excess grant funds as well as providing supervisory oversight of these transactions. Contact: Laurie Andre, GGSC Deputy Director, Accounting, GGSC, 207-592-0725 (State Number: 21-1235-01)

(2021-034) Title: Internal control over agency Schedule of Expenditures of Federal Awards submissions needs improvement Prior Year Findings: None State Department: Education State Bureau: Commissioner?s Office Federal Agency: U.S. Department of Education Assistance Listing Title: Education Stabilization Fund (ESF) (COVID-19) Assistance Listing Number (CFDA): 84.425D Federal Award Identification Number: S425D200004, S425D210004 Compliance Area: Reporting Type of Finding: Significant deficiency Questioned Costs: None Criteria: 2 CFR 200.303; 2 CFR 200.331; 2 CFR 200.510 The Department must establish and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. The Department must prepare a Schedule of Expenditures of Federal Awards (SEFA) for the period covered by the State?s financial statements. This schedule must separately identify subrecipient expenditures and direct program expenditures. Subrecipient expenditures are reimbursements made to pass-through entities who have responsibility for eligibility determinations and programmatic decision making. Condition: The Department awarded stipends to over 100 educators under the Elementary and Secondary School Emergency Relief (ESSER) program, a sub-program of the ESF. The stipends were awarded to support the creation of content for the Maine Online Opportunities for Sustained Education (MOOSE) online learning platform. The MOOSE platform was developed to support Maine?s students and educators during the COVID-19 pandemic. Stipends totaling $855,750 were paid to educators for the MOOSE platform during fiscal year 2021. The Department is responsible for working with the General Governmental Service Center (GGSC) to communicate Federal award expenditures to the Office of the State Controller (OSC) for inclusion in the annual SEFA. The MOOSE stipends were originally reported on the SEFA as subrecipient expenditures. The educators that created content for this platform do not meet the definition of a subrecipient; therefore, these expenditures should have been reported as direct program expenditures. Context: In fiscal year 2021, the ESSER program originally reported $17.9 million of subrecipient expenditures and $917,468 of direct expenditures on the SEFA. Cause: ? Inaccurate coding of direct expenditures ? Lack of adequate internal control relating to Department SEFA submissions to OSC ? Lack of adequate review procedures Effect: Incomplete or inaccurate expenditure reporting on the SEFA would result in noncompliance with Federal regulations if undetected. The SEFA is submitted to the Federal government and may be used for programmatic, policy or statistical purposes. Recommendation: We recommend that the Department and its Service Center work with OSC to improve SEFA submission and subsequent review procedures to ensure Federal program expenditures are reported accurately. Corrective Action Plan: See F-15 Management?s Response: The Department agrees with this finding. The Department will coordinate the review of expenditures with the GGSC prior to submission of the SEFA report to ensure all expenditures are reported accurately. Contact: Nicole Denis, Director of Finance, DOE, 207-530-2161 (State Number: 21-1235-02)

(2021-035) Title: Internal control over provider monitoring needs improvement Prior Year Findings: See Schedule of Findings and Questioned Costs for chart/table State Department: Health and Human Services State Bureau: Maine Center for Disease Control & Prevention Federal Agency: U.S. Department of Health and Human Services Assistance Listing Title: Immunization Cooperative Agreements Assistance Listing Number (CFDA): 93.268 Federal Award Identification Number: NH23IP922604 Compliance Area: Special tests and provisions Type of Finding: Material weakness Material noncompliance Questioned Costs: None Criteria: 2 CFR 200.303; 42 USC 1396; Vaccines for Children Program Operations Guide The Department must establish and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. The Department is required to ensure effective control and accountability for all vaccines under the Vaccines for Children (VFC) program. This was previously achieved through annual provider site visits. In March 2020, the U.S. Center for Disease Control (CDC) suspended site visits in response to COVID-19 and approved the Department to work under a modified plan. The Department?s modified plan requires the following: ? Ensure providers complete the annual vaccine storage and handling training published by the U.S. CDC; ? Request data logger reports for providers with an upcoming or overdue site visit to ensure vaccines have been stored at the appropriate temperature and temperatures have been accurately recorded; and ? Ensure providers are compliant with entering temperatures and reconciling vaccine inventory at least once every 30 days. Condition: The Office of the State Auditor (OSA) reviewed compliance with the processes that replaced provider site visits and found the following: ? A complete list of providers that were identified as overdue or coming due within the Provider Engagement, Analytics & Reporting (PEAR) portal during fiscal year 2021 could not be provided. The PEAR system cannot produce a point in time report and the Department did not retain reports. As a result, OSA was unable to test a sample of data logger reports. ? The Department could not provide documentation of follow-up communications with noncompliant providers regarding monthly reconciliations and temperature logging for 3 of the 60 providers selected for testing. ? The Department did not maintain adequate documentation of supervisory review over the three required areas of provider monitoring. The Office of the State Auditor selected a non-statistical random sample. Context: In fiscal year 2021, 375 VFC providers received vaccines valued at $15.3 million. Cause: ? Lack of policies and procedures ? Lack of documented supervisory oversight Effect: ? Noncompliance with Federal regulations ? Potential for improper vaccine storage and waste Recommendation: We recommend that the Department implement procedures to ensure that provider monitoring and adequate supervisory oversight is completed, documented and maintained. Corrective Action Plan: See F-16 Management?s Response: The Department agrees with this finding. This finding is directly related to an alternative plan developed by the State of Maine during FY2021 when on-site VFC Compliance Visits were temporarily suspended. The Department will update procedures to ensure provider monitoring is documented and records are maintained. The Department will update procedures to ensure supervisory oversight is completed, documented, and maintained. Contact: Jessica Shiminski, Health Program Manager, 207-287-7087 (State Number: 21-1118-01)

(2021-036) Confidential finding, see below for more information Title: ________ over the ________ system needs improvement Pursuant to paragraph 6.63 of the U.S. Government Accountability Office?s Government Auditing Standards (also known as the Yellow Book), we omitted details from this finding as they are confidential under the provisions of 5 MRSA 244-C (3). Though the content of this finding has been redacted, which appears as blank underlining, we provided the Department(s) with detailed information regarding the specific condition we identified, as well as the related criteria, context, causes, effects, and our specific recommendations for improvement. Prior Year Findings: See Schedule of Findings and Questioned Costs for chart/table State Department: Health and Human Services State Bureau: Maine Center for Disease Control & Prevention Federal Agency: U.S. Department of Health and Human Services Assistance Listing Title: Immunization Cooperative Agreements Assistance Listing Number (CFDA): 93.268 Federal Award Identification Number: NH23IP922604 Compliance Area: Allowable costs/cost principles Special tests and provisions Type of Finding: Significant deficiency Questioned Costs: None Criteria: ________ Condition: ________ Context: ________ Cause: ________ Effect: ________ Recommendation: ________ Corrective Action Plan: See F-16 Management?s Response: ________ Contact: Tonya Philbrick, Senior Health Program Manager, Maine Center for Disease Control & Prevention, DHHS, 207-287-2541 (State Number: 21-0906-01)

(2021-037) Confidential finding, see below for more information Title: ________ over ________, ________, and ________ needs improvement Pursuant to paragraph 6.63 of the U.S. Government Accountability Office?s Government Auditing Standards (also known as the Yellow Book), we omitted details from this finding as they are confidential under the provisions of 5 MRSA 244-C (3). Though the content of this finding has been redacted, which appears as blank underlining, we provided the Department(s) with detailed information regarding the specific condition we identified, as well as the related criteria, context, causes, effects, and our specific recommendations for improvement. Prior Year Findings: See Schedule of Findings and Questioned Costs for chart/table State Department: Health and Human Services State Bureau: Maine Center for Disease Control & Prevention Federal Agency: U.S. Department of Health and Human Services Assistance Listing Title: Immunization Cooperative Agreements Assistance Listing Number (CFDA): 93.268 Federal Award Identification Number: NH23IP922604 Compliance Area: Allowable costs/cost principles Special tests and provisions Type of Finding: Significant deficiency Questioned Costs: None Criteria: ________ Condition: ________ Context: ________ Cause: ________ Effect: ________ Recommendation: ________ Corrective Action Plan: See F-16 Management?s Response: ________ Contact: Danielle Sherwood, ImmPact Manager, DHHS, 207-287-2586 (State Number: 21-0906-02)

(2021-038) Title: Internal control over reporting needs improvement Prior Year Findings: None State Department: Health and Human Services State Bureau: Maine Center for Disease Control & Prevention Federal Agency: U.S. Department of Health and Human Services Assistance Listing Title: Epidemiology and Laboratory Capacity for Infectious Diseases (ELC) (COVID-19) Assistance Listing Number (CFDA): 93.323 Federal Award Identification Number: NU50CK000523 Compliance Area: Reporting Type of Finding: Significant deficiency Questioned Costs: None Criteria: 2 CFR 200.303; Coronavirus Aid, Relief, and Economic Security (CARES) Act Section 18115; Paycheck Protection Program and Health Care Enhancement Act of 2020 (PL 116-139); Coronavirus Response and Relief Supplemental Appropriations Act of 2020 (PL 116-260) The Department must establish and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. The Department must ensure that every laboratory that performs or analyzes a test that is intended to detect or diagnose a possible case of COVID-19 reports the results from each test to the U.S. Department of Health and Human Services. Condition: During fiscal year 2021, the Maine Center for Disease Control & Prevention (MeCDC) was required to complete the following reports: ? Quarterly and annual performance reports for three separate Federal awards ? Quarterly special reports for jurisdictional testing The Office of the State Auditor selected five quarterly reports and three annual reports for testing and identified the following exceptions: ? All reports were filed without documentation of approval by a secondary person prior to submission. ? Supporting documentation could not be provided to verify the accuracy and completeness of the filed reports. ? Documentation could not be provided to verify that the reports were filed timely. The Office of the State Auditor selected a non-statistical random sample. Context: During fiscal year 2021, twelve quarterly performance reports, three annual performance reports, and one quarterly special report were required to be filed. Cause: ? Lack of adequate internal controls ? Lack of supervisory oversight ? Lack of staff resources due to a significant increase in workload Effect: ? Incorrect or incomplete data may be reported to the Federal government. ? Potential Federal noncompliance due to performance and special reports not filed timely Recommendation: We recommend that MeCDC implement a documented process over the completion, filing, review and retention of performance and special reports. Corrective Action Plan: See F-16 Management?s Response: The Department agrees with this finding. The Division of Disease Surveillance, within the Maine Center for Disease Control and Prevention, will put into place an effective process to ensure quarterly and annual progress and special reports are accurate, complete, reviewed, and recorded when filed. Contact: Sara Robinson, Senior Program Manager, DHHS, 207-287-4610 (State Number: 21-1156-02)

(2021-039) Title: Internal control over subrecipient awards needs improvement Prior Year Findings: None State Department: Health and Human Services State Bureau: Division of Contract Management Federal Agency: U.S. Department of Health and Human Services Assistance Listing Title: Epidemiology and Laboratory Capacity for Infectious Diseases (ELC) (COVID-19) Assistance Listing Number (CFDA): 93.323 Federal Award Identification Number: NU50CK000523 Compliance Area: Subrecipient monitoring Type of Finding: Significant deficiency Questioned Costs: None Criteria: 2 CFR 200.303; 2 CFR 200.332 The Department must establish and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. Awards to subrecipients must include Federal award information that enables subrecipients to identify the source of the Federal award. Condition: The Division of Contract Management (DCM) is responsible for the preparation of subrecipient grant awards. The program information in the awards provided to subrecipients is the responsibility of the Maine Center for Disease Control & Prevention (MeCDC). MeCDC communicates the award information by providing it for upload to the Department of Health and Human Services grants database. DCM then utilizes that database to prepare the subrecipient awards and sends the drafted subrecipient awards to program personnel at MeCDC for final review. The subrecipient awards must include accurate Federal award identification information to ensure that subrecipients can properly identify the source of the award. For the two for-profit subrecipients who administer the ELC program, both subrecipient awards did not include the required Federal award information. Context: In fiscal year 2021, the Department provided $8 million to 46 subrecipients that administer the ELC program. Cause: Lack of established procedures over for-profit subrecipient awards Effect: Federal pass-through funds may not be correctly reported by subrecipients. Recommendation: We recommend that DCM and MeCDC collaborate on implementation of additional procedures to ensure for-profit subrecipient awards are complete, accurate and in accordance with Federal regulations. Corrective Action Plan: See F-17 Management?s Response: The Department agrees with this finding. The Division of Contract Management will collaborate with the MeCDC to implement controls to ensure subrecipient awards are complete, accurate and in accordance with Federal regulations. Contact: Jim Lopatosky, Director, Division of Contract Management, DHHS, 207-287-5075 (State Number: 21-1156-03)

(2021-040) Title: Internal control over payments made to and on behalf of TANF clients needs improvement Prior Year Findings: See Schedule of Findings and Questioned Costs for chart/table State Department: Health and Human Services State Bureau: Office for Family Independence Federal Agency: U.S. Department of Health and Human Services Assistance Listing Title: Temporary Assistance for Needy Families (TANF) Assistance Listing Number (CFDA): 93.558 Federal Award Identification Number: 1801METANF, 1901METANF, 2001METANF, 2101METANF Compliance Area: Activities allowed or unallowed Allowable costs/cost principles Type of Finding: Material weakness Material noncompliance Questioned costs Questioned Costs: The Office of the State Auditor (OSA) tested a sample of payments to TANF clients for services other than direct cash benefits and payments to providers on behalf of TANF clients. OSA identified known questioned costs totaling $8,377. Likely questioned costs totaling $667,074 were projected by dividing the identified known overpayment in our sample by total payments tested to establish an error rate, then applying that error rate to total payments to TANF clients for these services and payments to providers on behalf of TANF clients in fiscal year 2021. Criteria: 2 CFR 200.303; 2 CFR 200.403; 45 CFR 263.11 The Department must establish and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. To be allowable under Federal awards, costs must be necessary and reasonable for the performance of the Federal award and be adequately documented. The Department must use Federal TANF funds for expenditures that are reasonably calculated to accomplish the purposes of TANF. Use of funds in violation of this is considered misuse of funds. Condition: The Department issues TANF payments directly to a TANF client for various items and services. The Department also issues TANF payments directly to providers on behalf of TANF clients for services rendered such as childcare and transportation. OSA tested 60 payments and found that: ? one payment overpaid a provider by $526 for Transitional Child Care. Upon further review, OSA found that an additional $6,030 was overpaid to the childcare provider during fiscal year 2021. ? one payment overpaid a provider by $279 for childcare services. Upon further review, OSA found that an additional $1,116 was overpaid to the childcare provider during fiscal year 2021. ? two payments overpaid TANF clients a total of $426 ($276 for automobile insurance and $150 for clothing). An advance allowance was issued to each TANF client; however, neither TANF client submitted a receipt substantiating the purchase as required. The Office of the State Auditor selected a non-statistical random sample. Context: In fiscal year 2021, payments to TANF clients for services other than direct cash benefits and payments to providers on behalf of TANF clients totaled approximately $8 million. Cause: ? Lack of adequate procedures ? Lack of supervisory oversight Effect: ? Known questioned costs ? Potential future questioned costs and disallowances ? Noncompliance with Federal regulations Recommendation: We recommend that the Department implement procedures to ensure that payments made to TANF clients and providers are accurate, allowable, and adequately documented. We further recommend that the Department increase monitoring procedures over these payments. Corrective Action Plan: See F-17 Management?s Response: The Department agrees with the condition statement and recommendations. Regarding client payments: During SFY 2021, the Department formalized and implemented additional supervisory case readings (two per worker per week) and call monitoring (two calls a week, randomly selected). In addition, the Work Support Team Supervisor conducts partial reviews of approximately 25 percent of the cases worked on a daily basis. The Department will provide additional guidance to eligibility and other related workers regarding notification to the Work Support Team when the Department receives information that may affect payments. Regarding provider payments: The Department will examine the existing internal controls over payments, billing, invoice structures and mechanisms, including monitoring, to determine if the errors discovered were related to human error and/or lack of training or clarity in existing vendor payment controls. Contact: Anthony Pelotte, Director, Office for Family Independence, DHHS, 207-624-4104 (State Number: 21-1111-06)

(2021-041) Title: Internal control over special reporting needs improvement Prior Year Findings: None State Department: Health and Human Services State Bureau: Division of Contract Management Federal Agency: U.S. Department of Health and Human Services U.S. Department of Agriculture Assistance Listing Title: Temporary Assistance for Needy Families (TANF) Epidemiology and Laboratory Capacity for Infectious Diseases (ELC) (COVID-19) Immunization Cooperative Agreements (COVID-19) Special Supplemental Nutrition Program for Women, Infants, and Children (WIC) (COVID-19) Assistance Listing Number (CFDA): 93.558; 93.323; 93.268; 10.557 Federal Award Identification Number: 1801METANF, 1901METANF, 2001METANF, 2101METANF; NU50CK000523; NH23IP922604; 204ME743W5003, 204ME701W1003, 204ME701W1006, 214ME7435003, 214ME701W1003, 214ME701W1006, 214ME721W6006, 214ME721W6003 Compliance Area: Reporting Type of Finding: Material weakness Material noncompliance Questioned Costs: None Criteria: 2 CFR 200.303; 2 CFR 170 The Department must establish and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. Agencies must report each subaward that equals or exceeds the first-tier subaward threshold of $30,000 in Federal funds in the public-facing Federal Funding Accountability and Transparency Act (FFATA) Subaward Reporting System. Condition: When a subaward exceeding the first-tier subaward threshold is awarded to a subrecipient, the Department must collect and enter data into the FFATA Subaward Reporting System. Instead of entering data into the FFATA Subaward Reporting System when the obligating action (subaward/subcontract) exceeded the first-tier subaward threshold as required by Federal regulations, the Department reported when a Federal program?s individual Federal Award Identification Number (FAIN) exceeded the first-tier subaward threshold. There can be numerous FAINs within one subaward. Audit testing of the 27 subawards with Federal funds that exceeded the first-tier subaward threshold revealed that: ? 15 subawards totaling $8.5 million were not reported timely; ? 11 subawards totaling $25.7 million were not reported correctly; ? 5 subawards totaling $450,000 were not reported at all; and ? 1 subaward totaling $175,000 was reported with the incorrect Data Universal Numbering System (DUNS) number. Additionally, the Department could not provide evidence that any of the FFATA reports were reviewed prior to submission in the FFATA Subaward Reporting System to ensure that information entered was accurate and complete. The Office of the State Auditor selected a non-statistical random sample. Context: During fiscal year 2021, the Department disbursed $45.7 million in first-tier subawards to 76 subrecipients from the TANF, ELC, Immunization Cooperative Agreements, and WIC programs. Of the 76 subrecipients, 63 subrecipients received subawards exceeding the first-tier subaward threshold. These 63 subawards totaled approximately $45.5 million in fiscal year 2021. Cause: ? Misinterpretation of Federal regulations ? Lack of adequate procedures ? Lack of supervisory review Effect: ? Inaccurate, incomplete, and untimely information was and may continue to be reported to the Federal government. This information may be used for programmatic, policy or statistical purposes. ? Noncompliance with Federal regulations Recommendation: We recommend that the Department implement policies and procedures to ensure all subawards that meet or exceed the first-tier subaward threshold are reported accurately, timely, and in accordance with Federal regulations. We further recommend that the Department retain documentation of supervisory review for each FFATA report submitted in the FFATA Subaward Reporting System. Corrective Action Plan: See F-17 Management?s Response: The Department agrees with this finding. The Department will revisit its process to ensure all subawards are reported accurately, timely, and in accordance with Federal regulations. Additionally, the Department will ensure documentation of the supervisory review is retained. Contact: Jim Lopatosky, Director, Division of Contract Management, DHHS, 207-287-5075 (State Number: 21-1100-01)

(2021-042) Title: Internal control over subrecipient cash management needs improvement Prior Year Findings: See Schedule of Findings and Questioned Costs for chart/table State Department: Health and Human Services State Bureau: Division of Contract Management Federal Agency: U.S. Department of Health and Human Services U.S. Department of Agriculture Assistance Listing Title: Temporary Assistance for Needy Families (TANF) Special Supplemental Nutrition Program for Women, Infants, and Children (WIC) (COVID-19) Assistance Listing Number (CFDA): 93.558; 10.557 Federal Award Identification Number: 1801METANF, 1901METANF, 2001METANF, 2101METANF; 204ME743W5003, 204ME701W1003, 204ME701W1006, 214ME7435003, 214ME701W1003, 214ME701W1006, 214ME721W6006, 214ME721W6003 Compliance Area: Cash management Subrecipient monitoring Type of Finding: Material weakness Material noncompliance Questioned Costs: None Criteria: 2 CFR 200.303; 2 CFR 200.305 The Department must establish and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. The Department is required to monitor cash drawdowns by their subrecipients to ensure that the time elapsing between the payment of Federal funds to the subrecipient and the subrecipient?s actual disbursement for program purposes is minimized. Condition: The Department did not monitor subrecipients to ensure they were drawing Federal funds in accordance with cash management requirements. For cost-settled subawards, Department procedures include making equal advance monthly payments and then reconciling those amounts to the quarterly financial reports submitted by the subrecipient. This procedure does not take into consideration the time elapsing between the payment of Federal funds to the subrecipient and the subrecipient?s actual disbursement for program purposes. For ?cost-settled by invoice? (reimbursement) subawards, Department procedures do not require obtaining documentation to support the monthly invoices submitted by the subrecipient for costs that were already paid by the subrecipient, thus verifying it was for reimbursement and not advance payment. Context: In fiscal year 2021, the Department provided: ? $32.8 million to subrecipients from TANF grant funds of $79.5 million. TANF?s subawards are either cost-settled, cost-settled by invoice, or fee for service. ? $5 million to subrecipients from WIC grant funds of $13.6 million. All of WIC?s subawards are cost-settled. Cause: ? Misinterpretation of Federal regulations. 2 CFR 200.305(b)(1) references that the timing and amount of advance payments must be as close as is administratively feasible to the actual disbursements by the non-Federal entity. The Department interpreted this Federal requirement to mean it applied to the State; however, the requirement is directed towards non-Federal entities other than states. ? Lack of adequate subrecipient monitoring procedures. In addition to monitoring the total amount paid to subrecipients, the Department is required to monitor the timing between when the subrecipient receives Federal funds from the Department and when the subrecipient disburses those funds for program purposes. Effect: ? Noncompliance with subrecipient cash management requirements ? Federal programs may not be effectively and efficiently administered. ? The Federal government may require the implementation of more stringent subrecipient cash management procedures. Recommendation: We recommend that the Department implement monitoring procedures to ensure that: ? the time elapsing between the payment of Federal funds to the subrecipient and the subrecipient?s actual disbursement for program purposes is minimized for cost-settled subawards. ? the payment of Federal funds to the subrecipient is for reimbursement purposes, and not for advance payment, for ?cost-settled by invoice? subawards. Corrective Action Plan: See F-17 Management?s Response: The Department disagrees with this finding. The Department reviews budgeted expenses to determine their timing and nature (one time, recurring, allowability); reviews quarterly expense reports and alters payments to meet immediate cash needs, and finally, monitors subrecipient single audits to ensure there are no cash management findings. Additionally, our subrecipient's programs are tested more frequently and at a lower threshold than the threshold for single audits in accordance with the Maine Uniform Accounting and Auditing Practices for Community Agencies (MAAP). The Department's approach is administratively reasonable and does minimize the time elapsing between the payment of Federal funds to the subrecipient and the subrecipient?s actual disbursement for program purposes given administrative and operational needs. We believe we have procedures in place that can be corroborated by the fact that our subrecipients do not receive single audit findings related to cash management. Contact: Jim Lopatosky, Director, Division of Contract Management, DHHS, 207-287-5075 Auditor?s Concluding Remarks: The subrecipient monitoring procedures outlined in Management?s Response do not ensure that subrecipients are drawing funds in accordance with Federal cash management requirements. ? Reviewing budgeted expenses is not monitoring the subrecipient?s compliance with cash management requirements as the subrecipient has not disbursed the funds yet. ? The Department does not obtain documentation to support the timing of the subrecipient?s expenditures reported on the quarterly expense reports and to substantiate compliance. ? Though reviewing the subrecipient?s MAAP audits and Single Audits for findings is beneficial: o both types of audits are usually completed towards the end or after the grant award period. o MAAP audit requirements do not require testing of all subawards. Therefore, the subrecipient?s cash management may or may not be tested by the subrecipient?s auditor. o it is not guaranteed that cash management will be selected for testing by the subrecipient?s auditor; therefore, relying on the subrecipient?s auditor to discover cash management issues is not an adequate procedure to monitor the subrecipient?s compliance with that requirement. The finding remains as stated. (State Number: 21-1111-03)

