State of VermontState Government

Reference Number: 2025-003 Prior Year Finding: 2024-003 Federal Agency: U.S. Department of Agriculture State Agency: Agency of Agriculture Federal Program: Dairy Business Innovation Initiatives Assistance Listing Number: 10.176 Award Number and Year: 21DBIVT1004 (10/31/2021 – 10/30/2024), AM22DBIVT1015 (9/30/2022 – 9/29/2025), AM21DBIVT1011 (9/30/2022 – 9/29/2026), Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. On March 8, 2025, FSRS.gov was retired, and all subaward reporting data and functionality transitioned to SAM.gov after that date. The following key data elements must be reported: Subawardee Name and Data Universal Numbering System (DUNS) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $30,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: Subawards issued by the Agency of Agriculture (Agency) were not reported in accordance with FFATA requirements. Context: Sixteen subaward transactions were selected for testing, and the following exceptions were noted: • Two of sixteen subawards selected for testing were not reported to SAM.gov until after they were selected for testing by auditors. The subawards were issued in January 2022 and May 2024 but were not reported to SAM.gov until February 2026. • Six of sixteen subawards selected for testing were not reported timely. The subawards were issued from September 2024 through January 2025 but were not reported to SAM.gov until March 2025 and September 2025, or from 71 to 212 days late. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE Cause: The Agency had not completed implementation of its corrective action plan from the prior audit year. The Agency’s procedures and controls are not sufficient to ensure that subawards are reported to SAM.gov in accordance with FFATA reporting requirements. Effect: Subawards were not reported to FSRS in accordance with FFATA requirements. Questioned costs: None noted. Recommendation: We recommend the Agency complete implementation of its corrective action plan from the prior year. It should review its procedures and internal controls to ensure that all required subawards and subaward modifications are reported timely to SAM.gov in accordance with FFATA requirements and that all previously issued subawards are reported. Views of responsible officials: Management agrees with the finding.

Reference Number: 2025-004 Prior Year Finding: 2024-004 Federal Agency: U.S. Department of Agriculture State Agency: Agency of Human Services Federal Program: SNAP Cluster Assistance Listing Number: 10.551, 10.561 Award Number and Year: 4VT402513 (10/1/2023 – 9/30/2024) 4VT433933 (10/1/2023 – 9/30/2026) 4VT437533 (10/1/2023 – 9/30/2025) Compliance Requirement: Special Tests and Provisions – ADP System for SNAP Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or specific requirement: Compliance: State agencies are required to automate their SNAP operations and computerize their systems for obtaining, maintaining, utilizing, and transmitting information concerning SNAP (7 CFR sections 272.10 and 277.18). This includes: (1) processing and storing all case file information necessary for eligibility determination and benefit calculation, identifying specific elements that affect eligibility, and notifying the certification unit of cases requiring notices of case disposition, adverse action and mass change, and expiration; (2) providing an automatic cutoff of participation for households that have not been recertified at the end of their certification period by reapplying and being determined eligible for a new period (7 CFR sections 272.10(b)(1)(iii) and 273.10(f) and (g)); and (3) generating data necessary to meet federal issuance and reconciliation reporting requirements. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: Eligibility case reviews performed by the Agency of Human Services (Agency) were untimely and lacked proper documentation. Context: The Agency has implemented an Automated Data Processing (ADP) system referred to as the ACCESS system that is utilized in the eligibility determination process of many programs, including SNAP. ACCESS is used to process and store all case file information for eligibility determination and benefit calculations, it automatically terminates household eligibility at the end of their certification period unless recertified and provides data necessary to meet Federal issuance and reconciliation reporting requirements. Sixty participants were selected for testing and the following exceptions were noted: • 6 of 60 participants selected for testing were not reviewed timely. A minimum of four case reviews must be performed by each district in the month in which the applicant is determined eligible in ACCESS. • For 9 of 60 participants selected for testing, supervisory review and verification of the applicants’ eligibility was not dated by the supervisor. • For 2 of 60 participants selected for testing, the reviewer did not check to see if edits were made after the review was performed. Reviewers are required to check to verify that corrective actions were taken. Cause: The Agency’s procedures were not sufficient to ensure that eligibility case reviews were performed timely and were properly documented. Internal controls did not detect or prevent the errors. Effect The failure to perform eligibility case reviews timely and accurately could result in an ineligible applicant receiving benefits. Questioned costs: Undetermined. Recommendation: We recommend that the Agency review and enhance procedures and controls to ensure that eligibility case reviews are performed timely, accurately, and are properly documented. Views of responsible officials: Management agrees with the finding.

Reference Number: 2025-005 Prior Year Finding: No Federal Agency: U.S. Department of Housing and Urban Development State Agency: Agency of Commerce and Community Development Federal Program: Community Development Block Grants/State's Program and Non-Entitlement Grants in Hawaii Assistance Listing Number: 14.228 Award Number and Year: B-20-RH-50-0001 (1/17/2022 - 2/1/2029) B-22-RH-50-0001 (3/27/2023 - 9/1/2029) B-23-RH-50-0001 (7/1/2023 - 9/1/2030) B-22-DC-50-0001 (7/1/2022 - 9/1/2029) Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. On March 8, 2025, FSRS.gov was retired, and all subaward reporting data and functionality transitioned to SAM.gov after that date. The following key data elements must be reported: Subawardee Name and Data Universal Numbering System (DUNS) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $30,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Agency of Commerce and Community Development (Agency) did not report subaward dates in accordance with FFATA requirements. Context: Two of eight subawards selected for testing were not reported accurately in accordance with FFATA requirements. The subawards with incorrect subaward action dates totaled $615,195. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE Cause: The Agency’s procedures and controls are not sufficient to ensure that subawards are reported to SAM.gov in accordance with FFATA reporting requirements. Effect: Subawards were not reported in accordance with FFATA requirements. Questioned costs: None noted. Recommendation: We recommend the Agency review its procedures and internal controls to ensure that all required subawards and subaward modifications are reported in accordance with FFATA requirements. Views of responsible officials: Management agrees with the finding.

Reference Number: 2025-006 Prior Year Finding: 2024-008 Federal Agency: Department of Labor State Agency: Vermont Department of Labor Federal Program: Unemployment Insurance Assistance Listing Number: 17.225 Award Number and Year: 25A55UI000119 (10/1/2024 – 12/31/2027) 24A55UI000063 (10/1/2023 – 12/31/2026) UI370952155A50 (9/1/2021 – 5/22/2025) 23A60UB000019 (8/3/2023 – 5/22/2025) 23A60UB000024 (4/1/2023 – 5/22/2025) 24A60UD000052 (8/20/2024 – 8/20/2027) UI347462055A50 (8/20/2024 – 8/20/2027) 23A60UD000013 (7/14/2023 – 7/14/2026) 25A60UD000067 (10/1/2024 – 9/30/2027) Compliance Requirement: Reporting Type of Finding: Material Weakness in Internal Control over Compliance Criteria or specific requirement: Compliance: ETA 9050, Time Lapse of All First Payments except Workshare – The ETA 9050 report contains monthly information on first payment time lapse. This report concerns the time it takes states to pay benefits to claimants for the first compensable week of unemployment. That data addressed first payment time lapse for total unemployment only. The report is submitted electronically to the ETA National Office on the 20th of the month following the month to which the data relates. ETA 9052, Nonmonetary Determination Time Lapse Detection - The ETA 9052 report contains monthly information on the time it takes states to issue nonmonetary determinations from the date the issues are first detected by the agency. Single-claimant and multi-claimant nonmonetary determinations are included in the report. Nonmonetary determinations made by organizational units such as Benefits Accuracy Measurement (BAM) and Benefit Payment Control (BPC) are also included in the report. Note: Overpayment notices on uncontested earnings detected by any method (e.g., crossmatch) should not be included. The report is submitted electronically to the ETA National Office on the 20th of the month following the month to which the data relates. ETA 9055, Appeals Case Aging - The ETA 9055 report gathers monthly information on the inventory of lower authority and higher authority single claimant appeals cases that have been filed but not decided. Appeals case aging provides information about the number of days from the date an appeal was filed through the end of the month covered by the report. Also included are the average and median ages of the pending single claimant appeals cases. The report is submitted electronically to the ETA National Office on the 20th of the month following the month to which the data relates. Internal Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with the guidance in "Standards for Internal Control in the Federal Government" issued by the Comptroller General of the United States or the "Internal Control-Integrated Framework," issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Labor (the Department) was not able to provide support that reports had been reviewed and approved by an authorized State official prior to submission. Context: We selected for testing monthly reports for October 2024, November 2024, January 2025 and May 2025 and the following exceptions were noted: ETA 9050: Support could not be provided that 4 of 4 reports selected for testing had been reviewed and approved prior to submission. ETA 9052: Support could not be provided that 4 of 4 reports selected for testing had been reviewed and approved prior to submission. ETA 9055: Support could not be provided that 4 of 4 reports selected for testing had been reviewed and approved prior to submission. Cause: The Department does not have sufficient internal controls to ensure that reports were reviewed and approved prior to submission. Effect: A lack of review and approval of reports could allow incorrect data to be reported which could misrepresent the State’s financial and programmatic performance in the program. Questioned costs: Undetermined. Recommendation: We recommend that policies and procedures be implemented to ensure that all reports are reviewed by an authorized State official prior to submission and that supporting documentation providing evidence of supervisory review is maintained and available for audit. Views of responsible officials: Management agrees with the finding.

Reference Number: 2025-007 Prior Year Finding: 2024-010 Federal Agency: U.S. Department of Labor State Agency: Vermont Department of Labor Federal Program: Unemployment Insurance Assistance Listing Number: 17.225 Award Number and Year: 25A55UI000119 (10/1/2024 – 12/31/2027) Compliance Requirement: Period of Performance Type of Finding: Material Weakness in Internal Control over Compliance, Material Noncompliance Criteria or specific requirement: Compliance: A non-federal entity may charge only allowable costs incurred during the approved budget period of a federal award’s period of performance and any costs incurred before the federal awarding agency or pass-through entity made the federal award that were authorized by the federal awarding agency or pass-through entity (2 CFR sections 200.308 200.309 and 200.403(h)). A period of performance may contain one or more budget periods. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Labor (Department) charged costs to the federal grant prior to the allowable start of the period of performance and expenditures were missing evidence of approval prior to issuance of payment. Context: Nine of sixty transactions selected for testing were charged to the award before the allowable period of performance. The grant award start date was October 1, 2024, but costs were incurred in August and September 2024. Two of sixty transactions selected for testing were missing evidence of review and approval prior to issuance of the payment. Cause: The Department’s procedures and internal controls were not operating sufficiently to ensure that expenditures charged to the program were incurred within the award’s period of performance nor that payments were reviewed and approved prior to issuance. Effect: Unallowable costs were charged to the program. Questioned costs: $2,267, which represents the total incurred before the allowable period of performance. Recommendation: We recommend the Department review and enhance its procedures and controls to ensure that, prior to charging costs to the program, they are incurred within an award’s allowable period of performance and that payments are reviewed and approved by a supervisor who has knowledge of costs that are allowable under the program. Views of responsible officials: Management agrees with the finding.