(2021-043) Title: Internal control over Income Eligibility and Verification System procedures needs improvement Prior Year Findings: See Schedule of Findings and Questioned Costs for chart/table State Department: Health and Human Services State Bureau: Office for Family Independence Federal Agency: U.S. Department of Agriculture U.S. Department of Health and Human Services Assistance Listing Title: SNAP Cluster Temporary Assistance for Needy Families (TANF) Assistance Listing Number (CFDA): 10.551, 10.561; 93.558 Federal Award Identification Number: SNAP Benefits, Maine; 1801METANF, 1901METANF, 2001METANF, 2101METANF Compliance Area: Eligibility Special tests and provisions Type of Finding: Material weakness Material noncompliance Questioned Costs: None Criteria: 2 CFR 200.303; 7 CFR 272.8; 45 CFR 205.56 The Department must establish and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. The Department is required to comply with Federal Income Eligibility and Verification System (IEVS) exchange rules and regulations in accordance with program agreements. The Department is required to resolve all discrepancies identified through IEVS reports within 45 days of receipt. Condition: IEVS is used to exchange information among State and Federal agencies to verify various information needed to determine eligibility for Federal financial assistance. This information is updated in the Automated Client Eligibility System (ACES) to ensure eligibility determinations are made based on current information. IEVS generates various discrepancy reports on a weekly, monthly and quarterly basis. The Department is required to resolve all discrepancies identified through IEVS reports within 45 days of receipt. Of the 194 IEVS discrepancies tested: ? 61 discrepancies were not addressed in ACES; ? 11 discrepancies were addressed between 4 and 40 days late; ? 2 discrepancies were not correctly addressed in ACES; and ? the Office of the State Auditor (OSA) was unable to confirm if one discrepancy was updated correctly in ACES. OSA selected 44 discrepancies which were deemed significant by OSA and a non-statistical random sample of 25 discrepancies from each of the 6 IEVS reports, for a total of 194 discrepancies examined. Context: A total of 184 IEVS reports are required to be generated annually. The number of discrepancies on each report can vary from zero to almost 20,000. Cause: ? Lack of supervisory oversight ? Lack of resources available to respond to the significant increase in discrepancies due to the COVID-19 pandemic Effect: ? IEVS information may not be updated timely in ACES, which could result in incorrect eligibility determinations. ? Failure to participate in IEVS information exchange may result in the U.S. Department of Health and Human Services penalizing the State for up to two percent of the grant award. Recommendation: We recommend that the Department enhance oversight procedures to ensure IEVS discrepancies are properly resolved and documented on a timely basis. Corrective Action Plan: See F-18 Management?s Response: With only three disagreements regarding the discrepancies cited in the Condition statement above, the Department agrees with this finding. Four standard operating procedures governing IEVS reporting were modified in fiscal year 2021. However, largely due to the pandemic, combined with manual processing, we did witness an uptick in errors. The Department has created a Technology Roadmap workgroup and IEVS automation is a component of this project. Contact: Anthony Pelotte, Director, Office for Family Independence, DHHS, 207-624-4104 Auditor?s Concluding Remarks: Of the 75 discrepancies identified in the Condition, the Department disagrees with three of them. The Department did not provide adequate documentation to support their disagreement with these three discrepancies. The finding remains as stated. (State Number: 21-1111-01)

(2021-044) Confidential finding, see below for more information Title: ________ over the ________ system needs improvement Pursuant to paragraph 6.63 of the U.S. Government Accountability Office?s Government Auditing Standards (also known as the Yellow Book), we omitted details from this finding as they are confidential under the provisions of 5 MRSA 244-C (3). Though the content of this finding has been redacted, which appears as blank underlining, we provided the Department(s) with detailed information regarding the specific condition we identified, as well as the related criteria, context, causes, effects, and our specific recommendations for improvement. Prior Year Findings: See Schedule of Findings and Questioned Costs for chart/table State Department: Health and Human Services State Bureau: Office for Family Independence Federal Agency: U.S. Department of Health and Human Services Assistance Listing Title: Temporary Assistance for Needy Families (TANF) Assistance Listing Number (CFDA): 93.558 Federal Award Identification Number: 1801METANF, 1901METANF, 2001METANF, 2101METANF Compliance Area: Allowable costs/cost principles Reporting Special tests and provisions Type of Finding: Material weakness Questioned Costs: None Criteria: ________ Condition: ________ Context: ________ Cause: ________ Effect: ________ Recommendation: ________ Management?s Response: ________ Corrective Action Plan: See F-18 Management?s Response: ________ Contact: Anthony Pelotte, Director, Office for Family Independence, DHHS, 207-624-4104 (State Number: 21-0905-03)

(2021-045) Title: Internal control over cash benefits paid to TANF clients needs improvement Prior Year Findings: None State Department: Health and Human Services State Bureau: Office for Family Independence Federal Agency: U.S. Department of Health and Human Services Assistance Listing Title: Temporary Assistance for Needy Families (TANF) Assistance Listing Number (CFDA): 93.558 Federal Award Identification Number: 1801METANF, 1901METANF, 2001METANF, 2101METANF Compliance Area: Activities allowed or unallowed Allowable costs/cost principles Type of Finding: Significant deficiency Questioned costs Questioned Costs: The Office of the State Auditor (OSA) tested a sample of payments issued to TANF clients as direct cash benefits. OSA identified known questioned costs totaling $224. Likely questioned costs totaling $112,657 were projected by dividing the identified known overpayment in our sample by total payments tested to establish an error rate, then applying that error rate to total payments issued to TANF clients as direct cash benefits in fiscal year 2021. Criteria: 2 CFR 200.303; 2 CFR 200.403; 45 CFR 263.11 The Department must establish and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. To be allowable under Federal awards, costs must be necessary and reasonable for the performance of the Federal award and be adequately documented. The Department must use Federal TANF funds for expenditures that are reasonably calculated to accomplish the purposes of TANF. Use of funds in violation of this is considered misuse of funds. Condition: The Department issues monthly payments to TANF clients as direct cash benefits to provide temporary assistance to families while they work towards becoming self-sufficient. OSA selected 60 payments for testing and found that one payment overpaid a TANF client by $224. Though this TANF client?s case was referred to another division for overpayment in September 2020, the Department has not recouped any of the identified overpayment as of audit testing in March 2022. The Office of the State Auditor selected a non-statistical random sample. Context: In fiscal year 2021, payments issued to TANF clients as direct cash benefits totaled approximately $18.5 million. Cause: ? Lack of adequate procedures ? Lack of supervisory oversight Effect: ? Known questioned costs ? Potential future questioned costs and disallowances ? Noncompliance with Federal regulations Recommendation: We recommend that the Department implement procedures to ensure that payments made to TANF clients are accurate, allowable, and adequately documented. We further recommend that the Department increase monitoring procedures over these payments. Corrective Action Plan: See F-18 Management?s Response: The Department disagrees with this finding. The Office of the State Auditor correctly identified an error; however, the Department has controls in place and identified the error timely. The case was referred for overpayment during the fiscal year. Contact: Anthony Pelotte, Director, Office for Family Independence, DHHS, 207-624-4104 Auditor?s Concluding Remarks: Although the case was referred for a prior overpayment in September 2020, which was documented in the TANF client?s electronic case record, the Department subsequently issued another payment (the $224 overpayment identified in the Condition), indicating a lack of adequate controls. As of audit testing in March 2022, the overpayment referral remains listed as pending in the TANF client?s electronic case record, 18 months after the initial overpayment was referred to another division, and the Department has not recouped any of the identified overpayment. The finding remains as stated. (State Number: 21-1111-07)

(2021-046) Title: Internal control over TANF client child support sanction procedures needs improvement Prior Year Findings: See Schedule of Findings and Questioned Costs for chart/table State Department: Health and Human Services State Bureau: Office for Family Independence Federal Agency: U.S. Department of Health and Human Services Assistance Listing Title: Temporary Assistance for Needy Families (TANF) Assistance Listing Number (CFDA): 93.558 Federal Award Identification Number: 1801METANF, 1901METANF, 2001METANF, 2101METANF Compliance Area: Special tests and provisions Type of Finding: Significant deficiency Questioned Costs: None Criteria: 2 CFR 200.303; 45 CFR 264.30; 42 USC 608(a)(2) The Department must establish and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. If the Department determines that an individual is not cooperating with child support enforcement requirements, the Department is required to sanction the individual by deducting an amount equal to not less than 25 percent from the TANF assistance that would otherwise be provided to the family of the individual, and may deny the family any TANF assistance. Condition: The Department?s Division of Support Enforcement and Recovery (DSER) is responsible for enforcing child support requirements. DSER sends email notifications (sanction requests) to TANF personnel when individuals not cooperating with child support enforcement requirements are identified. If TANF personnel determine that the individual needs to be sanctioned after reviewing the individual?s case, they will process the sanction request in the Automated Client Eligibility System (ACES). Federal guidance requires the Office of the State Auditor (OSA) to develop audit procedures to test a sample of cases referred by DSER. When OSA requested the list of sanction requests from DSER for testing purposes, the Department provided a list that was generated based on noncooperation dates entered in the Child Support Enforcement of Maine (CSEME) system. However, noncooperation dates were not consistently entered into CSEME by DSER personnel during fiscal year 2021, resulting in an incomplete list. In March 2021, the Department sent DSER personnel a reminder that the noncooperation date needs to be entered when requesting a sanction. Context: DSER personnel transmit sanction requests through email to a general inbox that receives other notifications and collects approximately 400 emails per day. The sanction requests are then forwarded by a designated supervisor to the appropriate TANF personnel to be processed in ACES. For fiscal year 2021, DSER provided a list of 403 sanction requests to OSA. The number of sanction requests that were made but omitted from the DSER list is unknown. Cause: ? Lack of resources. The Department is unable to obtain a complete listing of sanction requests from DSER without dedicating a significant amount of time and resources sorting through the general email inbox. ? Lack of established procedures to ensure that all noncooperation dates are entered in CSEME. Additionally, reminding staff that the noncooperation date needs to be entered in CSEME prior to transmitting a sanction request through email does not guarantee that all noncooperation dates will be in CSEME. Effect: ? Noncompliant clients may be paid benefits that they are not entitled to receive. ? Failure to comply with sanction requirements may result in the U.S. Department of Health and Human Services penalizing the State for up to five percent of the grant award. Recommendation: We recommend that the Department establish procedures to ensure that all sanction requests are maintained in a central repository so that they can be easily retrieved for tracking and review purposes. Corrective Action Plan: See F-19 Management?s Response: The Department agrees with the condition statement noted in the audit finding for the audit period ending June 30, 2021. The Department implemented a solution to this issue during the audited year, in March of 2021, as represented by a direct communication to staff as well as subsequent communications including a SOP governing this process. Contact: Anthony Pelotte, Director, Office for Family Independence, DHHS, 207-624-4104 (State Number: 21-1111-02)

(2021-047) Title: Internal control over TANF performance reporting and work participation procedures needs improvement Prior Year Findings: See Schedule of Findings and Questioned Costs for chart/table State Department: Health and Human Services State Bureau: Office for Family Independence Federal Agency: U.S. Department of Health and Human Services Assistance Listing Title: Temporary Assistance for Needy Families (TANF) Assistance Listing Number (CFDA): 93.558 Federal Award Identification Number: 1801METANF, 1901METANF, 2001METANF, 2101METANF Compliance Area: Reporting Special tests and provisions Type of Finding: Significant deficiency Questioned Costs: None Criteria: 2 CFR 200.303; 45 CFR 261.60 through 261.62; 45 CFR 265.7 and 265.8 The Department must establish and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. The Department must maintain adequate documentation, perform adequate verification, and implement other control procedures for TANF client work participation. Work participation activities include unsubsidized employment, job search and job readiness, job skills training directly related to employment, vocational education, and other work-related programs. The Department must report the actual hours that a work-eligible TANF client participates in these work-related activities, on the ACF-199 TANF Data Report and the ACF-209 SSP-MOE Data Report on a quarterly basis. These reports are required by the Federal government. Condition: The Department reported incorrect work participation information on the ACF-199 and ACF-209 reports. Of the 120 clients tested, inaccurate work participation data was reported for 28 clients, including inaccurate: ? countable months towards the Federal time limit of 60 months, ? unsubsidized employment hours, ? job search and job readiness hours, ? work experience hours, ? vocational education training hours, ? job skills training directly related to employment hours, and ? education to employment with no high school diploma hours. The Office of the State Auditor selected a non-statistical random sample. Context: The Department must maintain adequate documentation, verification, and internal control procedures to ensure the accuracy of information reported to the Federal government and used to calculate work participation rates. In fiscal year 2021, the number of clients reported on the ACF-199 report ranged from approximately 11,000 to 13,000 clients, and the number of clients reported on the ACF-209 report ranged from approximately 36,000 to 42,000 clients. Cause: ? Lack of adequate procedures to ensure work participation data is accurately reflected in the Automated Client Eligibility System (ACES) and FedcapCARES case management system and reported correctly in the quarterly Federal performance reports ? Lack of supervisory oversight Effect: ? Incorrect work participation data reported to the Federal government may affect the Federal requirement for TANF?s State Maintenance of Effort. ? The Federal government may penalize the State by an amount not less than one percent and not more than five percent of the grant award for violation of work verification plan requirements. Recommendation: We recommend that the Department implement procedures to ensure that the information reported on the ACF-199 and ACF-209 reports is accurate and complete prior to submission to the Federal government. This should include increased systematic monitoring to improve the reliability of work participation data that is reported to the Federal government. Corrective Action Plan: See F-19 Management?s Response: The Department agrees with this finding and recommendations regarding the 28 cases containing errors. The Department will investigate and identify the source or cause of errors found which led to incorrect month counts. The Department will modify the existing Quality Review Tool. Additionally, we will review, and edit if necessary, the existing procedures governing this process. Contact: Anthony Pelotte, Director, Office for Family Independence, DHHS, 207-624-4104 (State Number: 21-1111-05)

(2021-048) Title: Internal control over subrecipient risk evaluation procedures needs improvement Prior Year Findings: See Schedule of Findings and Questioned Costs for chart/table State Department: Health and Human Services State Bureau: Office for Family Independence Office of Child and Family Services Division of Contract Management Division of Audit Federal Agency: U.S. Department of Health and Human Services Assistance Listing Title: Temporary Assistance for Needy Families (TANF) Assistance Listing Number (CFDA): 93.558 Federal Award Identification Number: 1801METANF, 1901METANF, 2001METANF, 2101METANF Compliance Area: Subrecipient monitoring Type of Finding: Significant deficiency Questioned Costs: None Criteria: 2 CFR 200.303; 2 CFR 200.332 The Department must establish and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. The Department is required to evaluate each subrecipient?s risk of noncompliance with Federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate subrecipient monitoring described in 2 CFR 200.332. Condition: The Department has established subrecipient monitoring procedures depending on whether the subrecipient is competitively bid or not. If a subaward is competitively bid, the Department seeks input from the Department of Health and Human Services Service Center, the Department?s Division of Audit, and the Division of Contract Management regarding known issues with the provider who submitted the bid. Those responses are collected and provided to the evaluation team which consists of various program personnel. The subaward agreement is then drafted and the level of subrecipient monitoring is included in the agreement. If a subaward is not competitively bid, the subaward agreement is drafted based on the level of subrecipient monitoring that the Department has established for the provided services. For the seven TANF subrecipients selected for testing: ? two subrecipients competitively bid on the subaward. For those subrecipients: o no documentary evidence could be provided to support that feedback was solicited from other Bureaus for any known issues or prior noncompliance for one subrecipient. o no documentary evidence could be provided to support the level of subrecipient monitoring that was completed for both subrecipients. ? five subrecipients did not competitively bid on the subaward. For those five subrecipients, no documentary evidence could be provided to support the level of subrecipient monitoring that was completed. The Office of the State Auditor selected a non-statistical random sample. Context: The Department provided $32.8 million to TANF subrecipients during fiscal year 2021. Cause: Lack of adequate policies and procedures to ensure that subrecipient risk evaluation documentation is retained Effect: ? Without a documented process, subrecipient risk evaluation procedures may not be consistently followed and documentation may not be adequately maintained. ? Subrecipients that are deemed higher risk may not be monitored on a more frequent basis. Conversely, subrecipients that are deemed lower risk may not be monitored on a less frequent basis, which would free resources and time to dedicate towards other higher risk subrecipients. Recommendation: We recommend that the Department implement and document procedures that outline the collaborative process with all Bureaus. This policy should require evaluation of each subrecipient?s risk of noncompliance specifically for the purposes of determining the appropriate subrecipient monitoring to be performed. Corrective Action Plan: See F-19 Management?s Response: The Department agrees with this finding. Although there are several layers of risk evaluation built into the subrecipient monitoring process, the Department agrees that there should be a policy regarding the evaluation of risk to determine the appropriate subrecipient monitoring. Contact: Tony Madden, Deputy Director ? Division of Audit, DHHS, 207-287-2834 (State Number: 21-1111-04)

(2021-049) Title: Internal control over subrecipient audit procedures needs improvement Prior Year Findings: None State Department: Health and Human Services State Bureau: Division of Audit Federal Agency: U.S. Department of Health and Human Services Assistance Listing Title: Temporary Assistance for Needy Families (TANF) Assistance Listing Number (CFDA): 93.558 Federal Award Identification Number: 1801METANF, 1901METANF, 2001METANF, 2101METANF Compliance Area: Subrecipient monitoring Type of Finding: Significant deficiency Questioned Costs: None Criteria: 2 CFR 200.303; 2 CFR 200.332 The Department must establish and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. When a subrecipient?s Federal award expenditures are expected to equal or exceed $750,000 during the fiscal year, the Department must verify that the subrecipient is audited as required by Subpart F of 2 CFR 200. Condition: The Department requires subrecipients to submit their Single Audit to the Department?s Division of Audit (DOA). DOA maintains a database to track when subrecipient Single Audit reports are due and ensures that they are received. The Office of the State Auditor tested eight TANF subrecipients that had a Single Audit due in fiscal year 2021 and identified that one TANF subrecipient submitted their Single Audit to the Federal Audit Clearinghouse (FAC) nine months past the Single Audit due date. DOA did not obtain the Single Audit for that subrecipient until seven months past the date of submission to the FAC. In addition, documentation could not be provided to support that DOA contacted the TANF subrecipient when the Single Audit was late. Context: A Single Audit was due in fiscal year 2021 for eight TANF subrecipients that received $22.1 million of Federal funds in fiscal year 2020. Cause: ? Lack of adequate procedures ? Lack of supervisory oversight Effect: Noncompliance with Federal regulations Recommendation: We recommend that the Department implement procedures to ensure that subrecipients that expend $750,000 or more in Federal awards complete and submit a Single Audit within the required time requirements. Corrective Action Plan: See F-19 Management?s Response: The Department agrees with this finding. The Department has already begun implementing new procedures regarding the subrecipient monitoring to ensure Single Audits are received timely. Contact: Tony Madden, Deputy Director, Division of Audit, DHHS, 207-287-2834 (State Number: 21-1100-02)

(2021-050) Title: Internal control over Hospital and Long Term Care Facility audits needs improvement Prior Year Findings: See Schedule of Findings and Questioned Costs for chart/table State Department: Health and Human Services State Bureau: Division of Audit Federal Agency: U.S. Department of Health and Human Services Assistance Listing Title: Medicaid Cluster (COVID-19) Assistance Listing Number (CFDA): 93.775, 93.777, 93.778 Federal Award Identification Number: 2005ME5MAP, 2105ME5MAP Compliance Area: Special tests and provisions Type of Finding: Material weakness Material noncompliance Questioned Costs: None Criteria: 2 CFR 200.303; 42 CFR 447.253(g); Maine State Plan under Title XIX of the Social Security Act (TN No. 13-020); MaineCare Benefits Manual, Chapter III, Sections 45, 50 and 67 The Department must establish and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. The Department is required to provide for the periodic audits of the financial and statistical records of participating providers. The Maine State Plan under Title XIX of the Social Security Act (TN No. 13-020) requires the Division of Audit to perform and issue an interim or final Cost Settlement Report within 12 months of receipt of the cost report from the Hospital Facility provider. The MaineCare Benefits Manual (MCBM) Chapter III, Sections 45, 50 and 67 outline the documentation and support required to be included in a provider?s annual cost report filing submission to the Division of Audit. The Division of Audit?s requirements for reviewing the cost reports and performing uniform desk reviews is also outlined. Section 67 states that the Division of Audit must perform a uniform desk review on each Nursing Facility (NF) cost report submission within 365 days of receipt of an acceptable cost report filing. Condition: The Division of Audit did not issue Hospital and Long Term Care Facility (LTCF) audits in accordance with Federal regulations. LTCF audits include both audits of NFs and Intermediate Care Facilities for Individuals with Intellectual Disabilities (ICF/IIDs). Hospitals The Maine State Plan under Title XIX of the Social Security Act (TN No. 13-020) requires the Division of Audit to perform an interim or final Cost Settlement Report within 12 months of receipt of the cost report submitted by the provider. The population of Hospital Facility audits due for completion in fiscal year 2021 was 36, of which one was issued 12 days late. LTCF ? Nursing Facilities The MCBM states uniform desk reviews shall be completed within 365 days after receipt of an acceptable cost report filing, including financial statements and other information requested from the provider except in unusual situations including, but not limited to, delays in obtaining necessary information from a provider. Unless the Division of Audit intends to schedule an on-site audit or an unusual situation referenced above exists, a written summary report of findings and adjustments shall be issued upon completion of the uniform desk review. The population of NF uniform desk reviews due for issuance in fiscal year 2021 was 44. Of those 44 uniform desk reviews, 14 were issued 13 to 238 days late and 30 had not been issued at the time of audit testing. LTCF ? ICF/IIDs The MCBM requires providers to submit cost reports annually based on the facility?s fiscal year end. 42 CFR 447.253(g) states ?[the agency] must provide for the periodic audits of the financial and statistical records of participating providers.? Furthermore, 2 CFR 200.303 requires a non-Federal agency to ?establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award.? Neither 42 CFR nor the MCBM specifies a specific timeframe to complete an audit of a ICF/IID cost report. The Division of Audit has stated its understanding of the periodic requirement to be that all ICF/IID cost report audits must be completed ?at some point in time.? There are 16 facilities in the State that fall into the category of ICF/IID requiring audits of their annually submitted cost reports. The Division of Audit issued 21 ICF/IID cost report audits, in relation to 14 facilities, in fiscal year 2021. Of these 21 audits, 2 were issued in under 365 days and 19 were issued in a range of 401 to 940 days after receipt of the cost report. The average time between the receipt of the cost report and the completion of the related audit for audits issued in fiscal year 2021 was 590 days. Context: The Department provided $861.8 million in Federal Medicaid funding and $119.5 million in State Medicaid funding to hospitals and LTCFs during fiscal year 2021 as follows: ? Hospital Facilities: o $595.1 million Federal funding o $62.4 million State funding ? Nursing Facilities: o $237.6 million Federal Funding o $57.1 million State Funding ? ICF/IID: o $29.1 million Federal Funding Cause: Lack of resources Effect: Noncompliance with Federal and State regulations Recommendation: We recommend that the Department reallocate resources so additional levels of personnel can be directed to address the backlog of audits and uniform desk reviews. Additional resources and staff auditors will enable the Department to perform and issue Hospital and LTCF audits on a timely basis in compliance with statutory guidelines. Lengthy backlogs in the internal audit function risk staleness of data and untimely remedial action. Corrective Action Plan: See F-19 Management?s Response: The Department partially agrees with this finding. The Department agrees with this finding in regard to LTCF - Nursing Facilities and Hospitals. The delay in completing the Nursing Facilities audits is the result of staff shortages and competing priorities due to COVID-19 funds which required audit resources to reconcile interim payments. While hospitals were not completed within the one-year timeline identified in policy, one audit being 12 days late should not be considered material. The hospital audits are tracked on a weekly basis and staff are dedicated to completing the audits. We are currently on pace to complete them all within the one-year timeline; therefore, no corrective action is necessary. The Department disagrees with this finding in regard to LTCF - ICF/IID's. The ICF/IID audits do not have a specific time requirement in MBM for completion. The federal regulations only require that periodic audits of financial records occur. All ICF/IID cost reports submitted to the Department are recorded in a database and tracked for audit purposes. All cost reports are audited as resources are available. We have worked with our Federal partners who have agreed with our interpretation of the regulation and the timing of our audits for the ICF/IIDs. Contact: Herb Downs, Director, Division of Audit, DHHS, 207-287-2778 Auditor?s Concluding Remarks: 42 CFR 447.253(f-g) states ?[the agency] must provide for the filing of uniform cost reports by each participating provider [and] periodic audits of the financial and statistical records of participating providers.? The Department is correct in its assertion that the regulation does not define a timeframe for either the filing of uniform cost reports by providers or the audit of financial and statistical records; however, two factors must be considered: ? The Department requires that providers submit cost reports annually. The periodic audit of a facility?s financial and statistical records should follow the same pattern as the periodic submission of those financial and statistical records. Failure to do so leads to delays in identifying funds due to or due from the provider. ? The Department?s interpretation that there is no deadline for performing audits of the financial and statistical records of ICF/IIDs leads to an open-ended timeframe where audits are never required to be completed. Delays in identifying funds due to a provider could lead to financial hardship for the facility and threaten the care Medicaid clients receive. Delays in identifying funds due from a facility postpone recoupment of overpayments by the State and postpone Federal reimbursement for those funds. Furthermore, delays in performing audits prevents the Department from providing reasonable assurance that the Department is managing the Federal award as required by 2 CFR 200.303. The finding remains as stated. (State Number: 21-1106-01)

(2021-051) Title: Internal control over cases opened due to potential fraud, abuse or questionable practices needs improvement Prior Year Findings: See Schedule of Findings and Questioned Costs for chart/table State Department: Health and Human Services State Bureau: Office of MaineCare Services Federal Agency: U.S. Department of Health and Human Services Assistance Listing Title: Medicaid Cluster (COVID-19) Children?s Health Insurance Premium (CHIP) (COVID-19) Assistance Listing Number (CFDA): 93.775, 93.777, 93.778; 93.767 Federal Award Identification Number: 2005ME5MAP, 2105ME5MAP 2005ME5021, 2105ME5021 Compliance Area: Special tests and provisions Type of Finding: Material weakness Material noncompliance Questioned Costs: None Criteria: 2 CFR 200.303; 42 CFR 455.13 through 15; MaineCare Benefits Manual, Sections 1.17 and 1.18 The Department must establish and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. When the State Medicaid Agency receives a complaint of Medicaid fraud or abuse or identifies questionable practices, it must conduct a preliminary investigation to determine whether there is sufficient basis to warrant a full investigation. Additionally, if the preliminary investigation is indicative of fraud, waste, or abuse the State Medicaid Agency must take appropriate actions to fully investigate the abuse and/or refer the case to the Medicaid Fraud Control Unit. Condition: The Office of the State Auditor (OSA) judgmentally selected ten cases related to potential fraud, abuse or questionable practices based upon the age of the case or the amount of identified recoupment. In OSA?s test of ten cases, five cases were found to be inactive for an extended period, ranging from 304 to 2,173 days. There was no evidence of monitoring or supervisory review during that extended period. Of the remaining population of cases, a non-statistical random sample of 60 cases was selected. In OSA?s test of 60 cases, no exceptions were identified. Context: In fiscal year 2021, the State paid approximately $3.3 billion to providers, including approximately $2.2 billion in Federal funds. Cause: ? Lack of resources ? Lack of procedures to ensure that cases are continually monitored Effect: ? Fraud, abuse or questionable practices may remain undetected. ? Costs that should be recovered may not be identified. Recommendation: We recommend that the Department establish procedures to identify inactive cases to ensure case reviews and investigations are completed in accordance with regulatory requirements and Department procedures. Corrective Action Plan: See F-20 Management?s Response: The Department agrees that the cases identified lacked documentation to support the reason for an extended period of non-activity. Three of the five cases identified have been subsequently closed and require no additional action. The remaining two cases are being addressed by the Program Manager. Procedures will be established to run a quarterly report and evaluate outstanding cases for closure or reassignment. Contact: Michelle Probert, Director, Office of MaineCare Services, DHHS, 207-287-2093 (State Number: 21-1106-03)

(2021-052) Title: Internal control over compliance with eligibility determination requirements needs improvement Prior Year Findings: See Schedule of Findings and Questioned Costs for chart/table State Department: Health and Human Services State Bureau: Office for Family Independence Federal Agency: U.S. Department of Health and Human Services Assistance Listing Title: Medicaid Cluster (COVID-19) Children?s Health Insurance Program (CHIP) (COVID-19) Assistance Listing Number (CFDA): 93.775, 93.777, 93.778; 93.767 Federal Award Identification Number: 2005ME5MAP, 2105ME5MAP; 2005ME5021, 2105ME5021 Compliance Area: Eligibility Type of Finding: Material weakness Material noncompliance Questioned Costs: None Criteria: 2 CFR 200.303: 42 CFR 435: MaineCare Eligibility Manual The Department must establish and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. 42 CFR 435 requires that the Department must: ? include in each applicant?s case record facts to support the agency?s decision on their application; ? maintain policies and procedures to ensure that eligibility is determined in a manner consistent with the best interests of the applicant or beneficiary; ? establish procedures for obtaining, using, and verifying information relevant to determinations as to eligibility and the amount of assistance; and ? verify the individual?s citizenship and identity. 42 CFR 435.10 states that a State plan must specify the groups to whom Medicaid is provided and the conditions of eligibility for individuals in those groups. The MaineCare Eligibility Manual, Part 2 Section 3.2, details specific criteria for identity verification and document retention. Condition: Eligibility Specialists record applicant information in the Automated Client Eligibility System (ACES), which is used to determine eligibility. Supporting documents are maintained in electronic case records. In the Office of the State Auditor?s (OSA?s) test of 60 clients with Medicaid Modified Adjusted Gross Income (MAGI)-based MaineCare coverage in fiscal year 2021: ? the identity was not recorded as verified in ACES for 17 clients; included in this are three clients whose electronic case record contained source documents supporting identity. ? the identity of four clients was recorded as verified in ACES, but supporting documents listed as verified were not retained in the electronic case record. ? the electronic case record for one client contained an application and demographic documents for another client not related to the case owner. In OSA?s test of 60 clients with CHIP-based MaineCare coverage in fiscal year 2021: ? the identity was not recorded as verified in ACES for 30 clients; and ? the identity of five clients was recorded as verified in ACES, but supporting documents listed as verified were not retained in the electronic case record. The Office of the State Auditor selected non-statistical random samples. 42 CFR 435.407 indicates that the State may rely, without further documentation of citizenship or identity, on a verification of citizenship made by a Federal agency; however, the MaineCare Eligibility Manual does not allow for this and details specific requirements for the verification of identity and retention of documents. In order to be in compliance with 42 CFR 435.10, the Department must adhere to the requirements it has established and outlined in the MaineCare Eligibility Manual for eligibility determination. The Office of the State Auditor also issued finding numbers 2021-054, Internal control over the eligibility determination process needs improvement, and 2021-058, Internal control over the ACES system needs improvement. Context: In fiscal year 2021, the State provided approximately 360,000 Medicaid/CHIP clients with $2.2 billion in Federal benefits. Cause: ? Lack of supervisory oversight ? Lack of client identity verification policies and procedures to ensure adherence to requirements set forth in the MaineCare Eligibility Manual and 42 CFR 435 Effect: ? Benefits could potentially be provided to ineligible individuals. ? Noncompliance with Federal and State regulations Recommendation: We recommend that the Department establish policies and procedures to ensure that the identity of an applicant is verified, and supporting documents are maintained in the electronic case records in accordance with program requirements. Corrective Action Plan: See F-20 Management?s Response: The Department disagrees with this finding. OSA has misinterpreted MaineCare policy by excluding the eligibility system (ACES) as part of the electronic case record. Electronic data sources are required per federal regulations and documentation of citizenship and identity verifications are stored within ACES. The requirement to verify identity is part of Medicaid citizenship verification requirements. Maine verifies citizenship and identity through electronic data matches in accordance with 42 CFR ?435.949; the results of this match are stored in ACES. The state cannot request paper documentation from applicants after successful electronic verification for the purpose of storing it in another system, nor can we establish more restrictive verification requirements than those allowed by federal regulations. This was a prior year finding (2020-052) that the Department disagreed with and the cognizant agency, CMS, agreed with the Department's position and closed the finding. Contact: Anthony Pelotte, Director, Office for Family Independence, DHHS, 207-624-4104 Auditor?s Concluding Remarks: Federal requirements for evidence of citizenship and identity are established in 42 CFR 435.407. States are provided the options of relying on, without further documentation of citizenship or identity, a verification of citizenship made by a Federal agency or another State agency, or requiring further documentary evidence of citizenship and/or identity. The MaineCare Eligibility Manual, Part 2 Section 3.2, details the Department?s decision to require applicants to submit documentary evidence of identity beyond verification of citizenship made by a Federal agency or another State agency. In addition, the MaineCare Eligibility Manual, Part 2 Section 2, VIII, B, states that ?copies of citizenship and identification documents shall be maintained in the case record or electronic database.? We agree that ACES is part of the electronic case record, and where appropriate documentation was recorded in ACES, no exception was taken; however, the exceptions noted are for instances where copies of documentation were required to be maintained in the electronic case record and were not. To ensure compliance with the requirements of the Federal awards, the Department must adhere to the procedures established for obtaining, using, verifying, and maintaining information relevant for eligibility determinations and the amount of assistance in accordance with 42 CFR 435. The finding remains as stated. (State Number: 21-1106-09)

(2021-053) Title: Internal control over Medicare Part B premium payments needs improvement Prior Year Findings: See Schedule of Findings and Questioned Costs for chart/table State Department: Health and Human Services Administrative and Financial Services State Bureau: Office for Family Independence Office of Information Technology Federal Agency: U.S. Department of Health and Human Services Assistance Listing Title: Medicaid Cluster (COVID-19) Assistance Listing Number (CFDA): 93.775, 93.777, 93.778 Federal Award Identification Number: 2005ME5MAP, 2105ME5MAP Compliance Area: Allowable costs/cost principles Type of Finding: Material weakness Questioned Costs: None Criteria: 2 CFR 200.303; 42 CFR 431.625 The Department must establish and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. 42 CFR 431.625 outlines eligibility criteria which, if met, allows the State to pay a portion of the Federal Medicare Part B premium on behalf of the client and claim Federal financial participation in the payment. Clients may be deemed eligible by the Federal government as indicated by a Federal Buy-In code, or by the State as indicated by eligibility status in the Automated Client Eligibility System (ACES). Condition: The Department receives monthly invoices from the Centers for Medicare and Medicaid Services (CMS) for Medicare Part B premiums. CMS provides a separate detailed listing of Medicaid members that supports the invoice to the Office of Information Technology (OIT). OIT produces a Monthly Reconciliation Report identifying potential discrepancies between the CMS detailed listing and the Department?s eligibility information recorded in ACES. Office for Family Independence (OFI) personnel use this reconciliation report to identify clients for whom payment should not be made. The Monthly Reconciliation Report and related documentation covering the CMS invoices received in four of the twelve months in fiscal year 2021 could not be provided by OFI. Of the eight reports provided, seven did not demonstrate completion of review or documentation of corrective action. In the Office of the State Auditor?s sample of 60 premium payments, one premium was paid by the Department on behalf of a client who was coded eligible on the CMS invoice but was coded not eligible in ACES. Further procedures determined that the client had been incorrectly coded in ACES and that the payment was allowable. The Monthly Reconciliation Report did not identify this discrepancy. The Office of the State Auditor selected a non-statistical random sample. Context: In fiscal year 2021, approximately $108 million in Federal funds and $46 million in State funds were paid to CMS for Medicare Part B premiums. Cause: ? Lack of supervisory oversight ? The Monthly Reconciliation Report is not adequately designed to identify all discrepancies. Effect: ? Potential Medicare Part B premiums paid by the State for ineligible clients ? Potential questioned costs and disallowances ? Noncompliance with Federal regulations Recommendation: We recommend that the Department establish procedures to ensure the production, review and follow up to Monthly Reconciliation Reports, and that the Department improve procedures for the documentation and retention of those reports. We further recommend that the Department design the Monthly Reconciliation Report to identify all discrepancies. Corrective Action Plan: See F-21 Management?s Response: The Department agrees with this finding. We continue to address this repeat finding as evidenced by two substantial edits to the standard operating procedures governing Medicare Part B Buy-in reconciliation during the fiscal year. Additional work on this front includes consolidation of legacy tasks previously conducted by the IEVS team migrating to the ACES Helpdesk. Related, we have also conducted a transaction code review to ensure all CMS codes requiring state action are appropriately captured on these reports. The Department is reviewing Information Technology processes in order to determine where system changes may enhance and further automate reconciliation for individuals with SSI and Medicare premium changes. Contact: Anthony Pelotte, Director, Office for Family Independence, DHHS, 207-624-4104 (State Number: 21-1106-06)

(2021-054) Title: Internal control over the eligibility determination process needs improvement Prior Year Findings: See Schedule of Findings and Questioned Costs for chart/table State Department: Health and Human Services State Bureau: Office for Family Independence Federal Agency: U.S. Department of Health and Human Services U.S. Department of Agriculture Assistance Listing Title: Medicaid Cluster (COVID-19) Children?s Health Insurance Program (CHIP) (COVID-19) SNAP Cluster Temporary Assistance for Needy Families (TANF) Assistance Listing Number (CFDA): 93.775, 93.777, 93.778; 93.767; 10.551, 10.561; 93.558 Federal Award Identification Number: 2005ME5MAP, 2105ME5MAP; 2005ME5021, 2105ME5021; SNAP Benefits, Maine; 1801METANF, 1901METANF, 2001METANF, 2101METANF Compliance Area: Allowable costs/cost principles Eligibility Type of Finding: Material weakness Questioned Costs: None Criteria: 2 CFR 200.303 The Department must establish and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. Condition: The Department did not have a documented process in place throughout fiscal year 2021 to ensure information entered into the Automated Client Eligibility System (ACES) is accurate and complete. Eligibility specialists manually enter information into ACES and initiate computerized eligibility determinations. Documentation supports that there is no process in place to ensure the accuracy of manually entered data used in eligibility determination. Supervisors perform a case review of one eligibility determination per eligibility specialist per month. Supervisors and senior program management have the ability to monitor phone interactions between eligibility specialists and clients in real time. Prior to February 2021, case reviews and call monitoring activities were not formalized or tracked. In February 2021, the Department implemented formal, documented case review and call monitoring procedures using standardized forms. Components of the formal case review include a review of the accuracy of data entry and resulting eligibility determinations, and appropriateness of processes. However, the Department does not have a process in place to review a random selection of cases, track specific issues identified in the reviews, identify common errors, and determine if those errors had a broader impact on eligibility determinations. Cases subject to review are judgmentally selected by supervisors. With approximately 300 eligibility specialists, case reviews are only performed for approximately one percent of all eligibility determinations. Identified errors are corrected in individual case files, but the results of case reviews are not monitored to identify common issues. The Office of the State Auditor (OSA) also issued finding numbers 2021-052, Internal control over compliance with eligibility determination requirements needs improvement, and 2021-058, Internal control over the ACES system needs improvement. Context: In fiscal year 2021, the State provided approximately: ? 360,000 Medicaid/CHIP clients with $2.2 billion in Federal benefits; ? 117,000 SNAP clients with $374 million in Federal benefits; and ? 16,000 TANF clients with $27 million in Federal benefits. Cause: Lack of adequate procedures to prevent, or detect and correct, errors and inaccuracies affecting the overall population of eligibility determinations Effect: ? Individuals not eligible for services could be deemed eligible or eligible individuals could be deemed ineligible. ? Potential questioned costs and disallowances Recommendation: We recommend that the Department enhance the formal case review procedures that were implemented to increase the number of case reviews performed and include a systematic, random selection of cases for review. This will ensure that a representative sample of eligibility determinations are objectively reviewed. We further recommend that the Department implement procedures to track errors and inaccuracies identified through the review process, determine common issues and areas of concern, and apply those results to the broader population of eligibility determinations. This will ensure that eligibility determinations are performed accurately. Corrective Action Plan: See F-21 Management?s Response: The Department disagrees with this finding. The systems we have in place are both necessary and sufficient in meeting programmatic requirements to ensure accurate eligibility determinations are being made. There has been no citation of federal regulation provided by OSA during this review that contradicts this. The Department would like to note: 1. Supervisors do a minimum of 1 case reading per month and a minimum of 1 call monitoring per week for staff on phones. It is commonplace for them to do more, especially for a new employee, or known coaching issues. 2. Prior to 2021, these case readings were tracked by supervisors and units, and were tracked centrally on our Streamline Management Y-Drive. 3. Phone calls can be referenced by Supervisors in real time OR afterwards, via recording. 4. Prior to 2021 specifics of case reading and call monitoring were formalized, with specific expectations in multiple categories, which were followed up on by coaching staff if not all of the expectations were met. However, with a goal of continuous improvement, we were already working on an enhanced system to track Case Reading and Call Monitoring performance statewide which will supersede and further improve upon current practice. A new program and procedure have already been written and are in the process of being vetted and approved by Regional personnel for implementation. This example of continuous quality improvement will lead to a more holistic understanding of trends and training needs. Contact: Anthony Pelotte, Director, Office for Family Independence, DHHS, 207-624-4104 Auditor?s Concluding Remarks: The results of OSA?s fiscal year 2021 testing of client eligibility determination requirements, as documented in finding 2021-052, identified material noncompliance with Federal regulations. The existing control environment as described by the Department did not prevent, or detect and correct, this noncompliance. In addition, OSA requested evidence to support the Department?s tracking of deficiencies identified through case reading and call monitoring procedures, the application of those results to the broader population of eligibility determinations to track the frequency and cause of deficiencies, and the implementation of broad-based corrective action taken in response to those findings. The Department did not provide evidence that this occurred. The Department did not demonstrate the establishment and maintenance of effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards as required by 2 CFR 200.303. The finding remains as stated. (State Number: 21-1106-02)

(2021-055) Title: Internal control over cost of care assessments needs improvement Prior Year Findings: See Schedule of Findings and Questioned Costs for chart/table State Department: Health and Human Services State Bureau: Office for Family Independence Federal Agency: U.S. Department of Health and Human Services Assistance Listing Title: Medicaid Cluster (COVID-19) Assistance Listing Number (CFDA): 93.775, 93.777, 93.778 Federal Award Identification Number: 2005ME5MAP, 2105ME5MAP Compliance Area: Allowable costs/costs principles Type of Finding: Significant deficiency Questioned Costs: Undeterminable. Incorrectly calculated cost of care (COC) assessments may result in an overpayment or underpayment to the providers when the State makes a payment for long-term care. Since there is not always a claim for every assessment, a projection of questioned costs cannot be reasonably estimated. Criteria: 2 CFR 200.303; 42 CFR 435.725; Families First Coronavirus Response Act (FFCRA) Section 6008(b)(3); MaineCare Eligibility Manual, Part 14, Section 6 The Department must establish and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. The Department must reduce its payment to an institution for service provided to an individual by the amount that remains after deducting certain amounts from the member?s total income. This remaining amount is the member?s maximum share of the cost, known as COC. Section 6008(b)(3) under the FFCRA prohibits states that claimed the temporary increase of Medicaid Federal Medical Assistance Percentages from making increases to a beneficiary?s required financial responsibility prior to November 2, 2020. Condition: A COC assessment represents the required contribution that a MaineCare recipient must pay toward care in a long-term care facility. The Office for Family Independence (OFI) is responsible for calculating COC assessments for Medicaid for all members in the State. A COC deduction represents the amount of assessment that was deducted from a paid claim. Members may have an assessment calculated but may never have a claim with a deduction utilizing that assessment. The Office of MaineCare Services (OMS) is responsible for applying assessments to submitted claims prior to payment. The Office of the State Auditor (OSA) selected a non-statistical random sample of 60 COC assessments and related deductions from paid claims. Three exceptions for COC assessments that were not adjusted correctly after notification of a change in income or expense were identified as follows: ? One COC was lower than it should have been by $30. The assessment was $1,477 and should have been $1,507 for six months during the fiscal year. This member had six claims where the incorrect COC was applied. ? One COC was lower than it should have been by $106. The assessment was $655 and should have been $761 for January 2021. This member did not have a qualifying claim for January 2021. ? One COC was lower than it should have been by $2. The assessment was $731 and should have been $733 for all 12 months of the fiscal year. This member had 12 claims where the incorrect COC was applied. OSA judgmentally selected three COC assessments that increased prior to November 2, 2020, to test for compliance with FFCRA criteria and noted the following: ? One COC increased $197 from $1,275 to $1,472 for October 2020. ? One COC increased $30 from $641 to $671 for the months of August and September 2020. Context: In fiscal year 2021, approximately: ? 34,000 COC assessments were calculated by OFI; ? 9,700 members had COC assessments; and ? $521 million was paid to nursing facilities and residential care facilities. Cause: ? Increased oversight procedures for manually adjusted COC assessments were not in place for the entire fiscal year. ? System enhancements to reduce the number of COC assessments that require manual adjustments were not in place for the entire fiscal year. ? Lack of supervisory oversight for COC assessments that increased prior to November 2, 2020 Effect: ? Inaccurate COC assessments and retroactive changes may result in overpayments or underpayments for members or the State. ? Potential questioned costs and disallowances ? Noncompliance with the FFCRA Recommendation: We recommend that the Department monitor newly implemented procedures and system enhancements to ensure that COC assessments are accurately calculated and that manually adjusted assessments have proper oversight. We further recommend that the Department review COC assessments that increased prior to November 2, 2020, and determine appropriate steps to ensure compliance with the FFCRA. Corrective Action Plan: See F-21 Management?s Response: The Department agrees with this finding and has a quality assurance process for monitoring manually adjusted cost of care assessments as reflected in the standard operating procedures which underwent a major revision, effective June 30, 2020. This new business process was in effect for the entire audited year. From the sample that was tested, the Department achieved a 95% compliance rate and will commit to continuing to achieve at least 95%. No corrective action is necessary. Contact: Anthony Pelotte, Director, Office for Family Independence, DHHS, 207-624-4104 (State Number: 21-1106-07)

(2021-056) Title: Internal control over deceased client cases and claims analysis needs improvement Prior Year Findings: See Schedule of Findings and Questioned Costs for chart/table State Department: Health and Human Services State Bureau: Office for Family Independence Office of MaineCare Services Federal Agency: U.S. Department of Health and Human Services Assistance Listing Title: Medicaid Cluster (COVID-19) Assistance Listing Number (CFDA): 93.775, 93.777, 93.778 Federal Award Identification Number: 2005ME5MAP, 2105ME5MAP Compliance Area: Allowable costs/costs principles Eligibility Type of Finding: Significant deficiency Questioned Costs: None Criteria: 2 CFR 200.303; 2 CFR 200.403 The Department must establish and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. Costs must be necessary and reasonable for the performance of the Federal award. Condition: The Office for Family Independence (OFI) is responsible for maintaining complete and accurate client information in the Automated Client Eligibility System (ACES). Information entered into ACES is relied on by the Office of MaineCare Services (OMS) to approve, deny, process, and analyze claims. OFI relies on numerous data sources for identifying and providing client date of death (DOD) information for input into ACES. In some cases where the exact DOD may not be immediately available, the DOD is entered as the last day of the month so that OFI can close the case of a known deceased client in a timely manner. OFI did not have a process in place for the entire fiscal year to identify and correct this information once a known DOD was provided. Audit procedures identified 13 clients with a DOD that was inconsistent with the actual DOD as provided by Maine Center for Disease Control & Prevention vital records. OMS has established procedures to identify claims paid with a service date after DOD. These procedures include staff review of claims and identification of appropriate action for any claim that was improperly paid, as certain claims with service dates after death are allowable. The Office of the State Auditor (OSA) identified an additional 65 claims that had service dates after death but were not identified by OMS procedures. OSA analyzed the entire population of medical claims paid in fiscal year 2021. Context: The Federal Medicaid program processed approximately $1.8 billion in paid medical claims in fiscal year 2021. Cause: ? Lack of procedures to ensure DOD information is entered accurately and appropriately updated in ACES ? Lack of adequate procedures to ensure all claims paid after a client?s DOD are identified Effect: ? Claims paid on behalf of deceased clients may go undetected. ? Potential questioned costs and disallowances Recommendation: We recommend that OFI implement procedures to identify and correct DOD information when a known DOD is not initially provided. We further recommend that OFI implement oversight to ensure DOD information is accurately entered into ACES. We recommend that OMS enhance existing procedures to ensure that all claims with service dates after a client?s DOD are identified for review to detect any claims that are not allowable. Corrective Action Plan: See F-22 Management?s Response: OFI Response: While the Department acknowledges 13 exceptions were found during the audit period ending June 30, 2021, it should be noted that all of these occurred prior to our updated standard operating procedure governing Date of Death processing which was implemented on April 26, 2021. Contact: Anthony Pelotte, Director, Office for Family Independence, DHHS, 207-624-4104 OMS Response: The Department has procedures in place among multiple units to identify and recover claims paid with dates of service after the date of death. Starting in February 2019, the Adjustment Unit receives updates from the Change Management Unit when there is a change to a member?s date of death and then adjusts/reverses any affected claims. The Program Integrity Unit runs an annual DOD report (implemented in November 2020) to identify and recover any overpayments. For context regarding the efficacy of the Department?s current procedures, there was an error rate of .000003 for claims with dates of service after the date of death. Contact: Michelle Probert, Director, Office of MaineCare Services, DHHS, 207-287-2093 Auditor?s Concluding Remarks are on the following page. Auditor?s Concluding Remarks: As stated in the Condition, OSA identified 65 claims that had service dates after death but were not identified by OMS procedures. Therefore, OMS procedures are not adequate to ensure claims are identified and reviewed. The finding remains as stated. (State Number: 21-1106-08)

(2021-057) Title: Internal control over the outsourced medical claims coding process needs improvement Prior Year Findings: See Schedule of Findings and Questioned Costs for chart/table State Department: Health and Human Services State Bureau: Office of MaineCare Services Federal Agency: U.S. Department of Health and Human Services Assistance Listing Title: Medicaid Cluster (COVID-19) Assistance Listing Number (CFDA): 93.775, 93.777, 93.778 Federal Award Identification Number: 2005ME5MAP, 2105ME5MAP Compliance Area: Special tests and provisions Type of Finding: Significant deficiency Questioned Costs: None Criteria: 2 CFR 200.303; Social Security Act Section 1903(r); National Correct Coding Initiative (NCCI) Medicaid Policy Manual; NCCI Medicaid Technical Guidance Manual The Department must establish and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. State Medicaid Agencies (SMAs) are required to incorporate National Correct Coding Initiative (NCCI) methodologies into State Medicaid programs. States are required to completely and correctly implement six Medicaid NCCI methodologies to ensure that only proper payment of allowable procedures is reimbursed, including the use of specific edit files. Condition: The NCCI was established by the Centers for Medicare and Medicaid Services (CMS) in an effort to promote correct coding by preventing coding errors and code manipulation and reducing improper payments and improper payment rates. The CMS NCCI Policy Manual states that SMAs must download specific confidential NCCI edit files available on the secure portal, known as MII RISSNET, rather than using publicly available files. SMAs must ensure that they or their vendors are using the appropriate Medicaid NCCI edits to adjudicate Medicaid claims. The Office of MaineCare Services (OMS) contracts with a vendor to process medical claims. The vendor updates the claims processing system to incorporate the NCCI edit files; however, the vendor is not obtaining and applying the specific confidential files from MII RISSNET as required by CMS. Context: OMS processed approximately $1.8 billion in Federal medical claims in fiscal year 2021. Cause: OMS determined that the benefit of utilizing the correct coding files did not support the time and expense required to implement the change. Effect: ? Incorrect coding could result in payment of unallowable claims or denial of allowable claims. ? Potential questioned costs and disallowances ? Noncompliance with Federal regulations Recommendation: We recommend that OMS devote the necessary resources to facilitate claims processing using the MII RISSNET files as required by CMS. Corrective Action Plan: See F-22 Management?s Response: The Department agrees with this finding. A Change Request has been made with the vendor to process claims using the MII RISSNET files. OMS is currently evaluating the Change Request development schedule and estimates that this will be completed and deployed by September of 2022. Currently the MIHMS NCCI reference tables are updated by publicly available files found on the Medicaid website. CMS requires States to update the MIHMS NCCI reference tables with NCCI edit files that are available on the Medicaid Integrity Institute (MII) secure portal (RISSNET). The Change Request was also created to set up a process to update the MIHMS NCCI reference tables with the RISSNET NCCI edit files. Contact: Michelle Probert, Director, Office of MaineCare Services, DHHS, 207-287-2093 (State Number: 21-1106-05)