Reference Number: 2025-008 Prior Year Finding: No Federal Agency: U.S. Department of Labor State Agency: Department of Labor Federal Program: Unemployment Insurance Assistance Listing Number: 17.225 Award Number and Year: 23A60UI038010 (1/1/2022 – 9/30/2024) 23A60UR000010 (1/1/2023 – 9/30/2025) 24A60UR000093 (1/1/2024 – 9/30/2026) Compliance Requirement: Special Tests and Provisions: UI Reemployment Programs: RESEA Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: Per 42 U.S. Code § 506 (a) The Secretary of Labor (in this section referred to as the “Secretary”) shall award grants under this section for a fiscal year to eligible States to conduct a program of reemployment services and eligibility assessments for individuals referred to reemployment services as described in section 503(j) of this title for weeks in such fiscal year for which such individuals receive unemployment compensation. Further, per 42 U.S. Code § 506 (c) (1), In carrying out a State program of reemployment services and eligibility assessments using grant funds awarded to the State under this section, a State shall use such funds only for interventions demonstrated to reduce the number of weeks for which program participants receive unemployment compensation by improving employment outcomes for program participants. The UI program serves as one of the principal “gateways” to the workforce system. It is often the first workforce program accessed by individuals who need workforce services. The Worker Profiling and Reemployment Services (WPRS) and Reemployment Services and Eligibility Assessments (RESEA) programs serve as UI’s primary programs that facilitate the reemployment needs of UI claimants. RESEA is authorized by Section 306 of the Social Security Act and builds on the success of RESEA’s predecessor, the former UI Reemployment and Eligibility Assessment (REA) program. RESEA uses an evidence-based integrated approach that combines an eligibility assessment for continuing UI eligibility and the provision of reemployment services. State administration of the RESEA is voluntary and under certain circumstances may be designed to also satisfy WPRS requirements. Operating guidance for the RESEA program is updated annually. UIPL 10-22 provides RESEA operating Guidance for FY 2022. RESEA-related performance reports are due on the 20th day of the second month following the end of the reporting quarter. A state UI staff member must review these reports for accuracy each calendar quarter and prior to submission, in addition to being reviewed by the RESEA program lead (if a different staff member). Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Labor (Department) did not follow proper procedures nor did it thoroughly document RESEA cases. Context: For two of forty cases selected for testing, the Department did not follow proper procedures. The cases were both identified as “Failed to Report” and the Department did not properly document the cases, it did not send the cases to adjudication, nor were eligibility review forms completed. Questioned costs: Undetermined. Cause: The Department’s internal controls were not sufficient to ensure it followed procedures and met RESEA program requirements. Effect: Failure to properly document or follow-up on RESEA cases in accordance with its own procedures and program requirements could delay the participants’ reentry into the workforce and prolong their receipt of unemployment benefits. Recommendation: The Department should update its internal controls to ensure that RESEA procedures are followed, that cases are properly documented and appropriate actions are taken when participants fail to meet program requirements. Views of responsible officials: Management agrees with the finding.

Reference Number: 2025-009 Prior Year Finding: 2024-009 Federal Agency: U.S. Department of Labor State Agency: Vermont Department of Labor Federal Program: Unemployment Insurance Assistance Listing Number: 17.225 Award Number and Year: 25A55UI000119 (10/1/2024 – 12/31/2027) UI370952155A50 (9/1/2021 – 5/22/2025) 23A60UB000019 (8/3/2023 – 5/22/2025) 24A60UD000052 (8/20/2024 – 8/20/2027) Compliance Requirement: Allowable Costs/Cost Principles Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Compliance: 2 CFR section 200.403 states, in part, except where otherwise authorized by statute, costs must meet the following general criteria in order to be allowable under Federal awards: (a) Be necessary and reasonable for the performance of the Federal award and be allocable thereto under these principles. (b) Conform to any limitations or exclusions set forth in these principles or in the Federal award as to types or amount of cost items. (c) Be consistent with policies and procedures that apply uniformly to both federally-financed and other activities of the non-Federal entity. (d) Be accorded consistent treatment. A cost may not be assigned to a Federal award as a direct cost if any other cost incurred for the same purpose in like circumstances has been allocated to the Federal award as an indirect cost. (e) Be determined in accordance with generally accepted accounting principles (GAAP), except, for state and local governments and Indian tribes only, as otherwise provided for in this part. (f) Not be included as a cost or used to meet cost sharing or matching requirements of any other federally-financed program in either the current or a prior period. (g) Be adequately documented. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Labor (Department) charged costs to the program that were issued without documentation of supervisory review and approval. Context: For two of sixty transactions selected for testing, the Department was unable to provide documentation of supervisory review and approval prior to issuance of payment. Cause: The Department’s procedures were not sufficient to ensure that payments were reviewed and approved prior to issuance of payment. Internal controls did not prevent or detect the errors. Effect: Unallowable costs could be charged to the program if disbursements are not reviewed by a supervisor who is knowledgeable of program regulations regarding allowable costs. Questioned costs: Undetermined. Recommendation: We recommend the Department review and enhance its procedures and controls regarding payment processing to ensure that, prior to charging costs to the program, they are reviewed by a supervisor who is knowledgeable of the regulations regarding allowable program costs and that documentation of the review is maintained. Views of responsible officials: Management agrees with the finding.

Reference Number: 2025-010 Prior Year Finding: No Federal Agency: U.S. Department of Transportation State Agency: Agency of Transportation Federal Program: National Infrastructure Investments Assistance Listing Number: 20.933 Award Number and Year: 69A36520401930BLDVT (8/1/2020 – 10/31/2026) CA0714 (4/29/2022 – 4/29/2032) CA0751 (5/1/2023 – 10/1/2028) CA0906 (1/24/2025 – 11/1/2030) Compliance Requirement: Reporting – Schedule of Expenditure of Federal Awards Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or specific requirement: Compliance: The auditee must prepare a schedule of expenditures of Federal awards (SEFA) for the period covered by the auditee's financial statements. The schedule must include the total Federal awards expended as determined in accordance with § 200.502. Information reported on the SEFA must include a list of individual Federal programs by Federal agency and the applicable Assistance Listing number(s), and a total of the amount expended for each individual Federal program. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Agency of Transportation (Agency) reported federal program expenditures on the SEFA under the wrong Assistance Listing Numbers (ALN). Context: When the Agency compiled its SEFA, it reported $11 million under ALN 20.314-Railroad Development. During the audit, it was determined that expenditures reported under ALN 20.314 should have been $0 and $10.7 million of this amount should have been reported under ALN 20.933-National Infrastructure Investment. Additionally, $312,460 should have been reported under ALN 20.326-Federal-State Partnership for Intercity Passenger Rail, and $6,739 should have been reported under ALN 20.325-Consolidated Rail Infrastructure and Safety Improvements. Cause: The Agency’s procedures were not sufficient to ensure that the SEFA was accurate and that program expenditures were reported under the correct ALNs. The Agency assigned an incorrect ALN to the Expenditure Account associated with these payments in the accounting system which led to the SEFA reporting error. Neither payment processing nor SEFA preparation controls prevented or detected the errors. Effect: The Department’s SEFA did not agree with supporting documentation. The Department understated total expenditures under ALN 20.933 by 51%, under ALN 20.325 by 1%, under ALN 20.326 by 100%, and overstated total expenditures under ALN 20.314 by 100%. Questioned costs: Undetermined. Recommendation: We recommend the Agency review and enhance internal controls and procedures for payment processing and SEFA preparation to ensure that payments are properly coded in the accounting system and that expenditures are reported accurately on the SEFA. Views of responsible officials: Management agrees with the finding.

Reference Number: 2025-011 Prior Year Finding: No Federal Agency: U.S. Department of Transportation State Agency: Agency of Transportation Federal Program: National Infrastructure Investments Assistance Listing Number: 20.933 Award Number and Year: 69A36520401930BLDVT (8/1/2020 – 10/31/2026) CA0714 (4/29/2022 – 4/29/2032) CA0751 (5/1/2023 – 10/1/2028) CA0906 (1/24/2025 – 11/1/2030) Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or specific requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. On March 8, 2025, FSRS.gov was retired, and all subaward reporting data and functionality transitioned to SAM.gov after that date. The following key data elements must be reported: Subawardee Name and Data Universal Numbering System (DUNS) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $30,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Agency of Transportation (Agency) did not report subawards in accordance with FFATA requirements. Context: One of two subawards selected for testing was not reported timely or accurately in accordance with FFATA requirements. Specifically, we noted the following: • The subaward was issued for $7.7 million, but only $560,000 was reported. • The subaward was issued on 7/3/2024 but was not reported until 4/22/2025. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE Cause: The Agency’s procedures and controls were not sufficient to ensure that subawards were reported timely and accurately. Effect: Subawards were not reported in accordance with FFATA requirements. Questioned costs: None noted. Recommendation: We recommend the Agency review its procedures and internal controls to ensure that subawards are reported timely and accurately to SAM.gov in no later than the end of the month following the month of issuance or modification. Views of responsible officials: Management agrees with the finding.

Reference Number: 2025-012 Prior Year Finding: No Federal Agency: U.S. Department of the Treasury State Agency: Agency of Administration Public Service Department Federal Program: COVID-19 – Coronavirus Capital Projects Fund Assistance Listing Number: 21.029 Award Number and Year: CPFFN0202 (2/4/2022 – 12/31/2026) Compliance Requirement: Reporting – Performance Reports Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: Per the State Compliance and Reporting Guidance issued by the Department of the Treasury (Treasury), recipients must submit Performance Reports on a quarterly basis. A Project and Expenditure Report must be completed for each Project included in an approved Program Plan, beginning after a Project has been selected and a subaward has been executed (if applicable). Project and Expenditure Reports will be due each quarter thereafter for the remainder of the period of performance to continue to collect performance data. Additionally, to provide public transparency, Treasury will seek information from Recipients regarding their plans and practices related to promoting on-time and on-budget delivery related to CPF Projects. The following information must be submitted with respect to the use of CPF funds during the period covered in Project and Expenditure Reports: Administrative Expenses and Program Budget Updates. The following information will be required in Project and Expenditure Reports for each Project: Project Information, Obligations and Expenditures, Project Status, Special Statutory Matching Funds Requirements, Labor, Required Performance Indicators and Project Data. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Agency of Administration (Agency) and the Department of Public Service (Department), Vermont Community Broadband Board (VCBB), were unable to provide supporting documentation for administrative costs reported on the Quarterly Performance Reports. Context: For two of two Quarterly Performance Reports selected for testing, support for administrative expenses was provided, however the data consisted of VCBB’s actual administrative expenditures combined with the Department of Libraries total drawdown amounts for the quarter rather than actual expenditures incurred. This method caused administrative expenses in the Treasury report to be misstated in the quarters tested during FY 2025. The Performance reports are prepared by VCBB using the compiled data, and the Agency oversees program activities, including reporting. Administrative Expense key line items are: current period obligations, cumulative obligations, current period expenditures, and cumulative expenditures. Cause: The Department’s procedures and internal controls were not sufficient to ensure that it maintained consistency of supporting documentation for the administrative expenses it reported on the Quarterly Performance Reports. The Agency’s controls for oversight of the program were not sufficient to ensure that Quarterly Performance Reports were accurate and agreed with supporting documentation. Effect: The accuracy of the reported administrative expenses could not be verified. Questioned costs: Undetermined. Recommendation: We recommend the Department and the Agency review their respective procedures and internal controls to ensure that Quarterly Performance Reports are accurate, are supported by documentation, and that supporting documentation is maintained and is readily available for audit. Views of responsible officials: Management agrees with the finding.

Reference Number: 2025-013 Prior Year Finding: No Federal Agency: U.S. Department of the Treasury State Agency: Public Service Department Department of Libraries Federal Program: COVID-19 – Coronavirus Capital Projects Fund Assistance Listing Number: 21.029 Award Number and Year: CPFFN0202 (2/4/2022 – 12/31/2026) Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. On March 8, 2025, FSRS.gov was retired, and all subaward reporting data and functionality transitioned to SAM.gov after that date. The following key data elements must be reported: Subawardee Name and Data Universal Numbering System (DUNS) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $30,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Public Service Department and the Department of Libraries (the Departments) did not report subawards timely in accordance with FFATA requirements. Context: Five of five subawards selected for testing were not reported timely in accordance with FFATA requirements. One subaward issued by the Department of Libraries and four subawards issued by the Public Service Department were selected for testing and we noted the following exceptions: • Department of Libraries: 1 of 1 subaward was not reported timely. The subaward was issued on 9/23/2024 but was not reported until 3/31/2025. • Public Service Department: 4 of 4 subawards were not reported timely. The subawards were issued from January to December 2024 but were not reported until 3/31/2025 and 4/1/2025. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE Cause: The Departments indicated that technical limitations in the FSRS system prevented timely subaward reporting. After FFATA reporting transitioned to SAM.gov in March 2025, they were able to access the system and submit the previously unreported subawards. Effect: Subawards were not reported timely in accordance with FFATA requirements. Questioned costs: None noted. Recommendation: We recommend the Departments’ review their procedures and internal controls to ensure that subawards are reported timely to SAM.gov in accordance with FFATA requirements. Views of responsible officials: Management agrees with the finding.