(2021-058) Confidential finding, see below for more information Title: ________ over the ________ system needs improvement Pursuant to paragraph 6.63 of the U.S. Government Accountability Office?s Government Auditing Standards (also known as the Yellow Book), we omitted details from this finding as they are confidential under the provisions of 5 MRSA 244-C (3). Though the content of this finding has been redacted, which appears as blank underlining, we provided the Department(s) with detailed information regarding the specific condition we identified, as well as the related criteria, context, causes, effects, and our specific recommendations for improvement. Prior Year Findings: See Schedule of Findings and Questioned Costs for chart/table State Department: Health and Human Services State Bureau: Office for Family Independence Federal Agency: U.S. Department of Health and Human Services U.S. Department of Agriculture Assistance Listing Title: Medicaid Cluster (COVID-19) Children?s Health Insurance Program (CHIP) (COVID-19) SNAP Cluster Temporary Assistance for Needy Families (TANF) Assistance Listing Number (CFDA): 93.775, 93.777, 93.778; 93.767; 10.551, 10.561; 93.558 Federal Award Identification Number: 2005ME5MAP, 2105ME5MAP; 2005ME5021, 2105ME5021; SNAP Benefits, Maine; 1801METANF, 1901METANF, 2001METANF, 2101METANF Compliance Area: Allowable costs/cost principles Eligibility Type of Finding: Significant deficiency Questioned Costs: None Criteria: ________ Condition: ________ Context: ________ Cause: ________ Effect: ________ Recommendation: ________ Corrective Action Plan: See F-22 Management?s Response: ________ Contact: Anthony Pelotte, Director, Office for Family Independence, DHHS, 207-624-4104 Auditor?s Concluding Remarks: ________ (State Number: 21-0905-02)

(2021-059) Title: Internal control over cash management needs improvement Prior Year Findings: None State Department: Defense, Veterans and Emergency Management State Bureau: Maine Emergency Management Agency Federal Agency: U.S. Department of Homeland Security Assistance Listing Title: Disaster Grants ? Public Assistance (Presidentially Declared Disasters) (COVID-19) Assistance Listing Number (CFDA): 97.036 Federal Award Identification Number: 354DRMEP1SME500, 4367DRMEP1SME500, 4522DRMEP1SME500 Compliance Area: Cash management Type of Finding: Material weakness Material noncompliance Questioned Costs: None Criteria: 2 CFR 200.303; 2 CFR 200.302; 31 CFR 205.33; State Administrative and Accounting Manual (SAAM) Section 50.40.80 The Department must establish and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. Financial records must adequately identify the source and application of funds and provide accountability for all funds, property, and other assets related to the Federally funded activities. The Department must minimize the time between the drawdown of Federal funds and the disbursement of these funds for Federal program purposes. The timing and amount of fund transfers must be as close as is administratively feasible to the Department?s actual cash outlay for program costs. Section 50.40.80 of the SAAM has defined administratively feasible as no more than seven business days. Condition: The Maine Emergency Management Agency (MEMA) did not minimize the time between drawdown and disbursement of Federal funds. In the Office of the State Auditor?s testing of 25 drawdowns: ? the cash balance was not taken into consideration when requesting any of the Federal drawdowns; and ? eight of the disbursements for program costs ranged from 10 to 48 days after the Federal funds were received. The Office of the State Auditor selected a judgmental and a non-statistical random sample. Context: During fiscal year 2021, MEMA expended approximately $39.8 million in Disaster Grants ? Public Assistance grant funds. Cause: ? Lack of adequate policies and procedures ? Lack of staff resources available to process grant drawdowns and monitor cash balances due to the increased number of COVID-19 grants managed by the agency Effect: ? The Federal government may impose more stringent program-specific cash management requirements based on noncompliance. ? Noncompliance with Federal and State regulations Recommendation: We recommend that the Department develop and implement policies and procedures to ensure that Federal cash is requested based on immediate cash needs which includes consideration of existing cash balances. We also recommend the Department review its staffing needs to ensure there are adequate resources to process and provide supervisory oversight over the increased workload from COVID-19 grants. Corrective Action Plan: See F-23 Management?s Response: The Department agrees with this finding. We are working to improve the cash management procedures and to implement the necessary reconciliation and draw processes. Contact: Joe Legee, Deputy Director, MEMA, 207-215-0442 (State Number: 21-1502-01)

(2021-060) Title: Internal control over subrecipient audit procedures needs improvement Prior Year Findings: None State Department: Defense, Veterans and Emergency Management State Bureau: Maine Emergency Management Agency Federal Agency: U.S. Department of Homeland Security Assistance Listing Title: Disaster Grants ? Public Assistance (Presidentially Declared Disasters) (COVID-19) Assistance Listing Number (CFDA): 97.036 Federal Award Identification Number: 4354DRMEP1SME500, 4367DRMEP1SME500, 4522DRMEP1SME500 Compliance Area: Subrecipient monitoring Type of Finding: Material weakness Material noncompliance Questioned Costs: None Criteria: 2 CFR 200.303; 2 CFR 200.332 The Department must establish and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. When a subrecipient?s Federal award expenditures are expected to equal or exceed $750,000 during the fiscal year, the Department must verify that the subrecipient is audited as required by Subpart F of 2 CFR 200. Condition: Maine Emergency Management Agency (MEMA) uses a spreadsheet to track when subrecipient Single Audit reports are due in order to ensure that they are received and reviewed as required. The Office of the State Auditor tested 11 subrecipients. MEMA could not provide evidence to verify that any of the subrecipients obtained Single Audits. Additional audit procedures found that at least 4 of the 11 subrecipients had Federal funding that exceeded the Single Audit requirement threshold. MEMA did not obtain or review these audits for potential subrecipient noncompliance with Federal regulations. The Office of the State Auditor selected a non-statistical random sample. Context: MEMA provided approximately $19.8 million in Disaster Grants ? Public Assistance funds to subrecipients during fiscal year 2021. Cause: Competing priorities related to an increase in aid requests as a result of COVID-19 Effect: ? Noncompliance with Federal regulations ? Subrecipients may not be complying with Federal statutes, regulations, or the terms and conditions of the subaward. Recommendation: We recommend that MEMA allocate resources to ensure that each subrecipient?s audits are received, reviewed, and that corrective action is taken in a timely manner. Corrective Action Plan: See F-23 Management?s Response: The Department agrees with this finding. We are working to improve and implement procedures as necessary to ensure MEMA meets the subrecipient audit requirements. Contact: Joe Legee, Deputy Director, MEMA, 207-215-0442 (State Number: 21-1502-03)

(2021-061) Title: Internal control over Schedule of Expenditures of Federal Awards reporting needs improvement Prior Year Findings: None State Department: Administrative and Financial Services Defense, Veterans and Emergency Management State Bureau: Office of the State Controller Maine Emergency Management Agency Federal Agency: U.S. Department of Homeland Security Assistance Listing Title: Disaster Grants ? Public Assistance (Presidentially Declared Disasters) (COVID-19) Assistance Listing Number (CFDA): 97.036 Federal Award Identification Number: 4354DRMEP1SME500, 4367DRMEP1SME500, 4522DRMEP1SME500 Compliance Area: Reporting Type of Finding: Material weakness Material noncompliance Questioned Costs: None Criteria: 2 CFR 200.303; 2 CFR 200.510; 2 CFR 200, Appendix XI, Assistance Listing Number 97.036 The Department must establish and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. The Department must prepare a Schedule of Expenditures of Federal Awards (SEFA) for the period covered by the State?s financial statements which must include the total Federal awards expended. At a minimum, the SEFA must provide total Federal awards expended for each individual Federal program and the Assistance Listing Number (ALN). Non-Federal entities must record expenditures on the SEFA when: (1) the Federal Emergency Management Agency has approved the non-Federal entity?s Project Worksheet (PW), and (2) the non-Federal entity has incurred the eligible expenditures. Federal awards expended in years subsequent to the fiscal year in which the PW is approved are to be recorded on the non-Federal entity?s SEFA in those subsequent years. Condition: Maine Emergency Management Agency (MEMA) must complete and submit exhibits and related schedules to the Office of the State Controller (OSC) at the close of each fiscal year to report Federal award information for inclusion on the State?s SEFA. OSC is responsible for compiling this information on behalf of the State. OSC obtained a schedule from the State?s Division of Purchases identifying $29.8 million in expenditures that were expected to be reimbursed under the Disaster Grants ? Public Assistance program. OSC incorrectly determined the expenditures to be recognizable by the Federal program in fiscal year 2021 and the expenditures were included on the SEFA. The Office of the State Auditor?s audit of the $29.8 million of additional expenditures identified the following: ? An overstatement of $8.3 million due to the same expenditures being included in the SEFA total twice. ? An overstatement of $21.5 million in expenditures that should not have been included as fiscal year 2021 expenditures in accordance with Federal regulations. Additionally, approximately $19.5 million of other program expenditures were incorrectly reported as amounts provided to subrecipients. As a result of this error, subrecipient expenditures were overstated and direct expenditures were understated on the SEFA. Context: MEMA Disaster Grants ? Public Assistance program expenditures were incorrectly reported as approximately $69.7 million rather than $39.9 million in fiscal year 2021. Additionally, approximately $39.4 million of that amount was reported as subrecipient expenditures, rather than the correct total of $19.9 million. Cause: ? Lack of adequate internal control relating to agency SEFA submissions to OSC ? Lack of adequate review procedures Effect: Incomplete or inaccurate amounts by Federal program and ALN on the SEFA would result in noncompliance with Federal regulations if undetected. The SEFA is submitted to the Federal government and may be used for programmatic, policy or statistical purposes. Recommendation: We recommend that OSC work with MEMA to improve SEFA submission and subsequent review procedures to ensure Federal program expenditures are reported accurately. Corrective Action Plan: See F-23 Management?s Response: The Department agrees with this finding. An administrative oversight resulted in $8.3 million being included in the SEFA twice. The $21.5 million are expenditures that were originally incurred in a non-federal fund, but not transferred to the federal fund until 2022. Since the SEFA is a cash basis document the $21.5 million should not be reflected in the SEFA until 2022 when the transfer was approved and recorded. OSC will work with State agencies to better understand the process they follow and offer to help them meet the requirements for SEFA reporting. Contact: Thomas Randall, Financial Coordinator/Audit Analyst, OSC, 207-626-8492 (State Number: 21-1502-04)

(2021-062) Title: Internal control over special reporting needs improvement Prior Year Findings: None State Department: Defense, Veterans and Emergency Management State Bureau: Maine Emergency Management Agency Federal Agency: U.S. Department of Homeland Security Assistance Listing Title: Disaster Grants ? Public Assistance (Presidentially Declared Disasters) (COVID-19) Assistance Listing Number (CFDA): 97.036 Federal Award Identification Number: 4354DRMEP1SME500, 4367DRMEP1SME500, 4522DRMEP1SME500 Compliance Area: Reporting Type of Finding: Material weakness Material noncompliance Questioned Costs: None Criteria: 2 CFR 200.303; 2 CFR 170 The Department must establish and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. Agencies must report each subaward that equals or exceeds the first-tier subaward threshold of $30,000 in Federal funds in the public-facing Federal Funding Accountability and Transparency Act (FFATA) Subaward Reporting System. Condition: When a subaward exceeding the first-tier threshold is awarded to a subrecipient, Maine Emergency Management Agency (MEMA) must collect and enter data into the FFATA Subaward Reporting System. MEMA did not report any subawards in the reporting system in fiscal year 2021. Context: MEMA provided approximately $19.8 million in Disaster Grants ? Public Assistance funds to subrecipients in fiscal year 2021. Of the 105 subrecipients in fiscal year 2021, 39 received subawards exceeding the first-tier subaward threshold totaling approximately $19.1 million. Cause: ? Competing priorities related to an increase in aid requests as a result of COVID-19 ? Lack of resources ? Lack of policies and procedures Effect: Noncompliance with Federal regulations Recommendation: We recommend that MEMA implement policies and procedures to ensure that FFATA reporting is completed for all subawards that meet or exceed the first-tier threshold. We further recommend that MEMA allocates resources to properly report subrecipient awards as required by Federal program regulations. Corrective Action Plan: See F-24 Management?s Response: The Department agrees with this finding. We are working to create and implement the necessary policies and procedures to ensure MEMA completes FFATA reporting for all subawards that meet or exceed the first-tier threshold. Contact: Joe Legee, Deputy Director, MEMA, 207-215-0442 (State Number: 21-1502-05)

(2021-063) Title: Internal control over subrecipient risk evaluation procedures needs improvement Prior Year Findings: None State Department: Defense, Veterans and Emergency Management State Bureau: Maine Emergency Management Agency Federal Agency: U.S. Department of Homeland Security Assistance Listing Title: Disaster Grants ? Public Assistance (Presidentially Declared Disasters) (COVID-19) Assistance Listing Number (CFDA): 97.036 Federal Award Identification Number: 4354DRMEP1SME500, 4367DRMEP1SME500, 4522DRMEP1SME500 Compliance Area: Subrecipient monitoring Type of Finding: Significant deficiency Questioned Costs: None Criteria: 2 CFR 200.303; 2 CFR 200.332 The Department must establish and maintain effective internal control over Federal awards that provides reasonable assurance that the Department is managing awards in compliance with Federal statutes, regulations, and the terms and conditions of awards. The Department is required to evaluate each subrecipient?s risk of noncompliance with Federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate subrecipient monitoring described in 2 CFR 200.332. Condition: When a subrecipient applies for Disaster Grants ? Public Assistance funds, Maine Emergency Management Agency (MEMA) policy requires staff to use a subrecipient risk assessment form to determine the risk of subrecipient noncompliance and appropriate monitoring procedures based on the determined risk. MEMA did not evaluate each subrecipient?s risk of noncompliance with Federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate level of subrecipient monitoring. In the 26 subrecipients selected for testing, 25 did not have completed risk evaluations. The Office of the State Auditor selected a judgmental and a non-statistical random sample. Context: MEMA provided approximately $19.8 million in Disaster Grants ? Public Assistance funds to subrecipients in fiscal year 2021. Cause: ? Competing priorities related to an increase in aid requests as a result of COVID-19 ? Lack of resources Effect: Subrecipients that are deemed higher risk as a result of prior noncompliance may not be monitored on a more frequent basis. Conversely, subrecipients that are deemed lower risk may not be monitored on a less frequent basis, which would free resources and time to dedicate towards other higher risk subrecipients. Recommendation: We recommend that MEMA continue implementation of their process that evaluates each subrecipient?s risk of noncompliance specifically for the purposes of determining the appropriate subrecipient monitoring to be performed during the subaward. We further recommend that MEMA allocate resources to evaluate risk in order to properly monitor subrecipients as required by Federal program regulations. Corrective Action Plan: See F-24 Management?s Response: The Department agrees with this finding. We are working to improve the risk assessment procedures and to implement the necessary assessment and monitoring on all subrecipients. Contact: Joe Legee, Deputy Director, MEMA, 207-215-0442 (State Number: 21-1502-02)

(2020-010) Confidential finding, see below for more information Title: ________ and ________ over ________ need improvement (The content of this finding has been redacted. This appears as blank underlining) Prior Year Findings: See Schedule of Findings and Questioned Costs for chart/table *The system was not audited in this fiscal year. State Department: Administrative and Financial Services State Bureau: Office of Information Technology Federal Agency: U.S. Department of Health and Human Services CFDA Title: Medicaid Cluster CFDA Number: 93.775, 93.777, 93.778 Federal Award Identification Number: 1905ME5MAP, 2005ME5MAP Compliance Area: Allowable costs/cost principles Eligibility Type of Finding: Significant deficiency Questioned Costs: None See Schedule of Findings and Questioned Costs for chart/table Criteria: National Institute of Standards and Technology (NIST) Special Publication ________; State of Maine ________; State of Maine ________ NIST Special Publication ________ states that organizations are responsible and accountable for the ________ by the use of ________ provided by ________. Ultimately, the responsibility for adequately ________ remains with ________. Organizations require that appropriate chains of trust be established with ________ when dealing with the many issues associated with ________. Organizations must establish and retain a level of trust that ________ in the________ provide adequate ________ to organizations. Condition: ________ refers to ________ that are owned and maintained by ________ to ________. These ________ and ________. ________ and ________ over ________ are not sufficient to ________ that are ________. The Office of Information Technology (OIT) has not been provided ________, ________, or ________ relevant to ________. Context: The State Department ________ are at risk from ________ because they are ________. The ________ is the largest program affected. ________ for this program processed approximately ________ in expenditures during fiscal year 2020. Programs must comply with Federal rules and regulations to avoid potential disallowance of Federal funding. OIT is in the process of developing and implementing ________ by the end of 2020. Currently, OIT has effectively ________. However, there remains ________. Cause: ________ Effect: ________ and ________ are a major focus of internal and external threats. The current ________ can potentially lead to the ________, ________, or the ________. Recommendation: We recommend that the Department continue efforts to ________, thereby lowering the overall ________. Corrective Action Plan: See F-8 Management?s Response: The Department agrees with this finding. The status of the ________ is progressing as ________ on the ________ have been ________. The remaining ________ are scheduled to ________ before the end of calendar year 2020. Contact: Nathan Willigar, Chief Information Security Officer, OIT, 207-458-1320 This is a confidential finding containing sensitive information. The complete finding has been formally addressed to: ? Chris Thibault, Administrative Specialist, Centers for Medicare and Medicaid Services, John F. Kennedy Federal Building, Room 2325, 15 New Sudbury Street, Boston, MA 02203 A copy of that correspondence has also been sent to: ? Greg Dowell, Assistant Director, U.S. Department of Health and Human Services, Office of the Inspector General, Office of Audit Service, National External Audit Review Center, 601 E. 12th Street, Suite 0429, Kansas City, MO 64106 (State Number: 20-0905-01)

(2020-011) Confidential finding, see below for more information Title: The Department has no ________ that ________ over the ________ is adequate (The content of this finding has been redacted. This appears as blank underlining) Prior Year Findings: See Schedule of Findings and Questioned Costs for chart/table *The system was not audited in this fiscal year. State Department: Education State Bureau: School Finance and Operations Federal Agency: U.S. Department of Education CFDA Title: Special Education Cluster (IDEA) CFDA Number: 84.027, 84.173 Federal Award Identification Number: H173A170115, H173A180115, H173A190115, H027A170109, H027A180109, H027A190109 Compliance Area: Reporting Subrecipient monitoring Type of Finding: Significant deficiency Questioned Costs: None See Schedule of Findings and Questioned Costs for chart/table Criteria: National Institute of Standards and Technology (NIST) Special Publication ________; State of Maine ________ NIST Special Publication ________ provides that organizations consider ________. ________, ________, and ________ are made available to ________ and ________. If ________ are provided to ________, arrangements must be made with the ________. ________. NIST Special Publication ________ states that organizations are responsible and accountable for ________. Ultimately, the responsibility for ________ remains with ________. Organizations require that ________. Organizations must ________ and ________. The State of Maine ________ state that ________, ________, and ________, and must also ________. Condition: The Department ________ with the ________ to provide ________ and a ________; however, the ________ was unable ________ for the audit period. Therefore, the department did not have ________ that ________ were in place over the ________ provided by ________ to ensure that ________. Context: ________ with a ________ to provide ________ and ________, including ________. ________ results can ________. ________ to determine the amount of ________ provided by the State to approximately ________ and ________. In fiscal year 2020, approximately ________ was provided. This includes ________ for the ________ of approximately ________. Cause: Although the Department required ________, the ________ was unable ________ for the audit period. Effect: ? ________ ? ________ ? ________ Recommendation: We recommend that ________ require the ________, ________, and ________; and ________. DOE would then ________ that the ________, ________, ________, and ________. Corrective Action Plan: See F-9 Management?s Response: The Department agrees with this finding. ________ is a ________, which ________ used to meet state and Federal reporting requirements. ________ is not a ________ which contains ________, nor does it ________, or ________. ________ is a ________ that ________. The ________ is ________ in the ________ and as such, the Department expected that ________ to meet all ________ and ________ and ________, to include applicable ________ and ________. To address the issues surrounding ________, the Department has renewed the ________ and has included ________ regarding the ________ to address ________ and ________, ________, and ________. As there is no ________ held in the ________, ________ and ________ will not need to be addressed in the ________. The Department was unable to resolve the finding for FY2020 as the ________ had ________, and the ________ was beyond the ________. The Department will request, through the state budget process, adequate resources to have ________. Contact: Joanne Allen, Director, School Finance & Operations, DOE, 204-624-6790 This is a confidential finding containing sensitive information. The complete finding has been formally addressed to: ? Christine Pilgrim, Associate Division Director, Monitoring and State Improvement Planning Division, Office of Special Education Program, Office of Special Education and Rehabilitative Services, U.S. Department of Education, 550 12th Street SW, Washington, DC 20202 A copy of that correspondence has also been sent to: ? Mark Priebe, Director Non-Federal Audit Team, U.S. Department of Education, Office of the Inspector General, 550 12th Street SW, Room 8153, Washington, DC 20202 (State Number: 20-0900-05)

(2020-012) Confidential finding, see below for more information Title: The Department of Health and Human Services has no ________ that ________ over the ________ is adequate (The content of this finding has been redacted. This appears as blank underlining) Prior Year Findings: See Schedule of Findings and Questioned Costs for chart/table *The system was not audited in this fiscal year. State Department: Health and Human Services State Bureau: Office of MaineCare Services Federal Agency: U.S. Department of Health and Human Services CFDA Title: Medicaid Cluster Children?s Health Insurance Program (CHIP) CFDA Number: 93.775, 93.777, 93.778; 93.767 Federal Award Identification Number: 1905ME5MAP, 2005ME5MAP; 1905ME5021, 2005ME5021 Compliance Area: Allowable costs/cost principles Type of Finding: Significant deficiency Questioned Costs: None See Schedule of Findings and Questioned Costs for chart/table Criteria: National Institute of Standards and Technology (NIST) Special Publication ________; State of Maine ________; State ________ NIST Special Publication ________ states that the organizations consider ________. ________, ________, and ________. If ________, arrangements must be made with ________. Information obtained from ________. NIST Special Publication ________ states that ________ and ________. Ultimately, the responsibility for adequately ________ remains with ________. Organizations require that appropriate ________ with ________. Organizations must ________. The State of Maine ________ state that ________ must ensure a ________, ________, and ________; and must also ________. The ________ requires the ________ to ________. Condition: The Department has not received ________ from ________ that ________ is adequate. The ________ must ________ that ________, ________, ________, ________, and ________. Specifically, the ________ is the ________. The Department stated that a ________ will start in early 2021 and the ________ will be provided in late 2021. Context: ________ is the ________ used to ________. These ________ totaled approximately ________ in ________, including approximately ________ during fiscal year 2020. ________ is an integral part of Maine?s ________. Cause: The ________ did not comply with the ________. The ________ requires that the ________ be provided to the State. Effect: ? ________ ? ________ ? ________ Recommendation: We recommend that the Department implement procedures to ensure that ________. This will provide the Department assurance that ________ related ________, ________, ________, ________, and ________ are adequate. Corrective Action Plan: See F-9 Management?s Response: The Department agrees with this finding. The ________ requires an ________. An initial ________ requires a ________, a ________, and then the ________. The ________ is currently being conducted and is anticipated to be done before the end of 2020, with the final ________ completed for review in early 2021. The second year of the audit will start in early 2021 with the final ________ later in 2021. The procedure will be that the program administrator will monitor the progress of the ________, to ensure the contractual requirements are met. Contact: Michelle S. Probert, Director, Office of MaineCare Services, 207-287-2093 This is a confidential finding containing sensitive information. The complete finding has been formally addressed to: ? Chris Thibault, Administrative Specialist, Centers for Medicare and Medicaid Services, John F. Kennedy Federal Building, Room 2325, 15 New Sudbury Street, Boston, MA 02203 A copy of that correspondence has also been sent to: ? Greg Dowell, Assistant Director, U.S. Department of Health and Human Services, Office of the Inspector General, Office of Audit Service, National External Audit Review Center, 601 E. 12th Street, Suite 0429, Kansas City, MO 64106 (State Number: 20-0900-07)

(2020-013) Confidential finding, see below for more information Title: The Department of Labor has no ________ that ________ over the ________ is adequate (The content of this finding has been redacted. This appears as blank underlining) Prior Year Findings: See Schedule of Findings and Questioned Costs for chart/table *The system was not audited in this fiscal year. State Department: Labor State Bureau: Unemployment Compensation Federal Agency: U.S. Department of Labor CFDA Title: Unemployment Insurance (UI) CFDA Number: 17.225 Federal Award Identification Number: Unemployment Insurance Trust Fund, Maine Compliance Area: Allowable costs/cost principles Eligibility Type of Finding: Material weakness Questioned Costs: None See Schedule of Findings and Questioned Costs for chart/table Criteria: National Institute of Standards and Technology (NIST) Special Publication ________; Federal Information Processing Standards (FIPS); State of Maine ________ NIST Special Publication ________ states that ________, ________, ________, ________, ________, or ________, ________, and ________. State of Maine ________ state that ________, ________, and ________, and ________. Condition: The Office of the State Auditor continues to report that the Maine Department of Labor (MDOL) does not have ________ that ________ related ________ over the ________ provided by ________ are adequate and that ________ is ________, ________, ________, and ________. In ________, all ________ over potential ________ were ________ despite ________ for ________ and a sudden ________. In ________, there was a ________ on the State of Maine ________ that resulted in ________ and ________. This is due to ________ and ________ within ________. Management of the Department immediately focused their efforts solely on ________. Additional procedures were implemented to ________. Context: MDOL has a ________, for the ________ to ________ and ________, the ________ for the State of Maine, at a cost of ________. The total ________ for Maine in fiscal year 2020 was approximately ________, which includes approximately ________ and approximately ________. Additionally, the State ________ approximately ________. Approximately ________. The ________ and ________ caused ________. Cause: The ________ does not explicitly require ________ with the State Office of Information Technology ________ and provide ________ that includes a ________ on ________ and ________, ________, ________, ________ and ________ of the ________. Effect: ? ________ ? ________ ? ________ ? ________ ? ________ ? ________ ? ________ Recommendation: We recommend that the Department ________ to the ________ requiring the ________ to provide ________ that includes a ________ on ________ and ________, ________, ________, ________ and ________. This will provide assurance to the State regarding whether ________ are adequate. This will reduce ________. Corrective Action Plan: See F-9 Management?s Response: The Department partially agrees with this finding. The Department agrees that a ________ has not been performed on ________, it should be noted that other ________ are routinely performed. The Department does not agree with the assertion that the circumstances described in the finding would have been ________. Additionally, the Department does not agree with the characterization of the events highlighted in this finding as described below. Most ________ remained in place throughout the COVID-19 pandemic. Despite pressures to ________, the Department kept ________ in mind with each decision that was made and in implementation of the new federal programs. In response to the pandemic, the Department did review certain procedures and modified them to accommodate the rapid and drastic loss of employment by Maine workers. Steps were taken to limit the risk of the modifications. In ________, the Department and Maine workers were ________. This was not ________ on the Department. ________. The ________ that were in place ________, which was largely limited to ________. ________ were temporarily paused, but the program was not shutdown. Legitimate ________ were ________. From ________, The Maine Office of Information Technology (OIT) contracted with a third-party to conduct a ________, a ________, a ________ and a ________ of the ________. The ________. The Department has taken steps to help ensure ________. Partnerships with other state and federal agencies were enhanced and have been instrumental. These include: the Office of Inspector General; the U.S. Attorney?s Office; FBI; U.S. Secret Service; National Association of State Workforce Agencies and other states; OIT; the Maine Office of the Attorney General; and, the Maine Office of the State Treasurer. In addition, the Department has hired additional staff, both to address the ________ as well as to expand ________. Contractors have been hired to improve timeliness and to better assess ________. For the ________, changes were made to build in certain ________, which are constantly revised based on trends in Maine and across the country. The Department remains committed to compassionate actions ________. The Department will continue its aggressive approach toward ________, ________, ________ and ________, and is constantly reassessing risk based on ever-changing threats. Contact: Patricia O'Brien, Deputy Bureau Director, DOL, 207-621-5161 Auditor?s Concluding Remarks: ????________ was ________ in ________. Inconsistent with the statement above that ________, audit procedures discovered an additional ________ at fiscal year-end for ________ totaling ________ in State ________ and ________ in ________. The total ________ to ________ at fiscal year-end was ________ and ________, at ________ in ________, and ________. A ________ is designed to provide ________ over the ________ of ________ that are relevant to ________, ________, or ________ of the ________, or the ________ or ________ of that ________. Without ________ over ________ we cannot validate that ________ or ________ either ________ or ________ the ________ and ________. ________ over ________ and ________ may have helped ________ and ________ and provided information on the overall ________ of ________. The ________ of a ________, ________, ________ and ________ of the ________ were not provided to OSA, despite multiple information requests surrounding these matters. ________ is needed over ________ and ________. Without ________ both the ________ and ________ the State cannot ensure ________ are ________, ________, and ________, ________ and ________. The finding remains as stated. This is a confidential finding containing sensitive information. The complete finding has been formally addressed to: ? Jim Garner, Administrator, U.S. Department of Labor, Office of Unemployment Insurance, Frances Perkins Building, Room S-4524, 200 Constitution Avenue NW, Washington, DC 20210 A copy of that correspondence has also been sent to: ? Grover L. Fowler, Assistant Director, Financial Management Audits, U.S. Department of Labor, Office of the Inspector General, Frances Perkins Building, Room N-4633, 200 Constitution Avenue NW, Washington, DC 20210 (State Number: 20-0900-03)

(2020-014) Confidential finding, see below for more information Title: ________ over the Department of Transportation ________ needs improvement (The content of this finding has been redacted. This appears as blank underlining) Prior Year Findings: See Schedule of Findings and Questioned Costs for chart/table *The system was not audited in this fiscal year. State Department: Transportation (DOT) Administrative and Financial Services (DAFS) State Bureau: Finance and Administration, a Bureau of DOT Office of Information Technology, a Unit of DAFS Federal Agency: U.S. Department of Transportation CFDA Title: Highway Planning and Construction Cluster Formula Grants for Rural Areas CFDA Number: 20.205, 20.219; 20.509 Federal Award Identification Number: Various Highway Planning and Construction Cluster Grants; ME-2016-008-03, ME-2017-011-00, ME-2018-024-00, ME-18-X054-01, ME-18-X056-02, ME-2019-002-01, ME-2019-019-00, ME-2020-005-00 Compliance Area: Allowable costs/cost principles Type of Finding: Significant deficiency Questioned Costs: None See Schedule of Findings and Questioned Costs for chart/table Criteria: National Institute of Standards and Technology (NIST) Special Publication ________; NIST Special Publication ________; and State of Maine Office of Information Technology (OIT) Policies: ________, ________, and ________ NIST Special Publication ________ states that an organization must have the ability to ________ and ________. These ________, such as ________ or ________, or ________. ________ describes the process to ________ and ________ an ________. Step ________. NIST Special Publication ________ provides that the organization ________, ________, and ________: ? ________; and ? ________ NIST Special Publication ________. Condition: The Department of Transportation (DOT) is unable to provide a ________ that governs their overall ________ program which includes ________. The Department provided a copy of the ________ as documentation of compliance. This plan, last updated in 2009, does not comply with State policy or industry best practices for ________. Context: ________ is the ________ system used by DOT to ________ prior to interfacing to the State?s ________. The system ________ in fiscal year 2020. This includes ________. Cause: ________ Effect: Without the authoritative guidance of a well-documented ________, ________ processes may lack the clarity for implementation, monitoring, and evolution. In addition, in the event of a ________, the lack of a ________ could potentially result ________. Recommendation: We recommend that DOT work with the Office of Information Technology (OIT) to develop a ________ that will govern their ________ program. Additionally, we recommend that DOT design, develop, formally approve, regularly update, and test ________ in accordance with government standards and the established ________. Corrective Action Plan: See F-9 Management?s Response: The Department agrees with this finding. The Department will be reaching out to the OIT ________ point person at the beginning of calendar year 2021 to establish a timeline on the development of a ________. Contact: Doreen Corum, Financial Processing Director, DOT, 207-624-3139 This is a confidential finding containing sensitive information. The complete finding has been formally addressed to: ? Julie O'Dell, Program Analyst, Management Programs & Analysis, Federal Highway Administration, 1200 New Jersey Avenue SE, Washington, DC 20590 (State Number: 20-0900-01)

(2020-015) Confidential finding, see below for more information Title: The Department of Transportation has not completed a ________ that complies with State policy or industry best practice (The content of this finding has been redacted. This appears as blank underlining) Prior Year Findings: See Schedule of Findings and Questioned Costs for chart/table *The system was not audited in this fiscal year. State Department: Transportation (DOT) Administrative and Financial Services (DAFS) State Bureau: Finance and Administration, a Bureau of DOT Office of Information Technology, a Unit of DAFS Federal Agency: U.S. Department of Transportation CFDA Title: Highway Planning and Construction Cluster Formula Grants for Rural Areas CFDA Number: 20.205, 20.219; 20.509 Federal Award Identification Number: Various Highway Planning and Construction Cluster Grants; ME-2016-008-03, ME-2017-011-00, ME-2018-024-00, ME-18-X054-01, ME-18-X056-02, ME-2019-002-01, ME-2019-019-00, ME-2020-005-00 Compliance Area: Allowable costs/cost principles Type of Finding: Significant deficiency Questioned Costs: None See Schedule of Findings and Questioned Costs for chart/table Criteria: National Institute of Standards and Technology (NIST) Special Publication ________; NIST Special Publication ________, and ________; and State of Maine Office of Information Technology (OIT) Policies: ________, ________, and ________ NIST Special Publication ________ states that the ________ is a key step in implementing ________; the ________ purpose is to ________ and ________, and based on that information, ________. The ________ should be ________ and ________. NIST Special Publication ________: ? ________, ? ________, and ? ________ NIST Special Publication ________ provides that the organization?s ________, ________, and established ________. Condition: The Department of Transportation (DOT) has not prepared a ________ to determine the effect of an ________. This ________ is used to determine the appropriate ________. The ________ is the ________ that DOT ________. The ________ is the ________. The established and approved ________ are used to determine the ________. The Department has not ________ or established an ________. Those responsible for developing a ________ for the Department must know the ________ requirements in order to establish an acceptable ________. The absence of a ________ is communicated in a separate finding. Context: ________ is the ________ system used by DOT to ________ prior to interfacing to the State?s ________. The system ________ in fiscal year 2020. This includes ________. Cause: ________ Effect: The lack of a ________ and systems will not be ________. Recommendation: We recommend that DOT work with the Office of Information Technology to ________ that complies with State policy or industry best practices. Additionally, we recommend that DOT identify and approve ________ for ________ and ________ that support DOT business functions, which includes their ________. Corrective Action Plan: See F-10 Management?s Response: The Department agrees with this finding. The Department will be reaching out to the OIT ________ point person at the beginning of calendar year 2021 to establish a timeline on the development of a ________. As part of that process we will be conducting a ________ and identifying ________ and ________ that support DOT business functions. Contact: Doreen Corum, Financial Processing Director, DOT, 207-624-3139 This is a confidential finding containing sensitive information. The complete finding has been formally addressed to: ? Julie O'Dell, Program Analyst, Management Programs & Analysis, Federal Highway Administration, 1200 New Jersey Avenue SE, Washington, DC 20590 (State Number: 20-0900-02)

(2020-016) Confidential finding, see below for more information Title: ________ over the ________ needs improvement (The content of this finding has been redacted. This appears as blank underlining) Prior Year Findings: See Schedule of Findings and Questioned Costs for chart/table *The system was not audited in this fiscal year. State Department: Transportation (DOT) Administrative and Financial Services (DAFS) State Bureau: Finance and Administration, a Bureau of DOT Office of Information Technology, a Unit of DAFS Federal Agency: U.S. Department of Transportation CFDA Title: Highway Planning and Construction Cluster Formula Grants for Rural Areas CFDA Number: 20.205, 20.219; 20.509 Federal Award Identification Number: Various Highway Planning and Construction Cluster Grants; ME-2016-008-03, ME-2017-011-00, ME-2018-024-00, ME-18-X054-01, ME-18-X056-02, ME-2019-002-01, ME-2019-019-00, ME-2020-005-00 Compliance Area: Allowable costs/cost principles Type of Finding: Significant deficiency Questioned Costs: None See Schedule of Findings and Questioned Costs for chart/table Criteria: National Institute of Standards and Technology (NIST) Special Publication ________; and State of Maine Office of Information Technology (OIT) Policies: ________ NIST Special Publication ________: ? ________; ? ________; and ? ________ NIST Special Publication ________provides that the organization adhere to the principle of ________, ________ and ________. NIST Special Publication ________, ________: ? ________, and ? ________ NIST Special Publication ________ states that the organization ________. OIT ________ provides that agencies ________ and ________ to ________, ________, ________, ________ and ________. These procedures include ________ and ________. The ________ for State of Maine ________ requires ________. Condition: The Department ________ to ________ without a ________. Of the ________, ________. In addition, the ________ with a ________ did not ________. There is no ________ that ________ were ________. Of the ________, ________ was not ________ with ________. The ________ was set to ________, when it should have been ________. Additionally, ________ is not being ________. Of the ________ during the audit period, ________ were not ________. ________ was ________ between ________ after ________. The average ________ was ________ after the ________. ________ did not have a ________ established regarding the required ________ for ________ for ________. Industry best practice indicates that ________ should be ________. Context: ________ is the ________ system used by ________ to ________ prior to interfacing to the State?s ________. The system ________ in fiscal year 2020. This includes ________. Cause: Lack of ________ and ________ over ________ Effect: ? ________ ? ________ ? ________ ? ________ Recommendation: We recommend that DOT implement ________ that align with the the State of Maine OIT ________. These ________ should ________ based on a ________ and ________; ________ the use of agency ________ through ________; align ________ with State of Maine ________ and ________; and ________ in a timely manner. DOT should work with OIT to develop ________ and ________ where the State of Maine OIT ________ to align with industry best practice. Corrective Action Plan: See F-10 Management?s Response: The Department agrees with this finding. We will work with the OIT group to implement ________ and ________ to align with the State of Maine OIT ________. Contact: Doreen Corum, Financial Processing Director, DOT, 207-624-3139 This is a confidential finding containing sensitive information. The complete finding has been formally addressed to: ? Julie O'Dell, Program Analyst, Management Programs & Analysis, Federal Highway Administration, 1200 New Jersey Avenue SE, Washington, DC 20590 (State Number: 20-0900-04)

(2020-017) Title: Internal control over agency Schedule of Expenditures of Federal Awards submissions needs improvement Prior Year Findings: See Schedule of Findings and Questioned Costs for chart/table State Department: Administrative and Financial Services State Bureau: Health and Human Services Service Center Federal Agency: U.S. Department of Health and Human Services U.S. Department of Agriculture CFDA Title: SNAP Cluster (SNAP) Temporary Assistance for Needy Families (TANF) CFDA Number: 10.551, 10.561; 93.558 Federal Award Identification Number: 184ME421Q3903,194ME442Q7503, 194ME401S2520, 204ME401S2520, 204ME401S2519, 204ME442Q7503, 204ME401S2514, 194ME401S2514, 194ME401S2519, 194ME421Q3903, 204ME421Q3903, 194ME442Q7503, 194ME401S8026, 204ME401S8026, 194ME401S8036, 194ME401S8069; 1701METANF, 1801METANF, 1901METANF, 2001METANF Compliance Area: Reporting Type of Finding: Material weakness Material noncompliance Questioned Costs: None See Schedule of Findings and Questioned Costs for chart/table Criteria: 2 CFR 200.303; 2 CFR 200.510(b) The Department must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the Department is managing the award in compliance with Federal statutes, regulations, and the terms and conditions of the award. The State must prepare a Schedule of Expenditures of Federal Awards (SEFA) for the period covered by the State?s financial statements which must include the total Federal awards expended. At a minimum, the SEFA must provide total Federal awards expended for each individual Federal program and the CFDA number. Condition: Departments must complete and submit exhibits and related schedules to the Office of the State Controller (OSC). OSC compiles this information and prepares the SEFA for the State. The SEFA is included in the annual submission to the Federal Audit Clearinghouse (FAC). The Department provided incorrect information to OSC for SEFA reporting. Context: In fiscal year 2020: ? SNAP benefit expenditures were incorrectly reported to OSC as $259.8 million and should have been reported as $245.4 million. ? TANF expenditures were incorrectly reported to OSC as $45.4 million and should have been reported as $59.8 million. Cause: Lack of adequate internal controls over Department SEFA submissions to OSC Effect: ? Noncompliance with Federal regulations ? Incorrect information reported on the SEFA may be used for programmatic, policy or statistical purposes. Recommendation: We recommend that the Department collaborate with OSC to implement additional procedures to ensure that SEFA submission exhibits and related schedules provided to OSC are complete and accurate. This will ensure that Federal program expenditures are accurately reported on the SEFA prior to submitting to the FAC. Corrective Action Plan: See F-10 Management?s Response: The Department of Health and Human Services and its Service Center agree with this finding. Training was conducted on SEFA submissions and we are developing a procedure for SEFA review similar to our federal financial report reviews prior to submission. This entails training a second person in SEFA submissions and updating our SOP. Contact: Sarah Gove, Director, DHHS Service Center, 207-458-6626 (State Number: 20-1108-01)

(2020-018) Title: Internal control over SNAP benefit calculations within the automated data processing system needs improvement Prior Year Findings: See Schedule of Findings and Questioned Costs for chart/table *The program was not audited as a major program in this fiscal year. State Department: Health and Human Services State Bureau: Office for Family Independence Federal Agency: U.S. Department of Agriculture CFDA Title: SNAP Cluster (SNAP) CFDA Number: 10.551, 10.561 Federal Award Identification Number: 184ME421Q3903,194ME442Q7503, 194ME401S2520, 204ME401S2520, 204ME401S2519, 204ME442Q7503, 204ME401S2514, 194ME401S2514, 194ME401S2519, 194ME421Q3903, 204ME421Q3903, 194ME442Q7503, 194ME401S8026, 204ME401S8026, 194ME401S8036, 194ME401S8069 Compliance Area: Allowable costs/cost principles Special tests and provisions Type of Finding: Significant deficiency Questioned costs Questioned Costs: Likely questioned costs were projected by dividing the identified known overpayment by the total Transitional Food Assistance (TFA) benefit payments tested to establish an error rate. The error rate was then applied to total TFA benefit payments made in fiscal year 2020 to project likely questioned costs. See Schedule of Findings and Questioned Costs for chart/table Criteria: 2 CFR 200.303; 7 CFR 272.10; 7 CFR 273.26 The Department must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the Department is managing the award in compliance with Federal statutes, regulations, and the terms and conditions of the award. The Department is required to sufficiently automate SNAP operations and computerize systems. The system must determine eligibility and calculate benefits, or validate the eligibility worker's calculations, by processing and storing all client information necessary for eligibility determination and benefit computation, and redetermine or revalidate eligibility and benefits based on changing circumstances. The Department provides TFA benefits to a household under the SNAP program when the household is leaving the Temporary Assistance for Needy Families (TANF) program. Condition: TANF benefits are generally considered a source of household income when calculating basic SNAP benefits. However, when calculating TFA benefits, TANF benefits are excluded from income based on the final month of eligibility under the program. The Department relies on its automated data processing system, Automated Client Eligibility System (ACES), to accurately calculate TFA benefits for SNAP clients. The Department does not have procedures in place to ensure TFA benefits are calculated correctly. In our test of 60 benefit payments, one client was overpaid by $74 related to their TFA benefit. The Office of the State Auditor selected a non-statistical random sample. Context: In fiscal year 2020, the State provided approximately 114,000 SNAP clients with $231 million in benefits. Cause: ? Lack of adequate procedures ? Lack of supervisory oversight Effect: ? Questioned costs ? Potential future questioned costs and disallowances as a result of incorrect benefits provided to eligible individuals ? Noncompliance with Federal regulations Recommendation: We recommend that the Department implement a detailed review and approval process that occurs prior to benefit issuance to ensure that the information entered into ACES is accurate and complete. Corrective Action Plan: See F-10 Management?s Response: The Department disagrees with this finding. We do not agree that this finding rises to the level of a significant deficiency; additionally, we disagree with the assertion that there are not procedures in place to ensure that the information entered into ACES is accurate and complete. We do agree that there was one TFA client with an overpayment; however, this does not represent a structural or programmatic deficiency. Our federally funded Quality Control unit follows federal standards and requirements which further represent an additional internal control for both SNAP and TFA. A total of 60 cases were reviewed for audit, 2 of them were TFA cases and 58 were SNAP. TFA is included in the Payment Error Rate determined by FNS and should be for the purpose of this audit. A sample size of only 2 TFA cases reviewed does not provide statistical evidence of non-compliance (or compliance). Contact: Anthony Pelotte, Director, Office for Family Independence, DHHS, 207-624-4104 Auditor?s Concluding Remarks: TFA is a SNAP program. The two TFA cases randomly selected in our test of 60 SNAP benefit issuances are representative of the entire SNAP benefit population and provide a reasonable basis for drawing conclusions about the population tested. In the prior year audit, a similar finding (2019-012) was identified for the single TFA case randomly selected in our test of 60 SNAP benefit issuances. The finding reported that TFA benefits were inappropriately paid to a SNAP client which resulted in questioned costs; the Department agreed with this prior year finding and documented a corrective action plan. Therefore, these test results do indicate that there is a control deficiency within the SNAP program. The classification of findings is determined after a thorough, comprehensive analysis performed by multiple Certified Public Accountants with over 60 years of combined auditing experience. The Office of the State Auditor (OSA) follows auditing standards when considering internal control over compliance. According to auditing standard AU-C 265, a significant deficiency in internal control over compliance is a deficiency, or combination of deficiencies, in internal control over compliance with a type of compliance requirement of a Federal program that is [?] important enough to merit attention by those charged with governance. OSA determined that the issue noted in the Condition of this finding warrants the attention of those charged with governance, as well as the Federal cognizant agency. The finding remains as stated. (State Number: 20-1108-03)

(2020-019) Title: Internal control over the issuance of SNAP benefits needs improvement Prior Year Findings: See Schedule of Findings and Questioned Costs for chart/table *The program was not audited as a major program in this fiscal year. State Department: Health and Human Services State Bureau: Office for Family Independence Federal Agency: U.S. Department of Agriculture CFDA Title: SNAP Cluster (SNAP) CFDA Number: 10.551, 10.561 Federal Award Identification Number: 184ME421Q3903,194ME442Q7503, 194ME401S2520, 204ME401S2520, 204ME401S2519, 204ME442Q7503, 204ME401S2514, 194ME401S2514, 194ME401S2519, 194ME421Q3903, 204ME421Q3903, 194ME442Q7503, 194ME401S8026, 204ME401S8026, 194ME401S8036, 194ME401S8069 Compliance Area: Allowable costs/cost principles Eligibility Type of Finding: Significant deficiency Questioned Costs: None See Schedule of Findings and Questioned Costs for chart/table Criteria: 2 CFR 200.303; 2 CFR 200.403 The Department must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the Department is managing the award in compliance with Federal statutes, regulations, and the terms and conditions of the award. Costs must be necessary and reasonable for the performance of the Federal award. Condition: The Department receives date of death (DOD) information from the Maine Center for Disease Control & Prevention (MeCDC) on a quarterly basis and from the Social Security Administration on a weekly basis. The Office of the State Auditor (OSA) obtained DOD information from MeCDC and compared it to clients who received SNAP benefits during fiscal year 2020. Of the 524 cases that had benefit transactions after the client?s DOD, OSA reviewed eight cases where the electronic benefits transfer transaction date was 150 or more days after the client?s DOD. For five of the eight cases, we noted that the Department continued to provide benefits one to four months after the client?s DOD. Context: In fiscal year 2020, the State provided approximately 114,000 SNAP eligible clients with $231 million in benefits. Of the 114,000 SNAP eligible clients, approximately 1,400 had a DOD in fiscal year 2020. Cause: ? Lack of adequate procedures ? Lack of supervisory oversight Effect: ? Benefits paid on behalf of deceased clients may go undetected. ? Potential questioned costs and disallowances Recommendation: We recommend that the Department improve procedures to ensure that DOD information is received, reviewed, and updated in the eligibility system on a biweekly or monthly basis in order to prevent incorrect issuances of benefits. Corrective Action Plan: See F-11 Management?s Response: The Department agrees with the finding that encompassed a review of 524 cases and discovered exceptions with 8 of them. We will review and improve as necessary DOD standard operating procedures. Contact: Anthony Pelotte, Director, Office for Family Independence, DHHS, 207-624-4104 (State Number: 20-1108-02)