Reference Number: 2025-014 Prior Year Finding: No Federal Agency: U.S. Environmental Protection Agency State Agency: Department of Environmental Conservation Federal Program: Drinking Water Sate Revolving Fund Assistance Listing Number: 66.468 Award Number and Year: 99121S23 (10/1/2023 – 9/30/2030) 99121E23 (10/1/2023 – 9/30/2030) Compliance Requirement: Reporting – Schedule of Expenditure of Federal Awards Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or specific requirement: Compliance: The auditee must prepare a schedule of expenditures of Federal awards (SEFA) for the period covered by the auditee's financial statements. The schedule must include the total Federal awards expended as determined in accordance with § 200.502. Information reported on the SEFA must include a list of individual Federal programs by Federal agency and the applicable Assistance Listing number(s), and a total of the amount expended for each individual Federal program. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Environmental Conservation (Department) reported federal program expenditures on the SEFA under the wrong Assistance Listing Number (ALN). Context: During audit test work, auditors determined that $3.8 million reported on the SEFA under ALN 66.468-Drinking Water State Revolving Fund should have been reported under 66.458-Clean Water State Revolving Fund. This error was made in both total expenditures and the amount passed through to subrecipients. Correction of the reporting error increased total expenditures reported in ALN 66.458 by 32% and decreased total expenditures reported in ALN 66.468 by 7%. Cause: The Department’s procedures were not sufficient to ensure that the SEFA was accurate and that program expenditures were reported under the correct ALNs. Internal controls did not prevent or detected the errors. Effect: The Department’s SEFA did not agree with supporting documentation. The Department overstated total expenditures under ALN 66.468 by 7% and underreported total expenditures under ALN 66.458 by 32%. Questioned costs: None noted. Recommendation: We recommend the Department review and enhance internal controls and procedures for SEFA preparation to ensure that expenditures are reported accurately on the SEFA. Views of responsible officials: Management agrees with the finding.

Reference Number: 2025-015 Prior Year Finding: No Federal Agency: U.S. Department of Education State Agency: Agency of Human Services Federal Program: Rehabilitation Services – Vocational Rehabilitation Grants to States Assistance Listing Number: 84.126 Award Number and Year: H126A240067 (10/1/2023 – 9/30/2025) H126A240068 (10/1/2023 – 9/30/2025) Compliance Requirement: Reporting – Case Services Report (RSA-911) Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: Grantees are required to submit the Case Service Report (RSA-911) on a quarterly basis no later than 45 days after the end of each quarter. Supporting documentation must be included in the service record or case management system for the required data elements pursuant to 34 CFR 361.47 and consistent with federal requirements at 2 CFR 200.303. Dates reported in the case management system must match the supporting documentation. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: Case Service Reports submitted by the Agency of Human Services (Agency) did not agree with supporting documentation. Context: For 3 of 40 cases selected for testing, the Date of Initial Individualized Plan for Employment (IPE) (element 398) did not agree with supporting documentation. Cause: The Agency’s procedures were not sufficient to ensure that Case Service Reports were accurately prepared. Internal controls regarding review and approval of financial reports prior to submission were not sufficient to prevent or detect the errors. Effect: The reported Date of IPE for several cases did not agree with supporting documentation. Questioned costs: Undetermined. Recommendation: We recommend the Agency review and enhance internal controls and procedures to ensure that Case Service Reports are accurate and agree with supporting documentation. The reviewer should verify that reports are tied to supporting documentation before they are approved and submitted. Views of responsible officials: Management agrees with the finding.

Reference Number: 2025-016 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Agency of Human Services Federal Program: COVID-19 - Epidemiology and Laboratory Capacity for Infectious Diseases (ELC) Assistance Listing Number: 93.323 Award Number and Year: 19NU50CK000520 (8/1/2019 – 7/31/2027) Compliance Requirement: Reporting – Financial Reports Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: Grantees are required to submit annual and final SF-425 Financial Reports which report total funds obligated and expended. Annual financial reports are due within 90 days after the end of the budget period and final financial reports are due within 120 days after the end of the period of performance. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: Financial reports submitted by the Agency of Human Services (Agency) did not agree with supporting documentation. Context: Four quarterly financial reports were selected for testing, consisting of two reports for the base award and two for COVID funding for the 12/31/2024 and 3/31/2025 quarters. Specifically, we noted the following exceptions in the COVID funding reports: • For 2 of 4 quarterly reports selected for testing, the amounts reported on multiple line items did not tie to supporting documentation. • In the 12/31/2024 quarterly report, current quarter expenditures were not included in the amount reported. Cause: The Agency’s procedures were not sufficient to ensure that financial reports were accurately prepared. Internal controls regarding review and approval of financial reports prior to submission were not sufficient to prevent or detect the errors. Effect: The expenditure amounts reported did not agree with supporting documentation. Questioned costs: Undetermined Recommendation: We recommend the Agency review and enhance internal controls and procedures to ensure that financial reports are accurate and agree with supporting documentation. The reviewer should verify that reports are tied to supporting documentation before they are approved and submitted. Views of responsible officials: Management agrees with the finding.

Reference Number: 2025-017 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Agency of Human Services Federal Program: COVID-19 - Activities to Support State, Tribal, Local and Territorial (STLT) Health Department Response to Public Health or Healthcare Crises Assistance Listing Number: 93.391 Award Number and Year: NH75OT000034 (6/1/2021 – 3/24/2025) Compliance Requirement: Procurement Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: The State’s procurement policy, Administrative Bulletin No. 3.5 – Procurement and Contracting Procedures, requires Vermont State agencies and departments to competitively procure goods and services which includes using a competitive bidding process and performing an analysis of the cost-effectiveness of the procurement. Per 2 CFR section 200.219, the non-Federal entity must conduct all procurement transactions in a manner providing full and open competition. Per 2 CFR section 200.324(a), the non-Federal entity must perform a cost or price analysis in connection with every procurement action in excess of the Simplified Acquisition Threshold including contract modifications. The method and degree of analysis is dependent on the facts surrounding the particular procurement situation, but as a starting point, the non-Federal entity must make independent estimates before receiving bids or proposals. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Agency of Human Services (Agency) did not meet all requirements of state and federal procurement policies when entering into a contract with a vendor. Context: For one of five contracts selected for testing, the Agency was unable to provide documentation that it had performed a cost analysis prior to finalizing the contract. A cost analysis is required by both state and federal regulations. Cause: The Agency’s procedures were not sufficient to ensure that it maintained documentation that a cost analysis was performed as part of the procurement process. Internal controls did not detect or prevent the error. Effect: Failure to perform a cost analysis could result in the Agency procuring goods or services that are not cost-effective nor in the best interest of the Agency or the program. Questioned costs: Undetermined. Recommendation: We recommend the Agency review and enhance internal controls and procedures to ensure that it maintains documentation that it performs a cost analysis for all procurement actions in accordance with Agency of Administration Bulletin No. 3.5 and federal requirements. Views of responsible officials: Management agrees with the finding.

Reference Number: 2025-018 Prior Year Finding: 2024-018 Federal Agency: U.S. Department of Health and Human Services State Agency: Agency of Human Services Federal Program: COVID-19 - Activities to Support State, Tribal, Local and Territorial (STLT) Health Department Response to Public Health or Healthcare Crises Assistance Listing Number: 93.391 Award Number and Year: NH75OT000034 (6/1/2021 – 3/24/2025) Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. On March 8, 2025, FSRS.gov was retired, and all subaward reporting data and functionality transitioned to SAM.gov after that date. The following key data elements must be reported: Subawardee Name and Data Universal Numbering System (DUNS) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $30,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: Subawards were not reported in accordance with FFATA requirements. Context: Two of fifteen subawards and subaward amendments selected for testing were not reported in accordance with FFATA requirements. The subawards were not reported until after they were selected by auditors for review. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE As part of a prior year Corrective Action Plan (CAP), the Agency implemented a process to report required subawards timely and to review previously issued subawards to ensure that all subawards were reported. The subaward exceptions noted were issued prior to the full implementation of the CAP. Cause: The Agency’s procedures and controls were not sufficient to ensure that subawards were reported in accordance with FFATA reporting requirements. Effect: Subawards were not reported in accordance with FFATA requirements. Questioned costs: None noted. Recommendation: We recommend the Agency complete implementation of its prior year CAP to ensure that all required subawards and subaward modifications are reported timely in accordance with FFATA requirements and that all previously issued subawards are reported. Views of responsible officials: Management agrees with the finding.

Reference Number: 2025-019 Prior Year Finding: 2024-020 Federal Agency: U.S. Department of Health and Human Services State Agency: Agency of Human Services Federal Program: CCDF Cluster Assistance Listing Number: 93.575, 93.596 Award Number and Year: 2401VTCCDD (10/1/2023 – 9/30/2026) 2501VTCCDD (10/1/2024 – 9/30/2027) Compliance Requirement: Special Tests and Provisions – Health and Safety Requirements Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or specific requirement: Compliance: Lead Agencies must certify that procedures are in effect (e.g., monitoring and enforcement) to ensure that providers serving children who receive subsidies comply with all applicable health and safety requirements. This includes verifying and documenting that child care providers (unless they meet an exception, e.g., family members who are caregivers or individuals who object to immunization on certain grounds) serving children who receive subsidies meet requirements pertaining to health and safety. These requirements must address eleven specific areas—including first aid and CPR, safe sleeping practices, and administration of medication—and child care workers must be trained in these areas (42 USC 9858c(c)(2)(I); 45 CFR section 98.41). Per 45 CFR 98.44(b), a Lead Agency must describe in the State Plan its established requirements for pre-service or orientation (to be completed within three months) and ongoing professional development for caregivers, teachers, and directors of child care providers of services for which assistance is provided under the CCDF that, to the extent practicable, align with the State framework. Accessible pre-service or orientation training in health and safety standards appropriate to the setting and age of children served addresses: (i) Each of the requirements relating to matters described in §98.41(a)(1)(i) through (xi) and specifying critical health and safety training that must be completed before caregivers, teachers, and directors are allowed to care for children unsupervised; (ii) At the Lead Agency option, matters described in § 98.41(a)(1)(xii); and (iii) Child development, including the major domains (cognitive, social, emotional, physical development and approaches to learning); Control: Per 45 CFR Part 98, Child Care and Development Fund recipients must establish and maintain robust internal controls to ensure integrity and accountability of program funds. Recipients must implement procedures designed to investigate and recover fraudulent payments, to impose sanctions on clients or providers in response to fraud, document and verify eligibility, and promote compliance with all applicable laws and regulations. These internal control mechanisms serve to prevent misuse, mismanagement, or fraudulent activity, thereby fostering accountability and transparency in the stewardship of federal funds allocated through the CCDF program. Condition: The Agency of Human Services (Agency) did not ensure that all providers completed required annual training nor that training in health and safety standards addressed the required eleven elements per 45 CFR sections 98.41 and 98.44(b)(1). Context: Nine child care providers were selected for testing and multiple exceptions were noted, including incomplete documentation, lack of training covering all required health and safety topics, and ineffective monitoring controls. Specifically, we noted the following: • For 9 of 9 child care providers selected for testing, the Agency’s provider training did not include all eleven of the required health and safety topics. The HHS Administration for Children & Families, Office of Child Care’s (OCC) monitoring report indicated that training for some of the eleven required health and safety topics was not provided. Since the Agency did not offer training for all required elements, no providers were able to meet this requirement. • For 5 of 9 child care providers selected for testing, the Agency was unable to provide documentation it had ensured the providers completed the required 15 hours of annual training. There was a lack of documentation that training requirements were reviewed as part of the annual site visit and insufficient documentation in provider corrective action plans. Cause: The Agency’s procedures were insufficient to ensure complete monitoring documentation of child care provider training. Training content did not include all 11 required health and safety topics. Internal controls did not detect or prevent these errors. Effect Deficiencies in the content and monitoring of provider health and safety training could result in inadequately trained child care providers, creating a risk to the health and safety of children receiving subsidies under the program. Questioned costs: None noted. Recommendation: We recommend that the Agency review and enhance training monitoring procedures and controls to ensure that all child care providers complete required health and safety training. The Agency should update its training content to include all required elements and ensure that provider corrective action plans and documentation are properly maintained. Site visit documentation should clearly indicate the results of training requirement monitoring. Views of responsible officials: Management agrees with the finding.