(2020-020) Confidential finding, see below for more information Title: ________ over the ________ system needs improvement (The content of this finding has been redacted. This appears as blank underlining) Prior Year Findings: See Schedule of Findings and Questioned Costs for chart/table *The system was not audited in this fiscal year. State Department: Health and Human Services State Bureau: Office for Family Independence Federal Agency: U.S. Department of Agriculture U.S. Department of Health and Human Services CFDA Title: SNAP Cluster (SNAP) Temporary Assistance for Needy Families (TANF) CFDA Number: 10.551, 10.561; 93.558 Federal Award Identification Number: 184ME421Q3903, 194ME442Q7503, 194ME401S2520, 204ME401S2520, 204ME401S2519, 204ME442Q7503, 204ME401S2514, 194ME401S2514, 194ME401S2519, 194ME421Q3903, 204ME421Q3903, 194ME442Q7503, 194ME401S8026, 204ME401S8026, 194ME401S8036, 194ME401S8069; 1701METANF, 1801METANF 1901METANF, 2001METANF Compliance Area: Allowable costs/cost principles Reporting Special tests and provisions Type of Finding: Significant deficiency Questioned Costs: None See Schedule of Findings and Questioned Costs for chart/table Criteria: 2 CFR 200.303; National Institute of Standards and Technology (NIST) Special Publication ________; State of Maine ________ Policy The Department must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the Department is managing the award in compliance with Federal statutes, regulations, and the terms and conditions of the award. NIST Special Publication ________ states that organizations consider ________ from the use of ________. If ________ are ________ by ________, arrangements must be made with ________ to ________. NIST Special Publication ________ states that organizations are responsible and accountable for the ________ provided by ________. The responsibility for ________ services remains with authorizing officials. NIST Special Publication ________ states that ________ is the measure of confidence that ________, ________, and ________ with respect to meeting the requirements for the system. NIST Special Publication ________ states that the organization must develop a plan of action for the information system to document the planned ________ over the ________ to reduce ________. The State of Maine ________ Policy sections ________and ________ require ________ to ensure a ________ of the utmost ________, ________, and ________, and to ________. Condition: The State of Maine ________ with a ________ to provide ________ and ________ for the ________ system. The ________ system processes ________ and ________ for the SNAP and TANF programs. The ________ utilizes a ________ to support ________ services. The contract requires the ________ to provide ________ and ________ and to ensure that an ________ is established and maintained in accordance with Federal program regulations. ________ measures the degree that the State can ________ and ________ of ________ provided by the ________ and ________. The Office for Family Independence (OFI) is responsible for oversight of this contract. OFI did not ________ for the ________ or ________ as required by the contract. In addition, documentation of the ________ and ________ of ________ in the ________ could not be provided by OFI. Context: The Department has a ________, ________ with a ________ to ________ and ________ the ________ system. ________ processed through ________ totaled approximately ________, and ________ totaled approximately ________ in fiscal year 2020. Cause: ? ________ ? ________ Effect: ? ________ ? ________ ? ________ Recommendation: We recommend that the Department implement procedures to ensure that ________ are ________ and ________ annually, and ________ are ________. This annual process should be documented, approved, and retained by management. Corrective Action Plan: See F-11 Management?s Response: The Department agrees we are responsible for ________, and that we did not ________. We are also in agreement that documentation of ________ and ________ of ________ needs improvement. In response, the Department will develop and implement a standard operating procedure documenting the ________ and ________ of ________. Contact: Anthony Pelotte, Director, Office for Family Independence, DHHS, 207-624-4104 This is a confidential finding containing sensitive information. The complete finding has been formally addressed to: ? Jessica Shahin, Associate Administrator, U.S. Department of Agriculture, Supplemental Nutrition Assistance Program, 1320 Braddock Place, Alexandria, VA 22314; and ? Carol Monteiro, Regional Program Manager, Administration for Children and Families, Office of Family Assistance, John F. Kennedy Federal Building, Room 2000, 15 New Sudbury Street, Boston, MA 02203 A copy of that correspondence has also been sent to: ? Kimberly Edwards, Audit Liaison, U.S. Department of Agriculture, Food and Nutrition Services, Northeast Regional Office, 10 Causeway Street, Room 501, Boston, MA 02222-1069; and ? Greg Dowell, Assistant Director, U.S. Department of Health and Human Services, Office of the Inspector General, Office of Audit Service, National External Audit Review Center, 601 E. 12th Street, Suite 0429, Kansas City, MO 64106 (State Number: 20-0900-12)

(2020-021) Title: Internal control over cash balances needs improvement Prior Year Findings: See Schedule of Findings and Questioned Costs for chart/table *The program was not audited as a major program in this fiscal year. State Department: Health and Human Services Administrative and Financial Services State Bureau: Maine Center for Disease Control & Prevention Health and Human Services Service Center Federal Agency: U.S. Department of Agriculture CFDA Title: Special Supplemental Nutrition Program for Women, Infants, and Children (WIC) CFDA Number: 10.557 Federal Award Identification Number: 174ME743W5003, 184ME743W5003, 194ME743W5003, 194ME701W1003, 194ME701W1006, 204ME701W1003, 204ME701W1006 Compliance Area: Cash management Type of Finding: Material weakness Material noncompliance Questioned Costs: None See Schedule of Findings and Questioned Costs for chart/table Criteria: 2 CFR 200.303; 2 CFR 200.302; 31 CFR 205.33; State Administrative and Accounting Manual (SAAM) Section 50.40.80 The Department must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the Department is managing the award in compliance with Federal statutes, regulations, and the terms and conditions of the award. Financial records must adequately identify the source and application of funds and provide accountability for all funds, property, and other assets related to the Federally funded activities. The Department must minimize the time between the drawdown of Federal funds and the disbursement of these funds for Federal program purposes. The timing and amount of fund transfers must be as close as administratively feasible to the Department?s actual cash outlay for program costs. Section 50.40.80 of the SAAM has defined administratively feasible as Federal funds shall be held for no more than seven business days. Condition: The cash balance was not taken into consideration when requesting Federal funds for the Breastfeeding Peer Counsel, WIC Administrative, and WIC Food grants for fiscal year 2020, which resulted in: ? the Breastfeeding Peer Counsel and WIC Administrative grants having a negative cash balance ranging from $400,000 to $1.2 million throughout the fiscal year; and ? the WIC Food grant having an excess cash balance ranging from $700,000 to $1.4 million throughout the fiscal year. The Breastfeeding Peer Counsel and WIC Administrative grants? funding technique is reimbursement basis. The WIC Food grant uses an advanced draw funding technique. Therefore, a separate analysis for each grant was required. Context: At June 30, 2020, the ending cash balances for the WIC grants were as follows: ? The Breastfeeding Peer Counsel and WIC Administrative grants had an ending cash balance of negative $410,000. ? The WIC Food grant had an ending cash balance of $930,000. Cause: ? Lack of procedures to ensure that the cash balance is considered before requesting Federal funds ? Lack of supervisory oversight ? Lack of resources and competing priorities Effect: ? The Federal government may impose more stringent cash management requirements based on prior noncompliance. ? The State could potentially incur an interest liability on excess Federal cash balances. ? Until the Department completes a reconciliation of related financial activity, it will not know whether funds need to be returned to the Federal government for all, a portion, or none of the excess cash balance, and it will not know whether a General Fund appropriation is needed to clear the negative cash balance for administrative costs in the Federal Fund. Recommendation: We recommend that the Department: ? complete a full reconciliation of the cash balance for all grants issued for the WIC program to determine the cause and remediation for both the negative and excess cash balances, and ? implement procedures to ensure that the cash balance is considered when requesting Federal funds in accordance with 31 CFR 205.33. Corrective Action Plan: See F-11 Management?s Response: The Department of Health and Human Services and its Service Center agree with this finding. The Service Center will reconcile current and prior year grants and implement a standardized template for grant daily reconciliations which includes monitoring cash. Contact: Sarah Gove, Director, DHHS Service Center, 207-458-6626 (State Number: 20-1113-01)

(2020-022) Title: Internal control over subrecipient monitoring needs improvement Prior Year Findings: See Schedule of Findings and Questioned Costs for chart/table *The program was not audited as a major program in this fiscal year. State Department: Health and Human Services State Bureau: Maine Center for Disease Control & Prevention Federal Agency: U.S. Department of Agriculture CFDA Title: Special Supplemental Nutrition Program for Women, Infants, and Children (WIC) CFDA Number: 10.557 Federal Award Identification Number: 174ME743W5003, 184ME743W5003, 194ME743W5003, 194ME701W1003, 194ME701W1006, 204ME701W1003, 204ME701W1006 Compliance Area: Subrecipient monitoring Type of Finding: Material weakness Material noncompliance Questioned Costs: None See Schedule of Findings and Questioned Costs for chart/table Criteria: 2 CFR 200.303; 7 CFR 246.19 The Department must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the Department is managing the award in compliance with Federal statutes, regulations, and the terms and conditions of the award. The Department shall establish an ongoing management evaluation system which includes the monitoring of local agency operations, the review of local agency financial and participation reports, the development of corrective action plans to resolve program deficiencies, the monitoring of implementation of the corrective action plans, and on-site visits. The results of such actions must be documented. Monitoring of local agencies must encompass evaluation of management, certification, nutrition education, breastfeeding promotion and support, participant services, civil rights compliance, accountability, financial management systems, and food delivery systems. The Department must conduct monitoring reviews of each local agency at least once every two years. Reviews must include on-site reviews of a minimum of 20 percent of the clinics in each local agency, or one clinic, whichever is greater. Condition: The Department was required to perform full-year management evaluation reviews for four local agencies during fiscal year 2020. In the Office of the State Auditor?s testing: ? one local agency management evaluation review due in September 2019 was not performed until July 2020, and the finance portion of the review was not completed; ? one local agency management evaluation review due in November 2019 was not performed until December 2020, and the finance portion of the review was not completed; ? one local agency management evaluation review due in February 2020 had not been completed as of audit testing in February 2021; and ? one local agency management evaluation review due in June 2020 had not been completed as of audit testing in February 2021. Follow-up procedures over four management evaluation reviews that were due but not fully completed in fiscal year 2019 found that the finance portion of the reviews had not been completed as of audit testing in February 2021. Context: In fiscal year 2020, the Department provided $4.4 million to eight local agencies. Cause: ? Unfilled vacancies from fiscal year 2019 (Finance Manager and three WIC staff positions that perform management evaluation reviews) created a backlog of reviews ? Lack of supervisory oversight Effect: ? Federal programs may not be effectively and efficiently administered. ? Potential future questioned costs and disallowances Recommendation: We recommend that the Department implement a process to ensure that the backlog of reviews are completed. We further recommend additional oversight procedures to ensure all portions of management evaluation reviews are fully completed. Corrective Action Plan: See F-11 Management?s Response: The Department agrees with this finding. Limited human resources were assigned to higher priorities during the fiscal year. The Senior Health Program Manager will implement procedures to complete all outstanding Management Evaluation Reviews by March 31, 2021. Contact: Ginger Roberts-Scott, Program Manager, WIC Nutrition Program, DHHS, 207-287-5342 (State Number: 20-1113-04)

(2020-023) Title: Internal control over the WIC infant formula rebate process needs improvement Prior Year Findings: See Schedule of Findings and Questioned Costs for chart/table *The program was not audited as a major program in this fiscal year. State Department: Health and Human Services Administrative and Financial Services State Bureau: Maine Center for Disease Control & Prevention Health and Human Services Service Center Federal Agency: U.S. Department of Agriculture CFDA Title: Special Supplemental Nutrition Program for Women, Infants, and Children (WIC) CFDA Number: 10.557 Federal Award Identification Number: 174ME743W5003, 184ME743W5003, 194ME743W5003, 194ME701W1003, 194ME701W1006, 204ME701W1003, 204ME701W1006 Compliance Area: Cash management Type of Finding: Significant deficiency Questioned Costs: None See Schedule of Findings and Questioned Costs for chart/table Criteria: 2 CFR 200.303; 7 CFR 246.14 The Department must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the Department is managing the award in compliance with Federal statutes, regulations, and the terms and conditions of the award. WIC infant formula rebates received by the State from manufacturers must be wire transferred by WIC staff to the WIC Food Account in the month in which the payments are received. These rebates must be used to offset the cost of food. Condition: One rebate totaling $359,552 received in September 2019 was not wire transferred to the WIC Food Account until October 2019. The WIC Food Account is a bank account established by and held at WIC?s banking intermediary. Context: In fiscal year 2020, the WIC program received $3.8 million in rebates that must be used to offset the cost of food. Cause: ? Lack of adequate procedures ? Lack of supervisory oversight Effect: WIC infant formula rebates must be transferred in a timely manner to the banking intermediary to defray food costs. If rebates are not wire transferred timely, the program could potentially draw Federal funds unnecessarily. Recommendation: We recommend that the Departments collaborate efforts to identify and implement additional procedures to ensure that infant formula rebates are processed timely. Corrective Action Plan: See F-12 Management?s Response: The Department of Health and Human Services and its Service Center agree with this finding. The Service Center will review, identify and implement additional procedures needed to ensure timely rebates and document them in a Standard Operating Procedure by June 2021. Contact: Sarah Gove, Director, DHHS Service Center, 207-458-6626 (State Number: 20-1113-02)

(2020-024) Title: Internal control over subrecipient awards needs improvement Prior Year Findings: See Schedule of Findings and Questioned Costs for chart/table *The program was not audited as a major program in this fiscal year. State Department: Health and Human Services State Bureau: Maine Center for Disease Control & Prevention Division of Contract Management Federal Agency: U.S. Department of Agriculture CFDA Title: Special Supplemental Nutrition Program for Women, Infants, and Children (WIC) CFDA Number: 10.557 Federal Award Identification Number: 174ME743W5003, 184ME743W5003, 194ME743W5003, 194ME701W1003, 194ME701W1006, 204ME701W1003, 204ME701W1006 Compliance Area: Subrecipient monitoring Type of Finding: Significant deficiency Questioned Costs: None See Schedule of Findings and Questioned Costs for chart/table Criteria: 2 CFR 200.303; 2 CFR 200.332 The Department must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the Department is managing the award in compliance with Federal statutes, regulations, and the terms and conditions of the award. Awards to subrecipients must include Federal award information that enables subrecipients to identify the source of the Federal award. Condition: The Division of Contract Management (DCM) is responsible for the preparation of subrecipient grant awards. The program information in the awards provided to subrecipients is the responsibility of the Maine Center for Disease Control & Prevention (MeCDC). MeCDC communicates the award information by providing it for upload to the DHHS grants database. DCM then utilizes that database to prepare the subrecipient awards and sends the drafted subrecipient awards to program personnel for final review. The subrecipient awards must include accurate Federal award identification information to ensure that subrecipients can properly identify the source of the subrecipient awards. For the eight subrecipients who administer the WIC program, all eight subrecipient awards: ? incorrectly identified the Center for Disease Control and Prevention as the Federal awarding agency for the WIC Administrative grant. The U.S. Department of Agriculture is the Federal awarding agency. ? incorrectly identified the Federal Award Identification Number for the WIC Breastfeeding Peer Counsel grant and the WIC Administrative grant. Context: In fiscal year 2020, the Department provided $4.4 million to the eight subrecipients that administer the WIC program. Cause: ? Lack of adequate internal control ? Lack of supervisory oversight Effect: Federal pass-through dollars may not be correctly reported by subrecipients Recommendation: We recommend that DCM and MeCDC collaborate on additional procedures that can be implemented to ensure awards to subrecipients are complete, accurate and in accordance with Federal regulations. Corrective Action Plan: See F-12 Management?s Response: The Department agrees with this finding. During the time period of the audit, grant information was not entered into the Grants Database which is used by DCM to properly identify the FAIN and correct Federal awarding agencies. The Department transferred oversight of the CDC grant from the CDC staff to the DHHS Service Center staff to ensure grant information is correctly identified in the Grants Database. Contact: Jim Lopatosky, Director, Division of Contract Management, DHHS, 207-287-5075 (State Number: 20-1113-03)

(2020-025) Confidential finding, see below for more information Title: ________ over the ________ system needs improvement (The content of this finding has been redacted. This appears as blank underlining) Prior Year Findings: See Schedule of Findings and Questioned Costs for chart/table *The system was not audited in this fiscal year. State Department: Health and Human Services State Bureau: Maine Center for Disease Control & Prevention Federal Agency: U.S. Department of Agriculture CFDA Title: Special Supplemental Nutrition Program for Women, Infants, and Children (WIC) CFDA Number: 10.557 Federal Award Identification Number: 174ME743W5003, 184ME743W5003 194ME743W5003, 194ME701W1003 194ME701W1006, 204ME701W1003 204ME701W1006 Compliance Area: Allowable costs/cost principles Type of Finding: Significant deficiency Questioned Costs: None See Schedule of Findings and Questioned Costs for chart/table Criteria: 2 CFR 200.303; National Institute of Standards and Technology (NIST) Special Publication ________; State of Maine ________ Policy The Department must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the Department is managing the award in compliance with Federal statutes, regulations, and the terms and conditions of the award. NIST Special Publication ________ states that organizations consider ________ from the use of common controls. If common controls are provided to organizations by ________, arrangements must be made with ________ to ________. NIST Special Publication ________ states that organizations are responsible and accountable for the ________ provided by ________. The responsibility for ________ services remains with authorizing officials. NIST Special Publication ________ states that ________ is the measure of confidence that ________, ________, and ________ with respect to meeting the requirements for the system. The State of Maine ________ Policy sections ________and ________ require ________ to ensure a ________ of the utmost ________, ________, and ________, and to ________. Condition: The Department of Health and Human Services does not have ________ that ________ within the ________ system is ________, ________, ________, and ________. The ________ provided a ________ covering the ________ of fiscal year 2020. This ________ identified ________ related to ________, ________, and ________. The Department did not respond to the ________ nor did they require the ________ to ________ that the ________ were ________. For the remaining ________ of fiscal year 2020, the Department did not receive any ________. ________ from ________ that the ________ was also not provided. The ________ did not ________. Therefore, the Department did not have ________ over ________ provided by ________. Context: The ________ system processed ________ in ________ in fiscal year 2020. Cause: Although the ________ was ________ to comply with Federal and State policies, rules, laws, and regulations, the ________ over the ________ and ________ of ________, including ________ specific to the ________ system from ________ to ________, was not provided. Effect: ? ________ ? ________ ? ________ Recommendation: We recommend that the Department enforce ________, agreed to by the ________, to provide ________ and the ________. We further recommend that the Department implement procedures which require ________ by management of these ________. The ________ and the ________ should be documented and monitored. Corrective Action Plan: See F-12 Management?s Response: The Department agrees with this finding. We will enforce ________ to obtain ________. We will also develop procedures to identify ________ and to ________ and ________. Contact: Ginger Roberts-Scott, Program Manager, WIC Nutrition Program, DHHS, 207-287-5342 This is a confidential finding containing sensitive information. The complete finding has been formally addressed to: ? Michelle D?Auria, Branch Chief, Supplemental Food Programs, Special Nutrition Programs Division, U.S. Department of Agriculture, Food and Nutrition Services, Northeast Regional Office, 10 Causeway Street, Room 501, Boston, MA 02222-1069 A copy of that correspondence has also been sent to: ? Kimberly Edwards, Audit Liaison, U.S. Department of Agriculture, Food and Nutrition Services, Northeast Regional Office, 10 Causeway Street, Room 501, Boston, MA 02222-1069 (State Number: 20-0900-10)

(2020-026) Confidential finding, see below for more information Title: Internal control over Unemployment Insurance claim payments needs improvement (A portion of this finding has been redacted. This appears as blank underlining) Prior Year Findings: See Schedule of Findings and Questioned Costs for chart/table State Department: Labor State Bureau: Unemployment Compensation Federal Agency: U.S. Department of Labor CFDA Title: Unemployment Insurance (UI) CFDA Number: 17.225 Federal Award Identification Number: Unemployment Insurance Trust Fund, Maine Compliance Area: Allowable costs/cost principles Eligibility Type of Finding: Material weakness Material noncompliance Questioned costs Questioned Costs: See Schedule of Findings and Questioned Costs for chart/table Criteria: 2 CFR 200.303; 20 CFR 615.8; Public Law 112-96 ? Middle Class Tax Relief and Job Creation Act of 2012; Public Law 116-136 ? Coronavirus Aid, Relief, and Economic Security (CARES) Act; Social Security Act (SSA) Title III, Section 303; 26 MRSA 1199; Unemployment Insurance Program Letter (UIPL) Nos. 5-13 and 24-20 The Department must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the Department is managing the award in compliance with Federal statutes, regulations, and the terms and conditions of the award. A State administering Unemployment Insurance (UI) must have State laws and policies in place that are consistent with Federal provisions and required by 20 CFR 615.8; Public Law 112-96; SSA Title III, Section 303; and UIPL No. 5-13, as follows: ? Standards for claim filing and processing including appeals and reviews, communication with claimants and employers, eligibility standards and disqualifications, and Interstate Benefit Payments and agreements ? Standards for reasonable work search criteria and policies requiring performance of internal audits of work search activity ? Standards for program integrity outlining procedures for identification and recovery of overpayments and penalties, including recovery through offset of future benefit payments In March 2020, as a nationwide response to the effects of the COVID-19 pandemic, including rapidly increasing unemployment rates, the Federal Coronavirus Aid, Relief, and Economic Security (CARES) Act was signed into law (Public Law 116-136). The CARES Act created three temporary Federal unemployment compensation entitlement programs, as follows: ? Pandemic Unemployment Assistance (PUA) provides UI benefits for workers not otherwise eligible for regular UI benefits, self-employed individuals, contract workers, and business owners. ? Pandemic Emergency Unemployment Compensation (PEUC) provides an additional 13 weeks of UI benefits for unemployed workers who have exhausted regular UI benefits. ? Federal Pandemic Unemployment Compensation provides an additional $600 weekly to all unemployed workers receiving traditional UI benefits, PUA or PEUC. On March 17, 2020, the Governor of Maine enacted emergency legislation that defines exceptions and waivers to requirements of the State?s UI program. The legislation established as 26 MRSA 1199: ? waives the requirement for the ability and availability to work in order to provide benefits to individuals who are under medical quarantine or temporary layoff due to mandated pandemic-related closures; ? waives the usual one week waiting period for individuals dislocated or temporarily laid off due to mandated pandemic-related closures; and ? expands temporary leaves of absence qualifications to include medical quarantine or isolation restrictions, a COVID-19 exposure or infection, or pandemic-related dependent care needs as long as claimants maintain contact with employers and are expected to return to work. In May 2020, the U.S. Department of Labor issued UIPL No. 24-20 which states that all Extended Benefit (EB) program costs would be covered by the Federal government, so long as claimants meet all eligibility requirements and the State enforces statutory provisions. The EB program provides up to an additional 13 weeks of unemployment to those who have exhausted all 26 weeks of regular UI benefits. An EB claimant is required to be able to and be available for work, to make a systematic and sustained effort to seek work, and to provide evidence of meeting these requirements prior to payment of benefits. Condition: Internal control over UI benefit claim payments includes ________. ________ is used by the Maine Department of Labor (MDOL) to ________. The system?s ________ include, but are not limited to: ? ________ ? ________ ? ________ ? ________ ? ________ ________ system controls ________ and ________ are prevented or detected ________. The system is ________. In addition, the system ________. The ________ system generates ________; however, formal review and completion of such procedures is at the Department?s discretion. Often, ________, and the Department must ________. Additionally, in some cases, MDOL did not follow standard operating procedures such as issuing warnings for failures to meet eligibility requirements, establishing overpayments when warranted, applying temporary holds on benefit payments when additional information is required, and conducting follow-up procedures such as fact-finding interviews when appropriate. The Department has complementary controls in place over claimant eligibility, including: ? internal work search audits performed by MDOL personnel required for one percent of weekly claims, and ? establishment of a Benefits Quality Control (BQC) Unit who is tasked with investigating a prescribed number of UI paid claims and denied claims each week. Federal entitlement programs and the enactment of emergency legislation as a result of the pandemic response required extensive claims processing modifications by MDOL. Due to overwhelming claims volume and a lack of resources available to address these modifications, and in an effort to expedite benefit payments to the citizens of Maine, the Department suspended the following controls over eligibility for all UI entitlement programs in March 2020: ? ________ ? ________ ? Work search audits ? Weekly BQC Unit investigations of paid and denied claims The Federal government provided authorization to suspend operations of the BQC Unit to realign resources for fraudulent claim investigations. MDOL also suspended ________ and work search audits. Written authorization from the Federal government was not received. After the removal of embedded controls, the MDOL UI program was targeted by imposter fraud attacks, notably in May and June 2020. These imposter fraud attacks created a spike in fraud during fiscal year 2020, with over $98.5 million in fraudulent payments identified. Of the $98.5 million, MDOL identified fraudulent payments of $41.2 million in State UI benefits and $57.3 million in Federal UI benefits. In the Office of the State Auditor?s (OSA) test of 60 claimants with benefit year start dates prior to March 2020, 13 claimants (approximately 22 percent) were deemed ineligible to receive benefits. Of the 13 ineligible claimants identified, MDOL established overpayments for 3 claimants, and 10 were undetected until procedures were performed by OSA. In OSA?s test of 60 claimants with benefit year start dates subsequent to March 2020, 11 claimants (approximately 18 percent) were deemed ineligible to receive benefits. All 11 claimants were subsequently marked as fraudulent and are included in the known fraud totals above. The Office of the State Auditor selected a non-statistical random sample. Additional audit procedures identified that: ? five ineligible claimants received UI benefits after their date of death. Of the five cases, four were subsequently marked as fraudulent claims and included in the fraud totals above, and one remained active and received benefits totaling $5,670 through the end of fiscal year 2020. ? all claims paid under the EB program are deemed ineligible due to the Department?s removal of automated system controls and payment of benefits prior to fulfillment of EB eligibility requirements. Context: The UI program provided $361 million in State UI benefits and $886.6 million in Federal UI benefits during fiscal year 2020. Of these benefits, the Department identified $98.5 million in fraudulent payments. Total State and Federal UI benefits increased by $277 million and $885.2 million, respectively, from the prior year, which is a direct result of the COVID-19 pandemic. Cause: ? Lack of resources due to the COVID-19 pandemic response prioritization ? Removal of embedded system controls in response to the COVID-19 pandemic ? Lack of adequate supervisory oversight over information system application controls for all of fiscal year 2020 Effect: ? Questioned costs of $63.4 million comprised of: o $57.3 million in identified fraudulent Federal UI benefit payments, reduced by a recovery of $20.5 million, resulting in net questioned costs of $36.8 million; o $41.2 million in identified fraudulent State UI benefit payments, reduced by a recovery of $14.9 million, resulting in net questioned costs of $26.3 million; o approximately $200,000 in ineligible Federal Extended Benefit program payments; and o approximately $16,000 in Federal and State UI benefit payments deemed ineligible as a result of audit testing. ? Potential liability, and applicable interest, due to the Federal government for claims paid to ineligible or fraudulent Federal UI benefit claimants, as detailed above ? Potential future questioned costs and disallowances ? The Federal government may impose stricter requirements or eliminate Federal funding available to the State. ? Noncompliance with Federal regulations Recommendation: We recommend that the Department implement additional control procedures, including ________, to ensure that eligibility requirements are met and adequately supported prior to issuance of benefit payments. We also recommend that the Department immediately review and reinstate all routine controls that were suspended in response to the COVID-19 pandemic. In addition, the Department should work with the U.S. Department of Labor to obtain authorization for the State to be held harmless from the financial impacts resulting from the suspension of routine controls and noncompliance with Federal program requirements. Corrective Action Plan: See F-12 Management?s Response: The Department disagrees with this finding. The finding states that ?all claims paid under the Extended Benefit (EB) program are deemed ineligible?? because the Department set aside certain controls and eligibility reviews. Specifically, the finding states that the Department set aside the work search audits without authorization from the U.S. Department of Labor (USDOL). However, the Department consulted with USDOL on the changes that were being considered and continues to do so throughout the pandemic. In addition, USDOL reviewed emergency provisions and Maine?s draft legislation. USDOL recommendations were incorporated into the proposed legislation that was submitted and ultimately enacted. The finding cites Unemployment Insurance Program Letter (UIPL) 24-20, which outlines the normal requirements of EB, including work search. However, UIPL 24-20 Section 4c allows states to temporarily modify or suspend the work search requirement in response to COVID-19. This section also makes reference to UIPL 13-20 Change 1, which indicates on page I-2 that state agencies ?may also chose to implement flexibilities in response to COVID-19 that are broader than the minimum?. UIPL 13-20 Section 5A also indicated that states ?may consider applying this emergency temporary flexibility to all individuals collecting UC and not just those recently separated. This allows individuals to more effectively comply with the social distancing recommendations of federal, state and local government officials to mitigate the spread of COVID-19. States can also continue using the flexibilities for able-and-available requirements set out in UIPL No. 10-20.? The finding further states that the unemployment system requirement for a one week waiting period prior to payment was suspended by the Department as a result of the lack of resources available to respond to the claims volume. However, this change was not implemented because of a lack of resources, but rather in accordance with Maine law and guidance from USDOL. Maine enacted emergency legislation through 2019 Public Law Chapter 617 that temporarily suspended the first week waiting period. This was also subsequently supported by the federal legislation and the UIPLs referenced in the preceding paragraph. The finding also states that the Department?s system does not ensure that benefit payments to ineligible claimants are prevented or detected prior to the issuance of payments. The Department collects necessary information to determine initial and ongoing eligibility. It is important to note that both federal and state law prohibit the withholding of payment from someone who is already receiving benefits when a potential eligibility issue is identified. The Department must gather additional information and issue a written determination, which also includes notification of the right to appeal the determination. In the meantime, payments must be made. If the Department issues a determination that the individual was ineligible, an overpayment is created and repayment is required. Most internal controls remained in place throughout the COVID-19 pandemic. Despite pressures to process benefit payments faster, the Department kept program integrity in mind with each decision that was made and in implementation of the new federal programs. In response to the pandemic, the Department did review certain procedures and modified them to accommodate the rapid and drastic loss of employment by Maine workers. Steps were taken to limit the risk of the modifications. Despite this, identities stolen in past nation-wide data breaches were used against unemployment programs across the country at the same time. The internal controls that were in place prevented a larger loss of funds, which was largely limited to a two-week period in May 2020. The Department does not dispute the unemployment imposter fraud payments identified. The Department has taken steps to help ensure program integrity. Partnerships with other state and federal agencies were enhanced and have been instrumental. These include: the USDOL Office of Inspector General; the U.S. Attorney?s Office; FBI; U.S. Secret Service; National Association of State Workforce Agencies and other states; MaineIT; the Maine Office of the Attorney General; and, the Maine Office of the State Treasurer. In addition, the Department has hired additional staff, both to address the increased claim volume as well as to expand fraud prevention activities. Contractors have been hired to improve timeliness and to better assess program risk. For the ________ system, changes were made to build in certain risk-assessments, which are constantly revised based on trends in Maine and across the country. The Department remains committed to compassionate actions that pay benefits expeditiously to eligible people while maintaining program integrity. The Department will continue its aggressive approach toward identifying fraudulent claims, recovering funds, assisting with investigations and prosecutions, and is constantly reassessing risk based on ever-changing threats. Contact: Laura Boyett, UC Bureau Director, DOL, 207-530-2579 Auditor?s Concluding Remarks: The Federal legislation referenced in Management?s Response was enacted subsequent to the Department?s suspension of controls. Therefore, the Department?s suspension of controls was not a result of this legislation. The Department also contends that ?the Department consulted with USDOL on the changes that were being considered and continues to do so throughout the pandemic? regarding the suspension of controls. The Department was unresponsive to OSA?s multiple requests for supporting documentation to verify the veracity that authorization was obtained from the U.S. Department of Labor. The Department correctly asserts that 26 MRSA 1199 (Public Law 617) was enacted as emergency legislation and provided relief for the suspension of the first week waiting period. However, this relief is only applicable to claimants adversely affected by mandated COVID-19 pandemic-related closures or medical quarantine. The Department erroneously suspended controls for all UI claimants, rather than only those that were adversely affected by the COVID-19 pandemic. The Condition of this finding does not specifically cite work search audits as a direct factor in EB program ineligibility as incorrectly noted in Management?s Response. It states that EB program claims are deemed ineligible because the Department did not enforce fulfillment of EB eligibility requirements prior to payment as required by Federal program regulations. OSA has reported a material weakness in internal control resulting in material noncompliance with Federal UI program regulations for at least 10 years. The magnitude of exceptions noted in fiscal year 2020 were exacerbated by the COVID-19 pandemic. While we recognize the efforts of the Department to maintain program integrity while responding to the extraordinary impacts of a global pandemic, the existing control environment does not provide and has not provided assurance that all eligibility requirements are met and adequately supported prior to the issuance of benefit payments. The finding remains as stated. This is a confidential finding containing sensitive information. The complete finding has been formally addressed to: ? Jim Garner, Administrator, U.S. Department of Labor, Office of Unemployment Insurance, Frances Perkins Building, Room S-4524, 200 Constitution Avenue NW, Washington, DC 20210 A copy of that correspondence has also been sent to: ? Grover L Fowler, Assistant Director, Financial Management Audits, U.S. Department of Labor, Office of the Inspector General, Frances Perkins Building, Room N-4633, 200 Constitution Avenue NW, Washington, DC 20210 (State Number: 20-1302-01)