Reference Number: 2025-020 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Agency of Human Services Federal Program: Foster Care – Title IV-E Assistance Listing Number: 93.658 Award Number and Year: 2401VTFOST (10/1/2023 – 9/30/2025) 2501VTFOST (10/1/2024 – 9/30/2026) Compliance Requirement: Eligibility Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or specific requirement: Compliance: The Foster Care program has established eligibility requirements for foster children who receive benefits under the program and for licensed foster care providers. Foster care benefits may be paid on behalf of a child only if all program eligibility requirements are met. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Agency of Human Services (Agency) claimed Foster Care expenses on behalf of children who were not eligible for the program. Context: Auditors selected forty children on whose behalf Foster Care payments were made during FY 2025. Seven of the forty children were determined not to be eligible for Foster Care. The Agency uses the Child Development Division Information System (CDDIS) to manage case data and eligibility for multiple federal programs. Due to a coding error, the children were incorrectly identified in CDDIS as Foster Care eligible. Cause: The Agency’s procedures were not sufficient to ensure that cases in CDDIS were coded to the eligible federal program nor that payments were charged to the correct federal program. Internal controls did not prevent or detect the errors. Effect The Agency claimed Foster Care expenses on behalf of children who were not eligible for the program. Questioned costs: Undetermined. Recommendation: We recommend that the Agency review and enhance procedures and controls to ensure that it correctly identifies the eligible federal program for all cases coded in CDDIS. We further recommend that children on whose behalf payments are charged to Foster Care are eligible for benefits under the program. Views of responsible officials: Management agrees with the finding.

Reference Number: 2025-021 Prior Year Finding: 2024-024 Federal Agency: U.S. Department of Health and Human Services State Agency: Agency of Human Services Federal Program: Medicaid Cluster Assistance Listing Number: 93.775, 93.777, 93.778 Award Number and Year: 2405VT5MAP (10/1/2023 – 9/30/2024) 2505VT5MAP (10/1/2024 – 9/30/2025) Compliance Requirement: Special Tests and Provisions - Provider Health and Safety Standards Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: Providers must meet the prescribed health and safety standards for hospital, nursing facilities, and ICF/IID (42 CFR part 442). The standards may be modified in the State Plan. The Medicaid Provider Enrollment Compendium (MPEC) requires that State Medicaid Agencies perform screening of providers based upon their risk level. Screening includes verifications of licenses and compliance with all federal and state regulations of the program. Control: Per 2 CFR section 200.303(a), the non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Agency of Human Services (Agency) did not maintain documentation to support providers’ compliance with the prescribed health and safety standards. Provider health and safety requirements are administered by a 3rd-party that determines and documents providers’ eligibility with the Agency’s requirements in the provider management module (PMM). Context: Sixty providers were selected for testing, and the following exceptions were noted: • For five of sixty providers selected for testing, documentation was incomplete to support that the provider was in good tax standing. The provider’s tax standing was verified by the Agency, but the letter was not signed by the Vermont Tax Department Commissioner and uploaded to the PMM as required. • For one of sixty providers selected for testing, the Agency did not perform a tax standing verification during the provider’s revalidation. Cause: The Agency’s 3rd-Party provider did not consistently maintain verification of tax standing documentation in the PMM. Procedures and controls were not sufficient to ensure that a tax standing verification was performed for all providers during revalidation. Although the Agency indicated it had implemented its corrective action plan from a prior year audit, it noted that exceptions may be identified until all providers have completed their 5-year revalidation by the Agency. Effect: Failure to verify and document compliance with health and safety standards could allow ineligible providers to perform services under the Medicaid program. Questioned costs: Undetermined. Recommendation: We recommend the Agency review procedures and controls and complete implementation of its corrective action plan from a prior audit to ensure that documentation is maintained in accordance with program requirements and that all providers are compliant with required health and safety standards. Views of responsible officials: Management agrees with the finding.

Reference Number: 2024-003 Prior Year Finding: No Federal Agency: U.S. Department of Agriculture State Agency: Agency of Agriculture Federal Program: Dairy Business Innovation Initiatives Assistance Listing Number: 10.176 Award Number and Year: AM200100XXXXG081 (9/30/2020 – 9/30/2024), 21DBIVT1004 (10/31/2021 – 10/30/2024), AM22DBIVT1015 (9/30/2022 – 9/29/2025), AM21DBIVT1011 (9/30/2022 – 9/29/2026), 23DBIVT1018 (9/30/2023 – 9/29/2026) Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or specific requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. The following key data elements must be reported: Subawardee Name and Data Universal Numbering System (DUNS) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $30,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: Subawards issued by the Agency of Agriculture (Agency) were not reported to FSRS in accordance with FFATA requirements. Context: Nine subaward transactions were selected for testing, including eight original subawards and one subaward amendment. Of the nine subawards selected, only one was reported timely in accordance with FFATA requirements. Specifically, we noted the following exceptions: • 1 of 8 original subawards was not reported to FSRS. The subaward was in the amount of $250,000. • 1 of 1 subaward amendment was not reported to FSRS. The subaward was a negative adjustment of $225,445. • 6 of 8 original subawards were not reported to FSRS timely. All subawards were reported on 4/24/2024 but they were issued from 1/27/2021 to 3/21/2024 and were reported from 24 days to 3 years and 2 months late. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE Cause: The Agency did not have procedures and controls in place to ensure that subawards were reported to FSRS in accordance with FFATA reporting requirements. Effect: Subawards were not reported to FSRS in accordance with FFATA requirements. Questioned costs: None noted. Recommendation: We recommend the Agency develop procedures and internal controls to ensure that all required subawards and subaward modifications are reported timely to FSRS in accordance with FFATA requirements and that all previously issued subawards are reported. Views of responsible officials: Management agrees with the finding.

Reference Number: 2024-004 Prior Year Finding: No Federal Agency: U.S. Department of Agriculture State Agency: Agency of Human Services Federal Program: SNAP Cluster Assistance Listing Number: 10.551, 10.561 Award Number and Year: 4VT400406 (10/1/2022 – 9/30/2023) 4VT402513 (10/1/2023 – 9/30/2024) Compliance Requirement: Special Tests and Provisions – ADP System for SNAP Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or specific requirement: Compliance: State agencies are required to automate their SNAP operations and computerize their systems for obtaining, maintaining, utilizing, and transmitting information concerning SNAP (7 CFR sections 272.10 and 277.18). This includes: (1) processing and storing all case file information necessary for eligibility determination and benefit calculation, identifying specific elements that affect eligibility, and notifying the certification unit of cases requiring notices of case disposition, adverse action and mass change, and expiration; (2) providing an automatic cutoff of participation for households that have not been recertified at the end of their certification period by reapplying and being determined eligible for a new period (7 CFR sections 272.10(b)(1)(iii) and 273.10(f) and (g)); and (3) generating data necessary to meet federal issuance and reconciliation reporting requirements. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: Eligibility case reviews performed by the Agency of Human Services (Agency) were untimely and lacked proper documentation. Context: The Agency has implemented an Automated Data Processing (ADP) system referred to as the ACCESS system that is utilized in the eligibility determination process of many programs, including SNAP. ACCESS is used to process and store all case file information for eligibility determination and benefit calculations, it automatically terminates household eligibility at the end of their certification period unless recertified and provides data necessary to meet Federal issuance and reconciliation reporting requirements. Forty participants were selected for testing and the following exceptions were noted: • For 1 of 40 participants selected for testing, the participant was initially determined to be eligible in ACCESS, but when a quality review was performed four months later, the participant was determined to be ineligible. The ineligible participant received benefits for two months before their benefits were terminated. • 5 of 40 participants selected for testing were not reviewed timely. A minimum of four case reviews must be performed by each district in the month in which the applicant is determined eligible in ACCESS. The five exceptions were reviewed in a subsequent month after the applicant was determined eligible. • For 16 of 40 participants selected for testing, supervisory review and verification of the applicants’ eligibility was not dated by the supervisor. Cause: The Agency’s procedures were not sufficient to ensure that eligibility case reviews were performed timely and were properly documented. Internal controls did not detect or prevent the errors. Effect The failure to perform eligibility case reviews timely resulted in an ineligible applicant receiving benefits for two months before it was detected. Questioned costs: $2,296 Recommendation: We recommend that the Agency review and enhance procedures and controls to ensure that eligibility case reviews are performed timely and are properly documented. Views of responsible officials: Management agrees with the finding.

Reference Number: 2024-005 Prior Year Finding: No Federal Agency: U.S. Department of Agriculture State Agency: Agency of Human Services Federal Program: SNAP Cluster Assistance Listing Number: 10.551, 10.561 Award Number and Year: 4VT400406 (10/1/2022 – 9/30/2023) 4VT402513 (10/1/2023 – 9/30/2024) Compliance Requirement: Special Tests and Provisions – EBT Card Security Type of Finding: Significant Deficiency in Internal Control Over Compliance Criteria or specific requirement: Compliance: The state is required to maintain adequate security over, and documentation/records for, EBT cards, to prevent their theft, embezzlement, loss, damage, destruction, unauthorized transfer, negotiation, or use (7 CFR section 274.8(b)(3)). Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: Documentation for the daily/weekly card reconciliations was incomplete. Context: The Agency of Human Services (Agency) prepares the Weekly Card Activity Reconciliation report to document the daily/weekly EBT cards produced, issued or destroyed. This report verifies that the number of cards produced agrees to the number of cards issued and destroyed during the day/week. For 1 of 40 reconciliation reports selected for testing, the count of cards destroyed was not maintained. Cause: The Agency’s internal controls were not sufficient to ensure that the reconciliation of destroyed cards was maintained. Effect Failure to maintain documentation for destroyed cards could result in unauthorized use of EBT cards that are designated for destruction. Questioned costs: Undetermined. Recommendation: We recommend that the Agency review and enhance internal controls to ensure that it maintains documentation of the daily/weekly reconciliation of destroyed EBT cards. Views of responsible officials: Management agrees with the finding.

Reference Number: 2024-006 Prior Year Finding: No Federal Agency: U.S. Department of Agriculture State Agency: Agency of Human Services Federal Program: SNAP Cluster Assistance Listing Number: 10.551, 10.561 Award Number and Year: 4VT400406 (10/1/2022 – 9/30/2023) 4VT402513 (10/1/2023 – 9/30/2024) Compliance Requirement: Procurement Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: The State’s procurement policy, Administrative Bulletin No. 3.5 – Procurement and Contracting Procedures, requires Vermont State agencies and departments to competitively procure goods and services which includes using a competitive bidding process and performing an analysis of the cost-effectiveness of the procurement. Per 2 CFR section 200.219, the non-Federal entity must conduct all procurement transactions in a manner providing full and open competition. Per 2 CFR section 200.324(a), the non-Federal entity must perform a cost or price analysis in connection with every procurement action in excess of the Simplified Acquisition Threshold including contract modifications. The method and degree of analysis is dependent on the facts surrounding the particular procurement situation, but as a starting point, the non-Federal entity must make independent estimates before receiving bids or proposals. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Agency of Human Services (Agency) was unable to provide documentation that it competitively procured a contract nor that a cost analysis was performed. Context: For one of five contracts selected for testing, the Agency was unable to provide documentation that it conducted the procurement using full and open competition, nor that a cost analysis was performed. Cause: The Agency’s procedures were not sufficient to ensure that it maintained documentation that it had competitively procured a contract nor that a cost analysis was performed. Internal controls did not detect or prevent the errors. Effect: Failure to competitively procure a contract and perform a cost analysis could result in the Agency procuring goods or services that are not cost-effective nor in the best interest of the Agency or the program. Questioned costs: Undetermined. Recommendation: We recommend the Agency review and enhance internal controls and procedures to ensure that it maintains documentation that it competitively procures contracts and that it performs a cost analysis for all procurement actions in accordance with Agency of Administration Bulletin No. 3.5 and federal requirements. Views of responsible officials: Management agrees with the finding.