(2020-027) Confidential finding, see below for more information Title: ________ for the ________ system need improvement (The content of this finding has been redacted. This appears as blank underlining) Prior Year Findings: See Schedule of Findings and Questioned Costs for chart/table *The system was not audited in this fiscal year. State Department: Labor State Bureau: Unemployment Compensation Federal Agency: U.S. Department of Labor CFDA Title: Unemployment Insurance (UI) CFDA Number: 17.225 Federal Award Identification Number: Unemployment Insurance Trust Fund, Maine Compliance Area: Allowable costs/cost principles Eligibility Type of Finding: Significant deficiency Questioned Costs: None See Schedule of Findings and Questioned Costs for chart/table Criteria: 2 CFR 200.303; National Institute of Standards and Technology (NIST) Special Publication ________; State of Maine Office of Information Technology (OIT) Policies The Department must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the Department is managing the award in compliance with Federal statutes, regulations, and the terms and conditions of the award. NIST Special Publication ________ and OIT policies state that the organization must ________. Condition: The ________ system is used by the Maine Department of Labor to process ________ program ________ and ________. Audit procedures over ________ found that of the ________ tested: ? ________ did not have ________; ? ________did not have a ________; and ? ________ were ________ after ________. The Office of the State Auditor selected a non-statistical random sample. Context: The UI program provided approximately ________ in State benefits and ________ in Federal UI benefits during fiscal year 2020. Total State and Federal UI benefits increased by ________ and ________, respectively, from the prior year. In order to administer this increase in benefits, ________ were ________ to the ________ system in fiscal year 2020, as compared to ________ in fiscal year 2019. These significant increases are a direct result of the COVID-19 pandemic. Cause: ? ________ ? ________ Effect: ? ________ ? ________ Recommendation: We recommend that the Department implement and subsequently monitor policies and procedures to ensure that: ? ________, ________ or ________ are documented; and ? ________ are provided to the Department before ________. Corrective Action Plan: See F-13 Management?s Response: The Department agrees with the finding. The ________ process was expedited to address the dramatic and rapid increase in unemployment claims. During fiscal year 2019, the Department ________ and during fiscal year 2020, ________, with ________ between March 2020 and June 2020. The Department ________ from ________ and ________ to help with the large workload due to the pandemic. The ________ process is handled by the same staff that were handling the ________ within the ________ system as a result of the CARES Act of 2020. Under the circumstances of ________ and concurrently implementing ________ related to federal legislation, unfortunately gaps in the process occurred. Standard operating procedures will be reviewed and updated as necessary. The Department doesn't anticipate this scenario reoccurring. Contact: Michelle Hein, Business Systems Manager, DOL, 207-530-0073 This is a confidential finding containing sensitive information. The complete finding has been formally addressed to: ? Jim Garner, Administrator, U.S. Department of Labor, Office of Unemployment Insurance, Frances Perkins Building, Room S-4524, 200 Constitution Avenue NW, Washington, DC 20210 A copy of that correspondence has also been sent to: ? Grover L. Fowler, Assistant Director, Financial Management Audits, U.S. Department of Labor, Office of the Inspector General, Frances Perkins Building, Room N-4633, 200 Constitution Avenue NW, Washington, DC 20210 (State Number: 20-0900-18)

(2020-028) Title: Internal control over subrecipient monitoring procedures needs improvement Prior Year Findings: None See Schedule of Findings and Questioned Costs for chart/table *The program was not audited as a major program in this fiscal year. State Department: Transportation State Bureau: Transportation Systems Planning Federal Agency: U.S. Department of Transportation CFDA Title: Formula Grants for Rural Areas CFDA Number: 20.509 Federal Award Identification Number: ME-2016-008-03, ME-2017-011-00, ME-2018-024-00, ME-18-X054-01, ME-18-X056-02, ME-2019-002-01, ME-2019-019-00, ME-2020-005-00 Compliance Area: Subrecipient monitoring Type of Finding: Material weakness Material noncompliance Questioned Costs: None See Schedule of Findings and Questioned Costs for chart/table Criteria: 2 CFR 200.303; 2 CFR 200.331; State Management Plan approved by the Federal Transit Administration The Department must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the Department is managing the award in compliance with Federal statutes, regulations, and the terms and conditions of the award. Per the State Management Plan and Federal requirements, the Department is required to perform a site visit for each subrecipient once every five years. During the site review, the Department must evaluate and monitor performance, review financial and performance reports, review policies and procedures, and review vehicle maintenance records. Condition: The Department was required to perform site reviews for 22 subrecipients during fiscal year 2020. In the Office of the State Auditor?s audit testing of five subrecipients: ? one subrecipient should have had a site visit performed by December 12, 2012. The site visit was completed on January 28, 2021. ? one subrecipient should have had a site visit performed by March 25, 2014. The site visit had not been completed as of audit testing in February 2021. ? one subrecipient should have had a site visit performed by October 30, 2018. The site visit had not been completed as of audit testing in February 2021. The Office of the State Auditor selected a non-statistical random sample. Context: In fiscal year 2020, the Department provided approximately $9.5 million to 22 subrecipients. $2.5 million of these funds were provided from COVID-19 related grants. Cause: ? Lack of resources ? Lack of supervisory oversight Effect: ? Noncompliance with Federal requirements for pass-through entities ? Federal programs may not be effectively and efficiently administered. ? Potential future questioned costs and disallowances Recommendation: We recommend that the Department implement a process to ensure that the backlog of site visits is completed. We further recommend additional oversight procedures to ensure that site visits and follow-up occur in the timeframe approved by the Federal Transit Administration. Corrective Action Plan: See F-13 Management?s Response: The Department agrees with this finding. A corrective action plan has been developed to ensure that the backlog of site visits is completed and that additional oversight procedures have been established to ensure that site visits and follow-up occur in the timeframe approved by the Federal Transit Administration. Contact: Doreen Corum, Financial Processing Director, DOT, 207-624-3139 (State Number: 20-1402-01)

(2020-029) Title: Internal control over cash management needs improvement Prior Year Findings: See Schedule of Findings and Questioned Costs for chart/table *The program was not audited as a major program in this fiscal year. State Department: Administrative and Financial Services State Bureau: General Government Service Center Federal Agency: U.S. Department of Education CFDA Title: Special Education Cluster (IDEA) CFDA Number: 84.027, 84.173 Federal Award Identification Number: H173A170115, H173A180115, H173A190115, H027A170109, H027A180109, H027A190109 Compliance Area: Cash management Type of Finding: Significant deficiency Questioned Costs: None See Schedule of Findings and Questioned Costs for chart/table Criteria: 2 CFR 200.303; 31 CFR 205.33; State Administrative and Accounting Manual (SAAM) Section 50.40.80 The Department must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the Department is managing the award in compliance with Federal statutes, regulations, and the terms and conditions of the award. The Department must minimize the time between the drawdown of Federal funds and the disbursement of these funds for Federal program purposes. The timing and amount of fund transfers must be as close as administratively feasible to the Department?s actual cash outlay for program costs. Section 50.40.80 of the SAAM has defined administratively feasible as Federal funds shall be held for no more than seven business days. Condition: The Department draws Federal funds to reimburse Special Education expenditures multiple times each week. In November 2019, in an effort to appropriately transfer expenditures from one grant to another, the Department requested a $60,462 draw for expenditures that had been previously reimbursed. The Department did not return the excess funds that resulted from this duplicative draw. Instead, the Department suspended drawdown requests through March 2020 until the duplicate funds were expended, which resulted in cash balances in excess of the State?s administratively feasible threshold of seven business days during that period. Context: In fiscal year 2020, there were 359 Federal grant drawdowns totaling $59.6 million for the Special Education program. Cause: ? Lack of adequate policies and procedures ? Lack of supervisory oversight Effect: The Federal government may impose more stringent program-specific cash management requirements based on noncompliance. Recommendation: We recommend the Department develop policies and procedures to address the identification and timely return of excess grant funds to the Federal government. Corrective Action Plan: See F-13 Management?s Response: The Department agrees with this finding. The General Government Service Center recently provided training to staff to reinforce the existing procedures that include the requirement to return excess funds in this type of situation rather than the suspension of draws and the utilization of the funds over an extended period. Contact: Laurie Andre, Deputy Director ? Accounting, General Government Service Center, DAFS, 207-592-0725 (State Number: 20-1201-01)

(2020-030) Confidential finding, see below for more information Title: ________ and ________ for the ________ system need improvement (The content of this finding has been redacted. This appears as blank underlining) Prior Year Findings: See Schedule of Findings and Questioned Costs for chart/table *The system was not audited in this fiscal year. State Department: Education State Bureau: School Finance and Operations Federal Agency: U.S. Department of Education CFDA Title: Special Education Cluster (IDEA) CFDA Number: 84.027, 84.173 Federal Award Identification Number: H173A170115, H173A180115, H173A190115, H027A170109, H027A180109, H027A190109 Compliance Area: Reporting Subrecipient monitoring Type of Finding: Significant deficiency Questioned Costs: None See Schedule of Findings and Questioned Costs for chart/table Criteria: 2 CFR 200.303; National Institute of Standards and Technology (NIST) Special Publication ________; NIST Special Publication ________; State of Maine Office of Information Technology (OIT) Policies The Department must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the Department is managing the award in compliance with Federal statutes, regulations, and the terms and conditions of the award. NIST Special Publication ________ states that an organization must have the ability to ________. NIST Special Publication ________ states that a ________ is key to implementing ________ and in the ________ process overall. NIST Special Publication ________ states that the organization: ? monitor the use of ________ and ________ for compliance with ________ requirements; ? ________, ________, and ________; and ? ________ a ________ for the information system. OIT policies state that: ? agencies must ________ based on ________ and other attributes as required by the organization; ? ________ are to meet minimum State requirements; and ? an agency system owner defines a ________ consistent with: o the ________ which represents ________; o the ________ which represents ________; and o the impact on business. Condition: The Department uses information generated from the ________ system to prepare State and Federal reports. The information includes ________, ________, ________, ________, and other data points submitted by individual ________ and ________. Audit procedures over the ________ system identified the following exceptions: ? For the ________ during fiscal year 2020: o ________ did not have documented ________; o ________ did not have documented ________; and o the documented ________ for ________ did not match the ________ in the ________ system. ? ________ did not meet the State?s ________. ? The Department has not completed a ________. A ________ is used to determine the appropriate ________ and ________. The established and approved ________ and ________ are used to determine the ________. ? The Department does not have a system specific ________ or ________. Context: In fiscal year 2020, the Special Education Cluster used data from ________ to report ________ of approximately ________. Cause: ? ________ ? ________ ? ________ Effect: ? ________ ? ________ ? ________ Recommendation: We recommend that the Department implement and subsequently monitor policies and procedures to ensure that: ? ________ is administered based on a ________ and ________; ? ________ are aligned with State of Maine policy; ? a ________ is conducted in compliance with government standards to facilitate the ________; and ? ________ are ________, ________, ________, ________ and ________ in accordance with State policy and industry best practices. Corrective Action Plan: See F-13 Management?s Response: The Department agrees with this finding. We have been improving our ________ process over the last two years and will continue to implement improvements. ________ and ________ are existing policies. These findings represent a specific area of internal compliance that needs to be fixed. DOE Data Team Help Desk is currently implementing updated ________ procedures to expand the implementation of our updated procedures to include the ________ and the documentation for internal ________. DOE will review and refine the ________ and existing ________ to include ________ and ________ by the next audit. There is a dependency on OIT to improve OIT ________ capabilities. OIT will continue to work to acquire the resources to fund and then hire an appropriate resource to conduct ________ planning for the State. However, there are currently no real prospects on how to accomplish this through the FY 22/23 budget. MDOE and DOE AppDev are currently in the Assessment phase regarding ________ related to the ________ and ________ policy. Development initiatives to remediate identified deficiencies will be planned and implemented in our upcoming development cycles. Contact: Katherine Warren, Education Data Systems Manager, DOE, 207-624-6716 This is a confidential finding containing sensitive information. The complete finding has been formally addressed to: ? Christine Pilgrim, Associate Division Director, Office of Special Education Program, U.S. Department of Education, 550 12th Street SW, Washington, DC 20202 A copy of that correspondence has also been sent to: ? Mark Priebe, Director Non-Federal Audit Team, U.S. Department of Education, Office of the Inspector General, 550 12th Street SW, Room 8153, Washington, DC 20202 (State Number: 20-0900-14)

(2020-031) Title: Internal control over claim reimbursements needs improvement Prior Year Findings: See Schedule of Findings and Questioned Costs for chart/table *The program was not audited as a major program in this fiscal year. State Department: Labor State Bureau: Rehabilitation Services Federal Agency: U.S. Department of Education CFDA Title: Rehabilitation Services ? Vocational Rehabilitation Grants to States CFDA Number: 84.126 Federal Award Identification Number: H126A180085, H126A190085, H126A200085, H126A180026, H126A190026, H126A200026 Compliance Area: Program income Type of Finding: Material weakness Material noncompliance Questioned Costs: None See Schedule of Findings and Questioned Costs for chart/table Criteria: 2 CFR 200.303; 2 CFR 200.307; Vocational Rehabilitation Providers Handbook (Social Security Administration) The Department must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the Department is managing the award in compliance with Federal statutes, regulations, and the terms and conditions of the award. Program income claims must be accurate and in accordance with the calculations outlined in the Vocational Rehabilitation Providers Handbook. Internal control must provide reasonable assurance that potential errors are prevented or detected and corrected in a timely manner. Condition: The Social Security Administration (SSA) administers a Vocational Rehabilitation (VR) Reimbursement Program to assist people with disabilities gain employment. Under this program, the SSA reimburses the Bureau of Rehabilitation Services, comprised of the Division of Vocational Rehabilitation and the Division for the Blind and Visually Impaired, for the cost of services provided to beneficiaries with disabilities if such services result in the achievement of work at a specified earnings level. Reimbursable VR service costs require calculations that utilize client eligibility periods and SSA-approved monthly cost rates. The Bureau relies on State information systems to correctly calculate costs for submission of claims to the SSA. The information system calculations apply a single cost rate across multiple Federal fiscal years rather than applying multiple cost rates depending on Federal fiscal year. The amount of claim payments received from the SSA often differs from the amount that was submitted by the Bureau. The multiple cost rates applied by the SSA for each Federal fiscal year included in the eligibility period, consistent with the formula outlined in the VR Providers Handbook, is the main factor in the variance. The Bureau does not have controls in place to ensure that these claim payments received from the SSA are accurate. Therefore, identification and correction of potential underpayments or overpayments will not be detected and corrected. In the 30 VR claim reimbursements examined by the auditor: ? claim calculations submitted by the Bureau were not consistent with the formula outlined in the VR Providers Handbook; ? the amount approved and paid by the SSA varied from 5 percent to 106 percent of the amount submitted by the Bureau; and ? the payment received by the Bureau averaged 85 percent of the amount submitted to the SSA and the Bureau did not perform a formal analysis of this activity. The Bureau became aware of the calculation discrepancies in February 2020 as a result of prior year audit procedures performed by the Office of the State Auditor. The Bureau then initiated a review of system programming with the third-party vendor responsible for the system; however, timely remediation was not possible due to information system limitations. In May 2020, the Bureau suspended the submission of program income claims until the information system can be programmed to accurately calculate claims. The Bureau notified the SSA of the suspension and underlying cause. The SSA may grant a waiver which would allow the Bureau to file retroactive claims; however, this is not guaranteed. The Office of the State Auditor selected a non-statistical random sample. Context: In fiscal year 2020, the Vocational Rehabilitation program received $1.3 million from the SSA and $14.7 million in Federal grant funding. Cause: ? Reliance on outdated information system claim calculations due to a lack of supervisory oversight, until the Bureau became aware of the miscalculations in February 2020 ? Limitations of the outdated existing information system ? Lack of adequate policies and procedures to ensure that claims to the SSA and payments received from the SSA are reconciled Effect: ? Potential underpayments or overpayments by the SSA may go undetected. Underpayments result in less program income funding available to provide VR services and overpayments result in amounts due back to the SSA. ? Due to the current suspension of claim submission to the SSA, there will be a delay in receipts as well as a decrease in program income funding available to provide VR services. If program income claim submission is not reactivated within applicable SSA deadlines and retroactive claim submission is not permitted, the temporary decrease in funding may become a permanent loss of program income revenue. Recommendation: We recommend that the Bureau continue to collaborate with the third-party vendor to adjust current information system calculations to be in accordance with the formula outlined in the VR Providers Handbook. We further recommend that the Bureau implement policies and procedures which require: ? formal documentation of the review of claim payments from the SSA to ensure that the amount received is accurate and in accordance with program guidelines; ? analysis of variances between claims submitted by the State and payments received from the SSA; ? documentation of the analysis and results; and ? initiation of appropriate action to resolve underlying issues. Corrective Action Plan: See F-13 Management?s Response: The Department agrees with this finding. Since February of 2020, the BRS Quality Assurance (QA) Division, with assistance from Maine IT, is working closely with the AWARE case management system vendor to resolve issues with the SSA cost reimbursement module. The QA Division does have a number of internal controls in place regarding the processing of SSA cost reimbursement claims, including the review of each payment received to confirm which client and claim it is associated with and assessing any difference between the claim and payment amount. In addition, bureau management reviews a quarterly report indicating claims submitted, potential reimbursement, number of denials and approvals and total reimbursement amount. Going forward, BRS will enhance its claims review process. On a quarterly basis the Bureau will analyze the report and identify any patterns or discrepancies to determine which need further investigation. Keeping in mind that BRS does not have access to some of the data SSA uses in determining the final claim amount, such as beneficiary eligibility periods and anticipated savings to the SSA trust fund, it is likely that differences in the claim amount requested and received will continue for a significant percentage of claims. Contact: Christine Robinson, BRS Director of Quality Assurance, DOL, 207-623-7942 (State Number: 20-1308-02)

(2020-032) Title: Internal control over the timeliness of eligibility determinations needs improvement Prior Year Findings: See Schedule of Findings and Questioned Costs for chart/table State Department: Labor State Bureau: Rehabilitation Services Federal Agency: U.S. Department of Education CFDA Title: Rehabilitation Services ? Vocational Rehabilitation Grants to States CFDA Number: 84.126 Federal Award Identification Number: H126A180085, H126A190085, H126A200085, H126A180026, H126A190026, H126A200026 Compliance Area: Eligibility Type of Finding: Significant deficiency Questioned Costs: None See Schedule of Findings and Questioned Costs for chart/table Criteria: 2 CFR 200.303; 34 CFR 361.41(b) The Department must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the Department is managing the award in compliance with Federal statutes, regulations, and the terms and conditions of the award. Eligibility for vocational rehabilitation (VR) services must be determined within 60 days after an initial application, unless the delay is the result of exceptional and unforeseen circumstances and the Bureau of Rehabilitation Services and the individual agree to a specific extension of time. Condition: The VR program provides services to individuals with disabilities so they may prepare for and engage in competitive employment. The Bureau is comprised of the Division of Vocational Rehabilitation (DVR) and the Division for the Blind and Visually Impaired (DBVI). In 2,472 DVR client eligibility determinations that were processed in fiscal year 2020: ? 222 determinations were processed after 60 days with a documented extension, but the extension was not filed timely; and ? 514 determinations were processed after 60 days and no extension was documented. In 90 DVR client applications that were pending eligibility determination at the end of fiscal year 2020, three applications remained outstanding for more than 60 days with no extension or documentation of exceptional circumstances. In 67 DVBI client eligibility determinations that were processed in fiscal year 2020, two determinations were made after 60 days and no extension was documented. Context: In fiscal year 2020, VR program expenditures totaled $16.3 million. Of the $16.3 million, DVR and DBVI expenditures totaled $13.5 million and $2.8 million, respectively. Cause: ? Lack of staff resources ? Lack of supervisory oversight Effect: ? Eligible participants may not receive services in a timely manner. ? Noncompliance with Federal regulations Recommendation: We recommend that the Bureau implement additional oversight procedures to ensure participant applications and eligibility determinations are processed within the required 60-day timeframe. If the process for eligibility determination is delayed beyond 60 days due to exceptional and unforeseen circumstances, controls should be implemented to ensure that a specific time extension is offered and agreed to by the applicant and documented by the Bureau. Corrective Action Plan: See F-14 Management?s Response: The Department agrees with this finding. In the Fall of 2020, the Division of Vocational Rehabilitation (DVR) issued an updated procedural directive on the eligibility process that set a maximum timeframe from date of application to date of intake. It also provides guidelines on how to streamline the eligibility process. All DVR/DBVI VR staff were trained on the streamlined process in November and December of 2020. That training is now included in the training for all new VR counselors and is posted on the bureau's intranet for future reference. BRS (DVR and DBVI) has several internal control procedures in place to monitor the requirement for a 60-day eligibility or a signed eligibility extension. There are also reports available in the AWARE case management system to assist VR counselors, supervisors and managers with monitoring eligibility due dates and organizing their work. BRS will provide a refresher staff training on how to generate and use these reports. The BRS QA unit will also provide regional reports to the Division Directors and Regional Managers on a monthly basis to assist with monitoring. It should be noted that even with effective internal controls in place, BRS often faces difficulties contacting applicants to arrange for an intake to establish eligibility or to get a signature to approve an eligibility extension. The impact of the COVID pandemic has added challenges to the eligibility determination process as well. Despite the aforementioned issues, DVR and DBVI placed a higher priority on keeping cases open during this unprecedented time. Contact: Christine Robinson, BRS Director of Quality Assurance, DOL, 207-623-7942 (State Number: 20-1308-01)