Reference Number: 2024-007 Prior Year Finding: No Federal Agency: U.S. Department of Defense State Agency: Vermont State Military Department Federal Program: National Guard Military Operations and Maintenance (O&M) Projects Assistance Listing Number: 12.401 Award Number and Year: W912LN2421001 (10/1/2023 – 9/20/2024) Compliance Requirement: Period of Performance Type of Finding: Significant Deficiency in Internal Control over Compliance, Other Matters Criteria or specific requirement: Compliance: A non-federal entity may charge only allowable costs incurred during the approved budget period of a federal award’s period of performance and any costs incurred before the federal awarding agency or pass-through entity made the federal award that were authorized by the federal awarding agency or pass-through entity (2 CFR sections 200.308 200.309 and 200.403(h)). A period of performance may contain one or more budget periods. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Vermont State Military Department (Department) charged costs to the federal grant prior to the allowable start of the period of performance. Context: One of five transactions selected for testing was incurred prior to the award’s period of performance. The expense was for a transaction incurred in the month of September 2023 but the award’s period of performance began on 10/1/2023. Cause: The Department’s procedures were not operating sufficiently to ensure that expenditures charged to the program were incurred within the award’s period of performance. Internal controls did not prevent or detect the error. Effect: Costs could be deemed unallowable by the awarding agency if funds are expended outside of the allowable period of performance. Questioned costs: Below the reportable limit. Recommendation: The Department should review and enhance its procedures and internal controls to ensure that it charges expenditures to the program that are incurred within an award’s allowable period of performance. Views of responsible officials: Management agrees with the finding.

Reference Number: 2024-008 Prior Year Finding: 2023-005 Federal Agency: Department of Labor State Agency: Vermont Department of Labor Federal Program: Unemployment Insurance Assistance Listing Number: 17.225 Award Number and Year: State UC, UCFE, UCX, TRA UI393002355A50 (10/2022-9/30/2023), TRA 24A55UT000024 (10/1/2023-9/30/2024), RESEA UI380102260A50 (1/1/2022-9/30/2024) RESEA 23A60UR000010 (1/1/2023-9/30/2025), Admin UI393532355A50 (10/1/2022-12/31/2025), Admin 24A55UI000063 (10/1/2023-12/31/2026), ARPA Fraud UI370952155A50 (9/1/2021-8/31/2025), ARPA Equity UI370952155A50 (10/1/2022-10/31/2025), CARES UI347462055A50 (4/1/2021-6/30/2025), DUA 23A60UD000013 (7/14/2023 - 7/14/2026) Compliance Requirement: Reporting Type of Finding: Material Weakness in Internal Control over Compliance, Material Noncompliance Criteria or specific requirement: Compliance: ETA 9130, Financial Status Report, UI Programs – This report is used to report program and administrative expenditures. All ETA grantees are required to submit quarterly financial reports for each grant award which they operate, including standard program and pilot, demonstration, and evaluation projects. Financial data is required to be reported cumulatively from grant inception through the end of each reporting period. Additional information on OMB Number 1205-0461 can be accessed at http://www.dol.gov/agencies/eta/grants/management and scroll down to the section on Financial Reporting. A separate ETA 9130 is submitted for each of the following: UI, PEUC, and PUA Administration, DUA, TRA/RTAA, and UI Projects (administration and benefits). ETA 191, Financial Status of UCFE/UCX (OMB No. 1205-0162) – Quarterly report on UCFE and UCX expenditures and the total amount of benefits paid to claimants of specific federal agencies (ET Handbook 401). ETA 9050, Time Lapse of All First Payments except Workshare – The ETA 9050 report contains monthly information on first payment time lapse. This report concerns the time it takes states to pay benefits to claimants for the first compensable week of unemployment. That data addressed first payment time lapse for total unemployment only. The report is submitted electronically to the ETA National Office on the 20th of the month following the month to which the data relates. ETA 9052, Nonmonetary Determination Time Lapse Detection - The ETA 9052 report contains monthly information on the time it take states to issue nonmonetary determinations from the date the issues are first detected by the agency. Single-claimant and multi-claimant nonmonetary determinations are included in the report. Nonmonetary determinations made by organizational units such as Benefits Accuracy Measurement (BAM) and Benefit Payment Control (BPC) are also included in the report. Note: Overpayment notices on uncontested earnings detected by any method (e.g., crossmatch) should not be included. The report is submitted electronically to the ETA National Office on the 20th of the month following the month to which the data relates. ETA 9055, Appeals Case Aging - The ETA 9055 report gathers monthly information on the inventory of lower authority and higher authority single claimant appeals cases that have been filed but not decided. Appeals case aging provides information about the number of days from the date an appeal was filed through the end of the month covered by the report. Also included are the average and median ages of the pending single claimant appeals cases. The report is submitted electronically to the ETA National Office on the 20th of the month following the month to which the data relates. Internal Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with the guidance in "Standards for Internal Control in the Federal Government" issued by the Comptroller General of the United States or the "Internal Control-Integrated Framework," issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Labor (the Department) was not able to provide support that it had submitted required financial, performance, and special reports had been reviewed and approved by an authorized State official prior to submission, and the Department was unable to provide supporting documentation that agreed with the data included in the submitted financial reports. Context: We reviewed a sample of the financial and performance reports filed during fiscal year 2024. The following exceptions were noted: ETA 9130: Supporting documentation was insufficient to support the data reported in 2 of 2 quarters reviewed. Support could not be provided that 2 of 2 quarters reviewed had been reviewed and approved prior to submission. ETA 191: Support could not be provided that 2 of 2 reports reviewed had been reviewed and approved prior to submission. ETA 9050: Support could not be provided that 4 of 4 reports reviewed had been reviewed and approved prior to submission. ETA 9052: Support could not be provided that 4 of 4 reports reviewed had been reviewed and approved prior to submission. ETA 9055: Support could not be provided that 4 of 4 reports reviewed had been reviewed and approved prior to submission. Cause: The Department does not have sufficient internal controls in place over compliance with Unemployment Insurance reporting requirements to ensure that reports were accurate, agreed with supporting documentation, and were reviewed and approved prior to submission. Effect: Auditors were unable to verify the accuracy of the financial reports submitted by the Department. A lack of review and approval of financial and performance reports could allow incorrect data to be reported for the program which could misrepresent the State’s financial and programmatic performance in the program. Questioned costs: Undetermined. Recommendation: We recommend that policies and procedures be implemented to ensure that all financial and performance reports are accurate, agree with supporting documentation, and are reviewed by an authorized State official prior to submission. We also recommend that supporting documentation and evidence of supervisory review is maintained and available for audit. Views of responsible officials: Management agrees with the finding.

Reference Number: 2024-009 Prior Year Finding: 2023-007 Federal Agency: U.S. Department of Labor State Agency: Vermont Department of Labor Federal Program: Unemployment Insurance Assistance Listing Number: 17.225 Award Number and Year: DUA 23A60UD000013 (7/14/2023 - 7/14/2026) Compliance Requirement: Allowable Costs/Cost Principles Type of Finding: Significant Deficiency in Internal Control over Compliance, Other Matters Criteria or specific requirement: Compliance: 2 CFR section 200.403 states, in part, except where otherwise authorized by statute, costs must meet the following general criteria in order to be allowable under Federal awards: (a) Be necessary and reasonable for the performance of the Federal award and be allocable thereto under these principles. (b) Conform to any limitations or exclusions set forth in these principles or in the Federal award as to types or amount of cost items. (c) Be consistent with policies and procedures that apply uniformly to both federally-financed and other activities of the non-Federal entity. (d) Be accorded consistent treatment. A cost may not be assigned to a Federal award as a direct cost if any other cost incurred for the same purpose in like circumstances has been allocated to the Federal award as an indirect cost. (e) Be determined in accordance with generally accepted accounting principles (GAAP), except, for state and local governments and Indian tribes only, as otherwise provided for in this part. (f) Not be included as a cost or used to meet cost sharing or matching requirements of any other federally-financed program in either the current or a prior period. (g) Be adequately documented. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Labor (Department) charged costs to the program that were issued without supporting documentation and documentation of supervisory review and approval. Context: Sixty transactions were selected for testing and the following exceptions were noted: • For six of sixty transactions selected for testing, the Department was unable to provide documentation to support the transactions totaling $510. • For six of sixty transactions selected for testing, the Department was unable to provide documentation of supervisory review and approval prior to issuance of payment. Cause: The Department’s procedures were not sufficient to ensure that payments were supported, reviewed, and approved prior to issuance of payment. Internal controls did not prevent or detect the errors. Effect: Unallowable costs could be charged to the program if disbursements are not supported and reviewed by a supervisor who is knowledgeable of program regulations regarding allowable costs. Questioned costs: $510 which represents the total unsupported expenditures. Recommendation: We recommend the Department reviews and enhances its procedures and controls regarding payment processing to ensure that, prior to charging costs to the program, they are supported and reviewed by a supervisor who is knowledgeable of the regulations regarding allowable program costs and that documentation of the review is maintained. Views of responsible officials: Management agrees with the finding.

Reference Number: 2024-010 Prior Year Finding: 2023-008 Federal Agency: U.S. Department of Labor State Agency: Vermont Department of Labor Federal Program: Unemployment Insurance Assistance Listing Number: 17.225 Award Number and Year: Admin 24A55UI000063 (10/1/2023-12/31/2026), DUA 23A60UD000013 (7/14/2023 - 7/14/2026) Compliance Requirement: Period of Performance Type of Finding: Significant Deficiency in Internal Control over Compliance, Other Matters Criteria or specific requirement: Compliance: A non-federal entity may charge only allowable costs incurred during the approved budget period of a federal award’s period of performance and any costs incurred before the federal awarding agency or pass-through entity made the federal award that were authorized by the federal awarding agency or pass-through entity (2 CFR sections 200.308 200.309 and 200.403(h)). A period of performance may contain one or more budget periods. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Labor (Department) charged costs to the federal grant prior to the allowable start of the period of performance. Context: Sixty transactions were selected for testing and the following exceptions were noted: • Five of sixty transactions were charged to the award before the allowable period of performance. The grant award start date was October 1, 2023, but costs were incurred in July, August, and September 2023. Cause: The Department’s procedures and internal controls were not operating sufficiently to ensure that expenditures charged to the program were incurred within the award’s period of performance. Effect: Costs could be deemed unallowable by the awarding agency if funds are expended outside of the allowable period of performance. Questioned costs: $2,980, which represents the total incurred before the allowable period of performance. Recommendation: We recommend the Department review and enhance its procedures and controls to ensure that prior to charging costs to the program, they are incurred within an award’s allowable period of performance. Views of responsible officials: Management agrees with the finding.

Reference Number: 2024-011 Prior Year Finding: No Federal Agency: U.S. Department of Transportation State Agency: Agency of Transportation Federal Program: Highway Planning and Construction Assistance Listing Number: 20.205 Award Number and Year: FFY2023 – FFY2024 Compliance Requirement: Subrecipient Monitoring Type of Finding: Significant Deficiency in Internal Control over Compliance, Other Matters Criteria or specific requirement: Compliance – Per 2 CFR section 200.332, the following requirements are imposed on pass-through entities: (a) Ensure that every subaward is clearly identified to the subrecipient as a subaward and includes information at the time of the subaward and if any of these data elements change, include the changes in subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward. Required information includes: (1) (iii) Federal Award Identification Number (FAIN); (iv) Federal Award Date; (b) Evaluate each subrecipient's risk of noncompliance with Federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate subrecipient monitoring described in paragraphs (d) and (e) of this section, which may include consideration of such factors as: (1) The subrecipient's prior experience with the same or similar subawards; (2) The results of previous audits including whether or not the subrecipient receives a Single Audit in accordance with Subpart F of this part, and the extent to which the same or similar subaward has been audited as a major program; (3) Whether the subrecipient has new personnel or new or substantially changed systems; and (4) The extent and results of Federal awarding agency monitoring (e.g., if the subrecipient also receives Federal awards directly from a Federal awarding agency). (c) Consider imposing specific subaward conditions upon a subrecipient if appropriate as described in § 200.208. (d) Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. Pass-through entity monitoring of the subrecipient must include: (1) Reviewing financial and performance reports required by the pass-through entity. (2) Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the Federal award provided to the subrecipient from the pass-through entity detected through audits, on-site reviews, and written confirmation from the subrecipient, highlighting the status of actions planned or taken to address Single Audit findings related to the particular subaward. (3) Issuing a management decision for applicable audit findings pertaining only to the Federal award provided to the subrecipient from the pass-through entity as required by § 200.521. (4) The pass-through entity is responsible for resolving audit findings specifically related to the subaward and not responsible for resolving crosscutting findings. If a subrecipient has a current Single Audit report posted in the Federal Audit Clearinghouse and has not otherwise been excluded from receipt of Federal funding (e.g., has been debarred or suspended), the pass-through entity may rely on the subrecipient's cognizant audit agency or cognizant oversight agency to perform audit follow-up and make management decisions related to cross-cutting findings in accordance with section § 200.513(a)(3)(vii). Such reliance does not eliminate the responsibility of the pass-through entity to issue subawards that conform to agency and award-specific requirements, to manage risk through ongoing subaward monitoring, and to monitor the status of the findings that are specifically related to the subaward. (e) Depending upon the pass-through entity's assessment of risk posed by the subrecipient (as described in paragraph (b) of this section), the following monitoring tools may be useful for the pass-through entity to ensure proper accountability and compliance with program requirements and achievement of performance goals: (1) Providing subrecipients with training and technical assistance on program-related matters; and (2) Performing on-site reviews of the subrecipient's program operations; (3) Arranging for agreed-upon-procedures engagements as described in § 200.425. Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Vermont Agency of Transportation (VTrans) omitted required federal award information from subawards it issued in the program and did not adequately monitor subrecipients. Context: Nineteen subawards were selected for testing and the following exceptions were noted: • For 16 of 19 subawards selected for testing, the federal award date was not included on the subaward agreement. • For 1 of 19 subawards selected for testing, the last on-site subrecipient monitoring visit was performed in FY 2019 and the next on-site monitoring did not take place until FY 2024. Per the VTrans subrecipient monitoring plan, on-site monitoring must be performed no less than every three years. Cause: Procedures and internal controls were not sufficient to ensure that subawards included all required federal information. Although VTrans subsequently modified its subaward issuance process, controls in effect during the audit period were not sufficient to ensure that subawards included all required information. Procedures and internal controls were also not sufficient to ensure that timely on-site monitoring visits were performed in accordance with its monitoring plan. Effect: Excluding the required federal grant award information at the time of subaward issuance may cause subrecipients and their auditors to be uninformed about specific program and other regulations that apply to the funds they receive. There is also the potential for subrecipients to have incomplete Schedules of Expenditures of Federal Awards (SEFA) in their Single Audit reports. Failure to conduct adequate subrecipient monitoring may result in a failure of VTrans to detect that subawards are used for unauthorized purposes, are managed in violation of the terms and conditions of the subawards, or that subaward performance goals are not achieved. There is an increased risk that subrecipients could be inappropriately spending and/or inaccurately tracking and reporting federal funds over multiple year periods, and these discrepancies may not be properly monitored, detected, and corrected by VTrans personnel on a timely basis. Questioned costs: Undetermined. Recommendation: VTrans should review and enhance internal controls and procedures to ensure that all required federal award information is included in subawards and that on-site subrecipient monitoring is conducted timely per the terms of its subrecipient monitoring plan. Views of responsible officials: Management agrees with the finding.

Reference Number: 2024-012 Prior Year Finding: No Federal Agency: U.S. Department of Transportation State Agency: Agency of Transportation Federal Program: Highway Planning and Construction Assistance Listing Number: 20.205 Award Number and Year: FFY2023 – FFY2024 Compliance Requirement: Special Tests and Provisions – Wage Rate Requirements Type of Finding: Significant Deficiency in Internal Control over Compliance, Other Matters Criteria or specific requirement: Compliance – All laborers and mechanics employed by contractors or subcontractors to work on construction contracts in excess of $2,000 financed by federal assistance funds must be paid wages not less than those established for the locality of the project (prevailing wage rates) by the Department of Labor (DOL) (40 USC 3141–3144, 3146, and 3147.) Per 29 CFR Part 5 – Labor Standards Provisions Applicable to Contacts Governing Federally Financed and Assisted Construction, nonfederal entities shall include in their construction contracts subject to the Wage Rate Requirements a provision that the contractor or subcontractor comply with those requirements and the DOL regulations. This includes a requirement for the contractor or subcontractor to submit to the nonfederal entity weekly, for each week in which any contract work is performed, a copy of the payroll and a statement of compliance (certified payrolls). Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Vermont Agency of Transportation (VTrans) did not receive weekly certified payrolls from all contractors. Context: Ten contracts were selected for testing, which included forty weekly certified payrolls tested. One of forty weekly certified payrolls was not received by VTrans. Cause: Procedures were not sufficient to ensure that VTrans obtained all required weekly certified payrolls. Internal controls did not detect or prevent the error. Effect: Failure to obtain weekly payrolls could prevent VTrans from detecting if a contractor pays less than the prevailing wage. Questioned costs: Undetermined. Recommendation: VTrans should review and enhance procedures and internal controls to ensure that it obtains weekly certified payrolls from all contractors. Views of responsible officials: Management agrees with the finding.

Reference Number: 2024-013 Prior Year Finding: No Federal Agency: U.S. Department of Transportation State Agency: Agency of Transportation Federal Program: Federal Transit Cluster Assistance Listing Number: 20.500, 20.507, 20.526 Award Number and Year: VT-04-0021-01 (3/14/2013 – 6/30/2016) Compliance Requirement: Cash Management, Period of Performance Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: 2 CFR section 200.343(b) requires nonfederal entities to liquidate all obligations incurred under the federal award no later than 90 calendar days after the end date of the period of performance as specified in the terms and conditions of the federal award unless the federal awarding agency or pass-through entity authorizes an extension. Per the U.S. Department of Transportation, Federal Transit Administration (FTA), circular FTA C 5010.1E Chapter 3, the recipient is responsible to initiate closeout of the Award, within 90 days after the end of the period of performance, or after all approved activities are completed and/or the applicable federal assistance has been expended for all eligible costs. Any deviation from the approved Award must be documented in the closeout amendment. US Department of the Treasury (Treasury) regulations at 31 CFR Part 205 implement the Cash Management Improvement Act of 1990 (CMIA), as amended (Pub. L. No. 101-453; 31 USC 6501 et seq.). Per 31 CFR Part 205 Subpart B, a State must minimize the time between the drawdown of Federal funds from the Federal government and their disbursement for Federal program purposes. A Federal Program Agency must limit a funds transfer to a State to the minimum amounts needed by the State and must time the disbursement to be in accord with the actual, immediate cash requirements of the State in carrying out a federal assistance program or project. The timing and amount of funds transfers must be as close as is administratively feasible to a State's actual cash outlay for direct program costs and the proportionate share of any allowable indirect costs. States should exercise sound cash management in funds transfers to subgrantees in accordance with OMB Circular A-102. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Agency of Transportation (VTrans) drew down federal funds against an award for which the period of performance had expired. An award period extension was not authorized by FTA, nor had the award been closed out timely. Context: VTrans drew down $12,671 from a grant award for which the period of performance ended on June 30, 2016. An extension for the award was not authorized by FTA, nor did FTA authorize VTrans to reopen or modify the grant award. VTrans did not initiate closure of the award until after completion of the drawdown. Cause: The procedures used by VTrans were not sufficient to ensure that it closed out a grant award timely, nor were they sufficient to prevent the drawdown of funds against an expired grant award. Internal controls did not prevent or detect the errors. Effect: VTrans drew down funds against a grant award after the end of its period of performance. Questioned costs: $12,671, the amount of funds drawn down against the expired grant award. Recommendation: We recommend that VTrans review and enhance grant closeout procedures and internal controls to ensure that grants are closed out timely. We further recommend that VTrans review and enhance procedures and internal controls over cash management to ensure that cash draws are performed only against grants for which the period of performance has not expired. Views of responsible officials: Management agrees with the finding.

Reference Number: 2024-014 Prior Year Finding: No Federal Agency: U.S. Department of the Treasury State Agency: Agency of Administration Federal Program: COVID-19 – Coronavirus State and Local Fiscal Recovery Funds Assistance Listing Number: 21.027 Award Number and Year: SLFRP4407 (3/3/2021 – 12/31/2024) Compliance Requirement: Procurement Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: The State’s procurement policy, Administrative Bulletin No. 3.5 – Procurement and Contracting Procedures, requires Vermont State agencies and departments to competitively procure goods and services which includes using a competitive bidding process and performing an analysis of the cost-effectiveness of the procurement. Per 2 CFR section 200.219, the non-Federal entity must conduct all procurement transactions in a manner providing full and open competition. Per 2 CFR section 200.324(a), the non-Federal entity must perform a cost or price analysis in connection with every procurement action in excess of the Simplified Acquisition Threshold including contract modifications. The method and degree of analysis is dependent on the facts surrounding the particular procurement situation, but as a starting point, the non-Federal entity must make independent estimates before receiving bids or proposals. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Agency of Administration (Agency) was unable to provide documentation that it competitively procured a contract nor that a cost analysis was performed. Context: For one of seven contracts selected for testing, the Agency was unable to provide documentation that it conducted the procurement using full and open competition, nor that a cost analysis was performed. The contract was procured in June 2020 in an initial amount of $5,000,000. Cause: The Agency’s procedures were not sufficient to ensure that it maintained documentation that it had competitively procured a contract nor that a cost analysis was performed. Internal controls did not detect or prevent the errors. Effect: Failure to competitively procure a contract and perform a cost analysis could result in the Agency procuring goods or services that are not cost-effective nor in the best interest of the Agency or the program. Questioned costs: Undetermined. Recommendation: We recommend the Agency review and enhance internal controls and procedures to ensure that it maintains documentation that it competitively procures contracts and that it performs a cost analysis for all procurement actions in accordance with Agency of Administration Bulletin No. 3.5 and federal requirements. Views of responsible officials: Management agrees with the finding.