(2020-033) Title: Internal control over Federal cash management needs improvement Prior Year Findings: See Schedule of Findings and Questioned Costs for chart/table *The program was not audited as a major program in this fiscal year. State Department: Administrative and Financial Services Labor State Bureau: Security and Employment Service Center Rehabilitation Services Federal Agency: U.S. Department of Education CFDA Title: Rehabilitation Services ? Vocational Rehabilitation Grants to States CFDA Number: 84.126 Federal Award Identification Number: H126A180085, H126A190085, H126A200085, H126A180026, H126A190026, H126A200026 Compliance Area: Cash management Type of Finding: Significant deficiency Questioned Costs: None See Schedule of Findings and Questioned Costs for chart/table Criteria: 2 CFR 200.303; 31 CFR 205.33; State Administrative and Accounting Manual (SAAM) 50.40.80 The Department must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the Department is managing the award in compliance with Federal statutes, regulations, and the terms and conditions of the award. The Department must minimize the time between the drawdown of Federal funds and the disbursement of these funds for Federal program purposes. The timing and amount of fund transfers must be as close as is administratively feasible to the Department?s actual cash outlay for program costs. Section 50.40.80 of the SAAM has defined administratively feasible as Federal funds shall be held for no more than seven business days. Condition: The Security and Employment Service Center (SESC) provides services including human resources, payroll, and accounting and finance to the Bureau of Rehabilitation Services (BRS), which is comprised of the Division of Vocational Rehabilitation (DVR) and the Division for the Blind and Visually Impaired (DBVI). On June 26, 2020, SESC processed a $231,599 request on behalf of DBVI for Federal Vocational Rehabilitation (VR) program expenditure reimbursement. SESC processed the request without reviewing documentation in support of the drawdown. SESC subsequently reviewed the supporting documentation and found that the request included funds for expenditures totaling $126,661 unrelated to DBVI?s VR program. SESC suspended future drawdowns until the cash balance was absorbed, rather than returning excess Federal funds. As a result, DBVI carried cash balances in excess of seven days of average expenses through July 20, 2020. Context: In fiscal year 2020, SESC processed 73 DBVI Federal draws totaling $2.7 million and 76 DVR Federal draws totaling $12.1 million. Cause: ? Procedural changes due to COVID-19 telecommuting ? Lack of adequate procedures to ensure Federal drawdowns are supported by program expenditures ? Lack of adequate procedures to ensure excess Federal funds are returned in a timely manner Effect: The Federal government may impose more stringent program-specific cash management requirements based on prior noncompliance. Recommendation: We recommend that SESC and BRS revise current policies and procedures to ensure that grant funds are only drawn for actual, immediate cash needs and that excess funds are promptly returned to the Federal government. Corrective Action Plan: See F-14 Management?s Response: The Department agrees with this finding. Cash on hand exceeded the administratively feasible time of seven business days. In seven business days, 77% of the cash drawn was expended. The cash drawn was fully expended in 17 business days. As stated in the Context section, 149 draws were processed in compliance with the cash management requirements. This one anomaly occurred at the end of the state fiscal year when the focus was on processing as many documents as possible within the applicable fiscal year. In addition, staff were still adjusting to working remotely in the pandemic environment. The internal controls in place identified the error. Because the process to return funds is administratively burdensome and the Department anticipated expending within a reasonable amount of time, the decision was made to not return the funds. The Department recognizes the need to accurately calculate the amount of cash being requested, especially considering that funds cannot be returned in the same manner that they are drawn. Contact: Christine Robinson, BRS Director of Quality Assurance, DOL, 207-623-7942 (State Number: 20-1308-03)

(2020-034) Title: Internal control over provider site visits needs improvement Prior Year Findings: See Schedule of Findings and Questioned Costs for chart/table *The program was not audited as a major program in this fiscal year. State Department: Health and Human Services State Bureau: Maine Center for Disease Control & Prevention Federal Agency: U.S. Department of Health and Human Services CFDA Title: Immunization Cooperative Agreements CFDA Number: 93.268 Federal Award Identification Number: NH23IP922604 Compliance Area: Special tests and provisions Type of Finding: Material weakness Material noncompliance Questioned Costs: None See Schedule of Findings and Questioned Costs for chart/table Criteria: 2 CFR 200.303; 42 USC 1396s; Vaccines for Children (VFC) Program Operations Guide The Department must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the Department is managing the award in compliance with Federal statutes, regulations, and the terms and conditions of the award. Effective control and accountability must be maintained for all vaccines provided under the VFC program. Grantees must provide oversight of program-enrolled providers every 24 months to ensure that proper control and accountability is maintained for vaccines, vaccines are properly safeguarded, and eligibility screening is conducted. Grantees are required to: ? maintain written procedures for overseeing inventory management at program-enrolled providers and perform sampling over provider inventory records, vaccine storage and handling, and provider medical records. ? maintain written procedures for overseeing immunization records at program-enrolled providers and perform sampling of vaccination records. ? perform follow-up procedures if deficiencies were identified in the above reviews. Effective March 17, 2020, the National Center for Immunizations and Respiratory Diseases suspended on-site reviews to enable grantees to fully respond to the COVID-19 pandemic. Grantees were required to submit a proposal of alternative monitoring procedures to ensure program integrity. Condition: The Department was required to perform on-site reviews for approximately 150 providers during fiscal year 2020. Due to the COVID-19 pandemic response, the Department was unable to provide the auditors with sufficient documentation for any on-site reviews to demonstrate that: ? the program complied with the requirements associated with inventory management, immunization recordkeeping, and follow up procedures. ? the program complied with its plan of alternative monitoring procedures after on-site visits were suspended. ? controls over site visits and supervisory oversight were adequate. Context: In fiscal year 2020, 315 VFC providers received vaccines valued at approximately $12.1 million. Cause: Lack of staff resources due to COVID-19 pandemic response prioritization Effect: ? Potential noncompliance with Federal regulations ? Potential for improper vaccine storage and waste if providers failed to follow procedures and processes Recommendation: We recommend that the Department implement procedures to ensure program integrity and adequate supervisory oversight is maintained while staff are reallocated to the COVID-19 pandemic response. Corrective Action Plan: See F-14 Management?s Response: The Department of Health and Human Services agrees with this finding. Due to the COVID-19 pandemic response, the Maine Immunization Program was unable to provide the resources or time to complete this audit. However, we continue to comply with all Federal CDC requirements as outlined in our Cooperative Agreement. Inventory management oversight, supervisory reviews, and/or alternative compliance monitoring will continue as allowable by resources, Federal CDC and post-pandemic protocols. Contact: Tonya Philbrick, Senior Health Program Manager, Maine Center for Disease Control & Prevention, DHHS, 207-287-2541 (State Number: 20-1118-02)

(2020-035) Title: Internal control over agency Schedule of Expenditures of Federal Awards submissions needs improvement Prior Year Findings: See Schedule of Findings and Questioned Costs for chart/table *The program was not audited as a major program in this fiscal year. State Department: Health and Human Services State Bureau: Maine Center for Disease Control & Prevention Federal Agency: U.S. Department of Health and Human Services CFDA Title: Immunization Cooperative Agreements CFDA Number: 93.268 Federal Award Identification Number: NH23IP922604 Compliance Area: Reporting Type of Finding: Material weakness Material noncompliance Questioned Costs: None See Schedule of Findings and Questioned Costs for chart/table Criteria: 2 CFR 200.303; 2 CFR 200.510(b) The Department must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the Department is managing the award in compliance with Federal statutes, regulations, and the terms and conditions of the award. The State must prepare a Schedule of Expenditures of Federal Awards (SEFA) for the period covered by the State?s financial statements which must include the total Federal awards expended. At a minimum, the SEFA must provide total Federal awards expended for each individual Federal program and the CFDA number. Condition: The Department is responsible for communicating noncash vaccine awards to the Department of Health and Human Services (DHHS) Service Center for inclusion on the annual SEFA. The SEFA is included in the annual submission to the Federal Audit Clearinghouse (FAC). The Department did not provide noncash flu vaccine award information to the DHHS Service Center for SEFA reporting. Context: In fiscal year 2020, noncash flu vaccines totaling $755,835 were not reported to the DHHS Service Center for inclusion in the SEFA. Cause: Lack of adequate procedures to ensure all noncash vaccine awards are accurately reported to the DHHS Service Center Effect: ? Noncompliance with Federal regulations ? Incorrect information reported on the SEFA may be used for programmatic, policy or statistical purposes. Recommendation: We recommend that the Department collaborate with the DHHS Service Center to implement additional procedures to ensure that noncash vaccine awards provided to the DHHS Service Center are complete and accurate. This will ensure that Federal program expenditures are accurately reported on the SEFA prior to submitting to the FAC. Corrective Action Plan: See F-15 Management?s Response: The Department of Health and Human Services and its Service Center agree with this finding. The Service Center has since conducted training on SEFA submissions and is developing a procedure for SEFA review similar to their federal financial report reviews prior to submission. This includes training a second person in SEFA submissions and updating its SOP. Additionally, the Department will develop an SOP for non-cash vaccines to ensure the proper reporting of non-cash vaccine values to the Service Center quarterly. Contact: Tonya Philbrick, Senior Health Program Manager, Maine Center for Disease Control & Prevention, DHHS, 207-287-2541 (State Number: 20-1118-03)

(2020-036) Title: Internal control over Federal cash management needs improvement Prior Year Findings: See Schedule of Findings and Questioned Costs for chart/table *The program was not audited as a major program in this fiscal year. State Department: Administrative and Financial Services State Bureau: Health and Human Services Service Center Federal Agency: U.S. Department of Health and Human Services CFDA Title: Immunization Cooperative Agreements CFDA Number: 93.268 Federal Award Identification Number: NH23IP922604 Compliance Area: Cash management Type of Finding: Significant deficiency Questioned Costs: None See Schedule of Findings and Questioned Costs for chart/table Criteria: 2 CFR 200.303; 31 CFR 205.33(a); State Administrative and Accounting Manual (SAAM) 50.40.80 The Department must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the Department is managing the award in compliance with Federal statutes, regulations, and the terms and conditions of the award. A State must minimize the time between the drawdown of Federal funds from the Federal government and their disbursement for Federal program purposes. The timing and amount of funds transfers must be as close as is administratively feasible to a State?s actual cash outlay for program costs. Section 50.40.80 of the SAAM has defined administratively feasible as Federal funds shall be held for no more than seven business days. Condition: During the first three months of fiscal year 2020, the program carried cash balances in excess of seven days of average expenses. The excess cash was the result of a drawdown received on June 21, 2019, which duplicated funds already drawn on June 18, 2019. The duplicate draw resulted in excess Federal funds that were not returned in a timely manner. Context: In fiscal year 2020, there were 93 Federal draws totaling $2.2 million. Cause: ? Lack of controls to ensure excess Federal funds are returned in a timely manner ? Lack of supervisory oversight Effect: The Federal government may impose more stringent program-specific cash management requirements based on prior noncompliance. Recommendation: We recommend that the Department revise current policies and procedures to ensure grant funds are only drawn for actual, immediate cash needs and excess funds must be promptly returned to the Federal government. The Federal cash balance must be considered before drawing Federal funds. Corrective Action Plan: See F-15 Management?s Response: The Department of Health and Human Services and its Service Center agree with this finding. The Service Center implemented a standardized template for grant daily reconciliations which includes monitoring cash. This template was implemented for the Immunization grant in October 2020. Contact: Sarah Gove, Director, DHHS Service Center, 207-458-6626 (State Number: 20-1118-01)

(2020-037) Confidential finding, see below for more information Title: ________ over the ________ system needs improvement (The content of this finding has been redacted. This appears as blank underlining) Prior Year Findings: See Schedule of Findings and Questioned Costs for chart/table *The system was not audited in this fiscal year. State Department: Health and Human Services State Bureau: Maine Center for Disease Control & Prevention Federal Agency: U.S. Department of Health and Human Services CFDA Title: Immunization Cooperative Agreements CFDA Number: 93.268 Federal Award Identification Number: NH23IP922604 Compliance Area: Special tests and provisions Type of Finding: Significant deficiency Questioned Costs: None See Schedule of Findings and Questioned Costs for chart/table Criteria: 2 CFR 200.303; National Institute of Standards and Technology (NIST) Special Publication ________; State of Maine ________ Policy The Department must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the Department is managing the award in compliance with Federal statutes, regulations, and the terms and conditions of the award. NIST Special Publication ________ states that organizations consider ________ from the use of common controls. If common controls are provided to organizations by ________, arrangements must be made with ________ to ________. NIST Special Publication ________ states that organizations are responsible and accountable for ________ provided by ________. The responsibility for ________ services remains with authorizing officials. NIST Special Publication ________ states that ________ is the measure of confidence that ________, ________, and ________ with respect to meeting the requirements for the system. The State of Maine ________ Policy sections ________and ________ require ________ to ensure a ________ of the utmost ________, ________, and ________, and to ________. Condition: The State of Maine contracts with a ________ to provide ________ and ________ for the ________ system. The ________ system manages the ________, ________, and ________ including ________, ________ and ________, ________, and ________. The contract requires the ________ to provide ________ and to ensure that ________ is established and maintained in accordance with Federal program regulations. ________ measures the degree that the State can ________ and ________ of ________ provided by the ________ and ________. The Department of Health and Human Services (DHHS) is responsible for contractor oversight. DHHS did not receive ________ for the ________ system as required by the contract. Context: In fiscal year 2020, ________ processed over ________ in ________. Cause: ________ Effect: ? ________ ? ________ ? ________ Recommendation: We recommend that the Department implement procedures to ensure that ________ are ________ and ________ annually, and ________ are ________. This annual process should be documented, approved, and retained by management. Corrective Action Plan: See F-15 Management?s Response: The Department of Health and Human Services agrees with this finding. ________ had detailed plans to ________ in 2020. The ________ would have been provided with the transition. The ________ was delayed due to the response required for COVID vaccination efforts which relied heavily on the ________. By June 30, 2022, ________ will transition to ________ and at the time of transition the necessary ________ and ________ for ________ will be ________ and will be ________ annually by the Department as well as the Office of Information Technology. Contact: Tonya Philbrick, Senior Health Program Manager, Maine Center for Disease Control & Prevention, DHHS, 207-287-2541 This is a confidential finding containing sensitive information. The complete finding has been formally addressed to: ? Claude Mwanda, Audit Resolution Team, U.S. Department of Health and Human Services, Center for Disease Control and Prevention, 1600 Clifton Road NE, Atlanta, GA 30329 A copy of that correspondence has also been sent to: ? Greg Dowell, Assistant Director, U.S. Department of Health and Human Services, Office of the Inspector General, Office of Audit Service, National External Audit Review Center, 601 E. 12th Street, Suite 0429, Kansas City, MO 64106 (State Number: 20-0900-15)

(2020-038) Confidential finding, see below for more information Title: ________ and ________ for the ________ system need improvement (The content of this finding has been redacted. This appears as blank underlining) Prior Year Findings: See Schedule of Findings and Questioned Costs for chart/table *The system was not audited in this fiscal year. State Department: Health and Human Services State Bureau: Maine Center for Disease Control & Prevention Federal Agency: U.S. Department of Health and Human Services CFDA Title: Immunization Cooperative Agreements CFDA Number: 93.268 Federal Award Identification Number: NH23IP922604 Compliance Area: Special tests and provisions Type of Finding: Significant deficiency Questioned Costs: None See Schedule of Findings and Questioned Costs for chart/table Criteria: 2 CFR 200.303; National Institute of Standards and Technology (NIST) Special Publication ________; NIST Special Publication ________; State of Maine Office of Information Technology (OIT) Policies; Maine Center for Disease Control & Prevention (MeCDC) ________ The Department must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the Department is managing the award in compliance with Federal statutes, regulations, and the terms and conditions of the award. NIST Special Publication ________ states that an organization must have the ability to ________. NIST Special Publication ________ states that the ________ is key to implementing ________ and in the ________ process overall. NIST Special Publication ________ states that the organization ________, ________, and ________. OIT policies state that: ? agencies must ________ based on ________ and other attributes as required by the organization; ? ________ are to meet minimum State requirements; and ? an agency system owner defines a ________ consistent with: o the ________ which represents ________; o the ________ which represents ________; and o the impact on business. MeCDC policies require retention and availability of ________ and ________ for ________. Condition: The State of Maine contracts with a vendor to provide ________ and ________ for the ________ system. The ________ system supports MeCDC?s ________, ________, and other ________ including ________, ________, ________, and ________. Audit procedures over the ________ system identified the following exceptions: ? For the ________ during fiscal year 2020: o ________ were ________; o one ________; and o one ________. ? ________ did not meet the State?s ________. ? MeCDC has not completed a ________. A ________ is used to determine the appropriate ________ and ________. The established and approved ________ and ________ are used to determine the ________. Context: In fiscal year 2020, the ________ system processed ________ totaling over ________. Cause: ? ________ ? ________ ? ________ Effect: ? ________ ? ________ ? ________ Recommendation: We recommend that the Department strengthen, implement, and subsequently monitor policies and procedures to ensure that: ? ________ is ________ and ________ by ________ and ________; ? ________ are aligned with State of Maine policy; and ? a ________ is conducted in compliance with government standards to facilitate the ________. Corrective Action Plan: See F-16 Management?s Response: The Department of Health and Human Services agrees with this finding. The program will adhere to all ________ requirements as outlined in the State?s ________ policy by April 2021. We will discuss the requirements with the ________ to determine feasibility for implementing the additional changes. We will continue our process of internal program ________ which we were unable to perform during the last audit year due to resource constraints for the response efforts needed for COVID. Lastly, also due to resource constraints, a ________ was not completed but will be prioritized this audit year to include the necessary information from the ________ detailing the ________ and ________ requirements for the system. Contact: Tonya Philbrick, Senior Health Program Manager, Maine Center for Disease Control & Prevention, DHHS, 207-287-2541 This is a confidential finding containing sensitive information. The complete finding has been formally addressed to: ? Claude Mwanda, Audit Resolution Team, U.S. Department of Health and Human Services, Center for Disease Control and Prevention, 1600 Clifton Road NE, Atlanta, GA 30329 A copy of that correspondence has also been sent to: ? Greg Dowell, Assistant Director, U.S. Department of Health and Human Services, Office of the Inspector General, Office of Audit Service, National External Audit Review Center, 601 E. 12th Street, Suite 0429, Kansas City, MO 64106 (State Number: 20-0900-16)

(2020-039) Title: Internal control over payments made on behalf of TANF clients needs improvement Prior Year Findings: See Schedule of Findings and Questioned Costs for chart/table State Department: Health and Human Services State Bureau: Office for Family Independence Federal Agency: U.S. Department of Health and Human Services CFDA Title: Temporary Assistance for Needy Families (TANF) CFDA Number: 93.558 Federal Award Identification Number: 1701METANF, 1801METANF, 1901METANF, 2001METANF Compliance Area: Allowable costs/cost principles Type of Finding: Material weakness Material noncompliance Questioned costs Questioned Costs: The Office of the State Auditor (OSA) tested a sample of payments made to TANF providers on behalf of TANF clients. Likely questioned costs were projected by dividing the identified known overpayment in our sample by total payments tested to establish an error rate. The error rate was then applied to total payments to providers on behalf of TANF clients in fiscal year 2020 to project likely questioned costs. See Schedule of Findings and Questioned Costs for chart/table Criteria: 2 CFR 200.303; 2 CFR 200.403; 45 CFR 263.11 The Department must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the Department is managing the award in compliance with Federal statutes, regulations, and the terms and conditions of the award. To be allowable under Federal awards, costs must be necessary and reasonable for the performance of the Federal award and be adequately documented. The Department must use Federal TANF funds for expenditures that are reasonably calculated to accomplish the purposes of TANF. Use of funds in violation of this is considered misuse of funds. Condition: The Department issues TANF payments directly to providers on behalf of TANF clients for services rendered such as childcare and transportation. OSA selected 60 provider payments and found: ? four providers were overpaid a total of $409 for Transitional Child Care. For one of the providers, OSA found that the $382 payment was made for childcare services which were no longer provided to the TANF client. Upon further review, OSA found that an additional $17,954 was overpaid to the childcare provider during fiscal year 2020. This childcare provider continued to be inappropriately paid $382 on a weekly basis through March 2021. ? one provider was underpaid by $7 for Transitional Child Care. ? one provider was incorrectly paid $250 for childcare services. The Office of the State Auditor selected a non-statistical random sample. Context: In fiscal year 2020, payments to providers on behalf of TANF clients totaled approximately $12.9 million. Cause: ? Lack of adequate procedures over provider payments ? Lack of supervisory oversight Effect: ? Questioned costs ? Potential future questioned costs and disallowances ? Noncompliance with Federal regulations Recommendation: We recommend that the Department implement procedures to ensure that payments made to TANF providers are accurate, allowable and adequately documented. We further recommend that the Department increase monitoring procedures over these payments. Corrective Action Plan: See F-16 Management?s Response: The Department agrees with this finding. The Office for Family Independence will review existing internal controls, monitoring, and documentation procedures regarding payments made to TANF providers for transitional and ASPIRE/HOPE support services and update as appropriate. Contact: Anthony Pelotte, Director, Office for Family Independence, DHHS, 207-624-4104 (State Number: 20-1111-07)

(2020-040) Title: Internal control over TANF client child support sanction procedures needs improvement Prior Year Findings: See Schedule of Findings and Questioned Costs for chart/table State Department: Health and Human Services State Bureau: Office for Family Independence Federal Agency: U.S. Department of Health and Human Services CFDA Title: Temporary Assistance for Needy Families (TANF) CFDA Number: 93.558 Federal Award Identification Number: 1701METANF, 1801METANF, 1901METANF, 2001METANF Compliance Area: Special tests and provisions Type of Finding: Material weakness Material noncompliance Questioned Costs: None See Schedule of Findings and Questioned Costs for chart/table Criteria: 2 CFR 200.303; 45 CFR 264.30; 42 USC 608(a)(2) The Department must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the Department is managing the award in compliance with Federal statutes, regulations, and the terms and conditions of the award. If the Department determines that an individual is not cooperating with child support enforcement requirements, the Department is required to sanction the individual by deducting an amount equal to not less than 25 percent from the TANF assistance that would otherwise be provided to the family of the individual, and may deny the family any TANF assistance. Condition: The Department?s Division of Support Enforcement and Recovery (DSER) is responsible for enforcing child support requirements. DSER sends email notifications to TANF personnel when individuals are identified who are not cooperating with child support enforcement requirements. TANF personnel process the sanction request in the Automated Client Eligibility System (ACES). The Office of the State Auditor (OSA) received a list of sanction requests from the Department for testing purposes. The Department provided a list from both DSER and ACES: ? The DSER list did not include all TANF-related sanction requests and included sanction requests for clients on programs other than TANF. ? The ACES list only included sanction requests that were processed by TANF personnel. Therefore, sanction requests that were made and not processed were omitted from this list. As a result, OSA was unable to obtain a complete listing from which to test a sample of DSER sanction requests. In addition, our review found three sanction requests that were not processed by TANF personnel. Context: In fiscal year 2020, DSER provided a list of 517 sanction requests and the TANF program provided a list of 373 sanction requests. Cause: ? Lack of adequate procedures ? Lack of supervisory oversight Effect: ? Noncompliant clients may be paid benefits that they are not entitled to receive. ? Failure to comply with sanction requirements may result in the U.S. Department of Health and Human Services penalizing the State for up to five percent of the grant award. Recommendation: We recommend that the Department implement procedures to ensure that all sanction requests received from DSER are processed accordingly. We further recommend that procedures be implemented to ensure that complete sanction requests are maintained, reviewed and reconciled throughout the year. Corrective Action Plan: See F-16 Management?s Response: The Department disagrees with the conditions cited in this finding. OFI has acknowledged, and continues to acknowledge, three exception cases that were not completed in a timely manner by OFI personnel. Contact: Anthony Pelotte, Director, Office for Family Independence, DHHS, 207-624-4104 Auditor?s Concluding Remarks: Without identifying the specific conditions to which the Department disagrees, OSA is unable to provide additional information in response to Department?s disagreement. The Department acknowledged that three cases were not processed by TANF personnel. The finding remains as stated. (State Number: 20-1111-08)