Reference Number: 2024-015 Prior Year Finding: No Federal Agency: U.S. Department of Education State Agency: Agency of Education Federal Program: Student Support and Academic Enrichment Grants Assistance Listing Number: 84.424 Award Number and Year: S424A220047 (7/1/2022 – 9/30/2024) Compliance Requirement: Cash Management Type of Finding: Significant Deficiency in Internal Control Over Compliance Criteria or specific requirement: Compliance: Grantees draw funds via the G5 System. Grantees request funds by (1) creating a payment request using the G5 System through the Internet; (2) calling the Payee Hotline; or (3) if the grantee is placed on the reimbursement or cash monitoring payment method, submitting a Form 270, Request for Title IV Reimbursement or Heightened Cash Monitoring 2 (HCM2), (OMB No. 1845-0089), to an ED program or regional office. When creating a payment request in G5, the grantee enters the drawdown amounts, by award, directly into G5. Grantees can redistribute drawn amounts between grant awards by making adjustments in G5 to reflect actual disbursements for each award, as long as the net amount of the adjustments is zero. When requesting funds using the other two methods, grantees provide drawdown information to the hotline operator or on the Form 270, as applicable. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Agency of Education (Agency) was unable to provide evidence of proper segregation of duties including a lack of review and approval of drawdown requests. Context: The Agency’s procedures and controls require that the Deputy Chief Fiscal Officer (CFO) prepares drawdowns and the Financial Director reviews and submits them in the G5 System. For 2 of 12 drawdown requests selected for testing, the Deputy CFO both compiled the drawdown information and reviewed and approved them in G5. Cause: The Agency did not follow its drawdown procedures and was unable to provide evidence of review and approval of drawdown requests. Internal controls did not detect or prevent the errors. Effect: There is an increased risk of undetected drawdown errors. Questioned costs: Undetermined. Recommendation: We recommend that the Agency review and enhance its internal controls to ensure that drawdowns are reviewed and approved in accordance with the Agency’s policies and procedures. Views of responsible officials: Management agrees with the finding.

Reference Number: 2024-016 Prior Year Finding: 2023-018 Federal Agency: U.S. Department of Education State Agency: Agency of Education Federal Program: COVID-19 – Governor’s Emergency Education Relief Fund COVID-19 – Elementary and Secondary School Emergency Relief Fund (ESSER) COVID-19 - Coronavirus Response and Relief Supplemental Appropriations Act, 2021 – Emergency Assistance to Non-Public Schools (CRRSA EANS) COVID-19 – American Rescue Plan – Elementary and Secondary School Emergency Relief (ARP ESSER) COVID-19 - American Rescue Plan – Elementary and Secondary School Emergency Relief –Homeless Children and Youth Assistance Listing Number: 84.425C, 84.425D, 84.425R, 84.425U, 84.425W Award Number and Year: S425C210009 (1/8/2021 – 9/30/2022) S425D210011 (1/5/2021 – 9/30/2022) S425R210033 (2/23/2021 – 9/30/2022) S425U210011 (3/24/2021 – 9/30/2023) S425W210047 (4/23/2021 – 9/30/2023) Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. The following key data elements must be reported: Subawardee Name and Data Universal Numbering System (DUNS) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $25,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Agency of Education (Agency) was not in compliance with FSRS reporting requirements. Subawards were not reported timely and accurately to FSRS. Context: Fifty-eight subawards were selected for testing which included twenty-three original subawards and thirty-four subaward amendments. Sixteen of fifty-eight transactions tested (28%) were not in compliance with FFATA reporting requirements. The following exceptions were noted: • 3 of 58 subawards were not reported accurately to FSRS. • 13 of 58 subawards were not reported timely to FSRS. The subawards were reported from 3 months to more than two years late. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE Cause: The Agency has not fully implemented its corrective action plan from the prior audit. Its procedures were not sufficient to ensure that all subawards and subaward amendments were reported timely and accurately to FSRS. Internal controls did not prevent or detect the errors. Effect: Subawards were not reported to FSRS in accordance with FFATA requirements. Questioned costs: None noted. Recommendation: We recommend the Agency complete implementation of its corrective action plan from the prior audit. It should review and enhance internal controls and procedures to ensure that all required subawards and subaward amendments are reported timely and accurately to FSRS no later than the end of the month following the month of issuance. Views of responsible officials: Management agrees with the finding.

Reference Number: 2024-017 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Agency of Human Services Federal Program: COVID-19 - Activities to Support State, Tribal, Local and Territorial (STLT) Health Department Response to Public Health or Healthcare Crises Assistance Listing Number: 93.391 Award Number and Year: NH75OT000034 (6/1/2021 – 5/31/2026) Compliance Requirement: Reporting – Performance Reporting Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or specific requirement: Compliance: Recipients must submit quarterly and final performance/progress reports. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Agency of Human Services (Agency) was unable to provide supporting documentation that agreed with the data included in the submitted reports. Context: For two of two quarterly performance reports selected for testing, supporting documentation provided by the Agency was insufficient to support the data reported. Cause: The Agency’s procedures and controls were not sufficient to ensure that performance reports were accurate and agreed with supporting documentation. Effect: Auditors were unable to verify the accuracy of performance reports submitted by the Agency. Questioned costs: Undetermined. Recommendation: We recommend the Agency review and enhance internal controls and procedures to ensure that performance reports are accurate, agree with supporting documentation, and that supporting documentation is maintained and available for audit. Views of responsible officials: Management agrees with the finding.

Reference Number: 2024-018 Prior Year Finding: 2023-024 Federal Agency: U.S. Department of Health and Human Services State Agency: Agency of Human Services Federal Program: COVID-19 - Activities to Support State, Tribal, Local and Territorial (STLT) Health Department Response to Public Health or Healthcare Crises Assistance Listing Number: 93.391 Award Number and Year: NH75OT000034 (6/1/2021 – 5/31/2026) Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or specific requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. The following key data elements must be reported: Subawardee Name and Data Universal Numbering System (DUNS) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $30,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: Subawards were not reported to FSRS in accordance with FFATA requirements. Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Context: Three of fourteen subawards selected for testing were not reported to FSRS in accordance with FFATA requirements. Specifically, we noted the following exceptions: • Three of fourteen subawards were not reported to FSRS until after auditors requested samples for testing. The subawards were issued between 9/16/2022 and 9/6/2023 but were not reported to FSRS until 10/18/2024. As part of a prior year Corrective Action Plan (CAP), the Agency implemented a process to report required subawards to FSRS timely and to review previously issued subawards to ensure that all subawards were reported. The subaward exceptions noted were issued prior to the full implementation of the CAP. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE Cause: The Agency’s procedures and controls were not sufficient to ensure that subawards were reported to FSRS in accordance with FFATA reporting requirements. Effect: Subawards were not reported to FSRS in accordance with FFATA requirements. Questioned costs: None noted. Recommendation: We recommend the Agency complete implementation of its prior year CAP to ensure that all required subawards and subaward modifications are reported timely to FSRS in accordance with FFATA requirements and that all previously issued subawards are reported. Views of responsible officials: Management agrees with the finding.

Reference Number: 2024-019 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Agency of Human Services Federal Program: Temporary Assistance for Needy Families Assistance Listing Number: 93.558 Award Number and Year: 2301VTTANF (10/1/2022 – 9/30/2023) 2401VTTANF (10/1/2023 – 9/30/2024) Compliance Requirement: Reporting – ACF-199 Special Tests and Provisions – Penalty for Failure to Comply with Work Verification Plan Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: Work Participation Rates – State agencies must meet or exceed their minimum annual work participation rates. The minimum work participation rates are 50 percent for the overall rate and 90 percent for the two-parent rate. A state’s minimum work participation rate may be reduced by its caseload reduction credit. The Department of Health and Human Services (HHS) may penalize the state by an amount of up to 21 percent of the State Family Assistance Grant (SFAG) for violation of this provision. Penalty for Failure to Comply with Work Verification Plan – The state agency must maintain adequate documentation, verification, and internal control procedures to ensure the accuracy of the data used in calculating work participation rates. In so doing, it must have in place procedures to (a) determine whether its work activities may count for participation rate purposes; (b) determine how to count and verify reported hours of work; (c) identify who is a work-eligible individual; (d) control internal data transmission and accuracy. Each state agency must comply with its HHS-approved Work Verification Plan in effect for the period that is audited. HHS may penalize the state by an amount not less than 1 percent and not more than 5 percent of the SFAG for violation of this provision. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: Exceptions were noted regarding the reporting of work participation rates in the ACF-199 report by the Agency of Human Services (Agency) and errors were also noted in the documentation supporting the ACF-199 reports. Context: Forty participants were selected for testing and auditors noted several instances where work participation rates reported on the ACF-199 report did not agree with supporting documentation and that supporting documentation contained errors or was incomplete. Specifically, we noted the following: • For two of forty participants selected for testing, the participants’ wages/hours reported did not match supporting documentation. The error was due to a data system programming error that automatically limits a participant’s actual hours worked to forty when their actual hours exceed forty hours. • One of forty participants selected for testing did not have proper documentation of a change in circumstance. This resulted in two months in which the participant was not documented as engaged in work but had documented hours reported in the ACF-199 report. • For one of forty participants selected for testing, their average hours of work participation were not rereviewed within the six-month window required under the state plan. • For one of forty participants selected for testing, the amount reported did not agree with supporting documentation. The discrepancy was due to rounding errors. • For one of forty participants selected for testing, the employment verification form was not signed by a supervisor. Cause: The Agency’s procedures were not sufficient to ensure that work participation rates reported in the ACF-199 report were accurate, tied to supporting documentation, and that supporting documentation was accurate. Internal controls did not detect or prevent the errors. Effect Work Participation rates reported on the ACF-199 contained errors and did not tie to supporting documentation. HHS may penalize the Agency for its failure to ensure the accuracy of the data used when calculating work participation rates. Questioned costs: Undetermined. Recommendation: We recommend that the Agency review and enhance procedures and controls to ensure that it maintains adequate documentation, verification, and internal control procedures to ensure the accuracy of work participation rates reported in the ACF-199 reports. Views of responsible officials: Management agrees with the finding.

Reference Number: 2024-020 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Agency of Human Services Federal Program: CCDF Cluster Assistance Listing Number: 93.575, 93.596 Award Number and Year: 2301VTCCDD (10/1/2022 – 9/30/2025) 2401VTCCDD (10/1/2023 – 9/30/2026) Compliance Requirement: Special Tests and Provisions – Health and Safety Requirements Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or specific requirement: Compliance: Lead Agencies must certify that procedures are in effect (e.g., monitoring and enforcement) to ensure that providers serving children who receive subsidies comply with all applicable health and safety requirements. This includes verifying and documenting that child care providers (unless they meet an exception, e.g., family members who are caregivers or individuals who object to immunization on certain grounds) serving children who receive subsidies meet requirements pertaining to health and safety. These requirements must address eleven specific areas—including first aid and CPR, safe sleeping practices, and administration of medication—and child care workers must be trained in these areas (42 USC 9858c(c)(2)(I); 45 CFR section 98.41). Per 45 CFR 98.44(b), a Lead Agency must describe in the State Plan its established requirements for pre-service or orientation (to be completed within three months) and ongoing professional development for caregivers, teachers, and directors of child care providers of services for which assistance is provided under the CCDF that, to the extent practicable, align with the State framework. Accessible pre-service or orientation training in health and safety standards appropriate to the setting and age of children served addresses: (i) Each of the requirements relating to matters described in §98.41(a)(1)(i) through (xi) and specifying critical health and safety training that must be completed before caregivers, teachers, and directors are allowed to care for children unsupervised; (ii) At the Lead Agency option, matters described in § 98.41(a)(1)(xii); and (iii) Child development, including the major domains (cognitive, social, emotional, physical development and approaches to learning); Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Agency of Human Services (Agency) did not ensure that all providers completed required annual training nor that training in health and safety standards addresses the required eleven elements per 45 CFR sections 98.41 and 98.44(b)(1). Context: Forty child care providers were selected for testing and the following exceptions were noted: • For 4 of 40 child care providers selected for testing, the Agency was unable to provide documentation that it ensured the providers completed the required 15 hours of annual training or that a supervisor had documented approval of the training hours. • For 40 of 40 child care providers selected for testing, the Agency’s provider training did not include all 11 of the required health and safety topics. During a monitoring site visit conducted in November 2023 by the HHS Administration for Children & Families, Office of Child Care (OCC), the monitoring team did not find evidence that the Agency’s provider training content included all 11 health and safety topics. Therefore, OCC’s monitoring report identified noncompliance with this training requirement. Cause: The Agency’s procedures were not sufficient to ensure that its monitoring documentation of child care provider training was complete. When developing provider health and safety training content, the Agency did not ensure that it included all 11 health and safety topics required by 45 CFR section 98.44(b)(1). Internal controls did not detect or prevent these errors. Effect Deficiencies in the content and monitoring of provider health and safety training could result in inadequately trained child care providers which may create a risk to the health and safety of children receiving subsidies under the program. Questioned costs: None noted. Recommendation: We recommend that the Agency review and enhance training monitoring procedures and controls to ensure that all child care providers complete required health and safety training. We further recommend that the Agency update its training content to ensure that it includes all required elements. Views of responsible officials: Management agrees with the finding.

Reference Number: 2024-021 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Agency of Human Services Federal Program: CCDF Cluster Assistance Listing Number: 93.575, 93.596 Award Number and Year: 2301VTCCDD (10/1/2022 – 9/30/2025) 2401VTCCDD (10/1/2023 – 9/30/2026) Compliance Requirement: Eligibility Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: Lead Agencies must have procedures in place for documenting and verifying eligibility in accordance with federal requirements, as well as the specific eligibility requirements selected by each Lead Agency in its approved plan. A Lead Agency is the designated state, territorial, or tribal entity to which the CCDF grant is awarded and that is accountable for administering the CCDF program. Procedures for documenting and verifying eligibility may be performed directly by the lead agency or other agencies engaged in the administration of CCDF. Per 45 CFR Section 98.20(c) - A Child's Eligibility for Child Care Services, for purposes of implementing the citizenship eligibility verification requirements mandated by title IV of the Personal Responsibility and Work Opportunity Reconciliation Act, 8 U.S.C. 1601 et seq., only the citizenship and immigration status of the child, who is the primary beneficiary of the CCDF benefit, is relevant. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Agency of Human Services (Agency) failed to perform verification of U.S. citizenship for participants who were otherwise eligible under the program because they were in need of or receiving protective services. Context: For three of forty participants selected for testing, U.S. citizenship was not verified. Auditors noted that the Agency pooled funding for multiple federal programs with CCDF, which made eligibility for the other funding sources subject to CCDF rules. The Administration for Children and Families (ACF) performed a monitoring visit in November 2023 which identified an exception for U.S. citizenship verification. Through the Agency’s corrective action plan resulting from ACF’s monitoring visit, citizenship was verified back to 10/1/2023 (for FFY2024), however the Agency did not verify citizenship for participants receiving benefits prior to this date. Cause: The Agency’s procedures and controls were not sufficient to ensure that U.S. citizenship was verified for participants who were otherwise eligible under the program because they were in need of or receiving protective services. When the exception was noted by ACF, the Agency verified citizenship for FFY2024, but did not verify citizenship for participants receiving benefits prior to this date. Effect Failure to verify U.S. citizenship for participants could result in ineligible participants receiving benefits under the program. Questioned costs: Undetermined. Recommendation: We recommend that the Agency review and enhance procedures and controls to ensure that it verifies U.S. citizenship for all participants and confirm that only eligible participants receive benefits under the program. Views of responsible officials: Management agrees with the finding.

Reference Number: 2024-022 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Agency of Human Services (Agency) Federal Program: Medicaid Cluster Assistance Listing Number: 93.775, 93.777, 93.778 Award Number and Year: 2305VT5MAP (10/1/2022 – 9/30/2023) Compliance Requirement: Eligibility Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: States verify the financial and nonfinancial factors of eligibility by checking electronic data sources in accordance with federal requirements at 42 CFR 435.948 through 435.956 and state requirements (as documented in the state plan, verification plan, and eligibility manual). Per 42 CFR §435.915(b) and the Vermont State Plan, eligibility for Medicaid is effective on the first day of a month if an individual was eligible at any time during that month. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Agency of Human Services (Agency) incorrectly discontinued benefits for a Medicaid participant during the month in which eligibility was renewed. Context: For one of sixty participants selected for testing, the Agency performed a renewal of Medicaid benefits during the month of October and discontinued benefits for that month instead of backdating the claim to the beginning of the month. Cause: The Agency did not adequately follow procedures regarding eligibility renewals in accordance with federal program requirements and its state plan. Internal controls did not detect or prevent the error. Effect A participant’s benefits were improperly discontinued for one month. Questioned costs: None noted. Recommendation: We recommend that the Agency review and enhance procedures and controls for Medicaid eligibility renewals to ensure that benefits for eligible participants are not discontinued. Views of responsible officials: Management agrees with the finding.

Reference Number: 2024-023 Prior Year Finding: 2023-030 Federal Agency: U.S. Department of Health and Human Services State Agency: Agency of Human Services Federal Program: Medicaid Cluster Assistance Listing Number: 93.775, 93.777, 93.778 Award Number and Year: 2305VT5MAP (10/1/2022 – 9/30/2023) 2405VT5MAP (10/1/2023 – 9/30/2024) Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. The following key data elements must be reported: Subawardee Name and Data Universal Numbering System (DUNS) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $30,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: A subaward was not reported to FSRS in accordance with FFATA requirements. Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Context: The Agency of Human Services (Agency) Internal Audit Group (IAG) reports subaward information in FSRS for its various departments using subaward information provided by the departments. Thirty subawards totaling $6,709,156 were selected for testing, including twenty-eight initial subawards and two subaward amendments. We noted the following exception: • One of thirty subawards was not reported. The subaward was issued 9/26/2023 but it was not reported to FSRS. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE As part of a prior year Corrective Action Plan (CAP), the Agency implemented a process to report required subawards to FSRS timely. The exception noted occurred prior to the full implementation of the CAP. Cause: The individual departments did not provide the IAG with complete subaward information on a timely basis which caused errors and omissions in subaward reporting to FSRS. Effect: Subawards were not reported to FSRS in accordance with FFATA requirements. Questioned costs: None noted. Recommendation: We recommend that the Agency complete implementation of its prior year CAP to ensure that all required subawards and subaward modifications are reported timely to FSRS in accordance with FFATA requirements. Views of responsible officials: Management agrees with the finding.

Reference Number: 2024-024 Prior Year Finding: 2023-031 Federal Agency: U.S. Department of Health and Human Services State Agency: Agency of Human Services Federal Program: Medicaid Cluster Assistance Listing Number: 93.775, 93.777, 93.778 Award Number and Year: 2305VT5MAP (10/1/2022 – 9/30/2023) 2405VT5MAP (10/1/2023 – 9/30/2025) Compliance Requirement: Special Tests and Provisions - Provider Health and Safety Standards Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: Providers must meet the prescribed health and safety standards for hospital, nursing facilities, and ICF/IID (42 CFR part 442). The standards may be modified in the State Plan. The Medicaid Provider Enrollment Compendium (MPEC) requires that State Medicaid Agencies perform screening of providers based upon their risk level. Screening includes verifications of licenses and compliance with all federal and state regulations of the program. Control: Per 2 CFR section 200.303(a), the non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Agency of Human Services (Agency) did not maintain documentation to support a provider’s compliance with the prescribed health and safety standards. The provider health and safety requirements are administered by a 3rd-party that determines and documents providers’ eligibility with the Agency’s requirements in the provider management module (PMM). Context: For one of sixty providers selected for testing, documentation was incomplete to support that the provider was in good tax standing. The provider’s tax standing was verified by the Agency, but the letter was not signed by the Vermont Tax Department Commissioner and uploaded to the PMM as required. As part of a prior year Corrective Action Plan (CAP), a process was developed to require letters of good standing be uploaded to the provider file in the PMM but when this provider’s tax standing was verified, the CAP had not been fully implemented. Cause: The Agency’s 3rd-Party provider did not consistently maintain verification of tax standing documentation in the PMM. Although the Agency had begun implementation of its corrective action plan from a prior year audit, the plan has not been fully implemented. Effect: Failure to verify and document compliance with health and safety standards could allow ineligible providers to perform services under the Medicaid program. Questioned costs: Undetermined. Recommendation: We recommend the Agency fully implement its CAP to ensure that documentation is maintained in accordance with program requirements and that all providers are compliant with required health and safety standards. Views of responsible officials: Management agrees with the finding.

Reference Number: 2024-025 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Agency of Human Services (Agency) Federal Program: Medicaid Cluster Assistance Listing Number: 93.775, 93.777, 93.778 Award Number and Year: 2305VT5MAP (10/1/2022 – 9/30/2023) 2405VT5MAP (10/1/2023 – 9/30/2024) Compliance Requirement: Special Tests and Provisions – Utilization Control Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: The state plan must provide methods and procedures to safeguard against unnecessary utilization of care and services (42 CFR Part 456). The State Medicaid Agency (SMA) must implement a statewide surveillance and utilization control program that (1) safeguards against unnecessary or inappropriate use of Medicaid services against excess payments, (2) assesses the quality of those services, and (3) provides for the control of the utilization of all services provided under the state plan per 42 CFR 456 Subparts B-I. The SMA must establish and use written criteria for evaluating the appropriateness and quality of Medicaid services. The agency must have procedures for the ongoing post-payment review, on a sample basis, of the need for, and the quality and timeliness of, Medicaid services. The SMA may conduct this review directly or may contract with an independent entity. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Agency of Human Services (Agency) failed to properly document closure of a case referred to the Medicaid Fraud and Residential Abuse Unit (MFRAU) by the Special Investigations Unit (SIU). Context: For one of twenty-eight cases selected for testing, the SIU opened the case in FY2016, marked it as a high priority, and referred it to the MFRAU. The MFRAU closed the case in FY2018, however, the closure was not properly documented nor communicated. In FY2024 the case was classified by the SIU as administratively closed due to its age, but the results of the review and closure were not documented. Cause: The Agency did not adequately follow procedures regarding utilization control case review and closure in accordance with federal program requirements and its state plan. Internal controls did not detect or prevent the error. Effect Failure to properly document and promptly close cases could allow unnecessary utilization of care and services to continue undetected and result in unnecessary or inappropriate use of Medicaid services. Questioned costs: Undetermined. Recommendation: We recommend that the Agency review and enhance procedures and controls for Medicaid utilization control to ensure that cases are closed timely and that documentation of the results of reviews are maintained and communicated. Views of responsible officials: Management agrees with the finding.

Reference Number: 2024-026 Prior Year Finding: 2023-023 Federal Agency: U.S. Department of Agriculture U.S. Department of Health and Human Services State Agency: Department of Finance and Management Federal Program: SNAP Cluster Temporary Assistance for Needy Families CCDF Cluster Assistance Listing Number: 10.551, 10.561, 93.558, 93.575, 93.596 Award Number and Year: 4VT400406 (10/1/2022 – 9/30/2023) 4VT402513 (10/1/2023 – 9/30/2024) 2301VTTANF (10/1/2022 – 9/30/2023) 2401VTTANF (10/1/2023 – 9/30/2024) 2301VTCCDD (10/1/2022 – 9/30/2025) 2401VTCCDD (10/1/2023 – 9/30/2026) Compliance Requirement: Cash Management Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: US Department of the Treasury (Treasury) regulations at 31 CFR Part 205 implement the Cash Management Improvement Act of 1990 (CMIA), as amended (Pub. L. No. 101-453; 31 USC 6501 et seq.). Subpart A of those regulations requires state recipients to enter into Treasury-State Agreements that prescribe specific methods of drawing down federal funds (funding techniques) for federal programs listed in the Assistance Listing (Catalog of federal Domestic Assistance) that meet the funding threshold for a major federal assistance program under the CMIA. Treasury-State Agreements also specify the terms and conditions under which an interest liability would be incurred. Programs not covered by a Treasury-State Agreement are subject to procedures prescribed by Treasury in Subpart B of 31 CFR Part 205 (Subpart B), which at 31 CFR section 205.33(a) include the requirement for a state to minimize the time between the drawdown of federal funds and their disbursement for federal program purposes. Annual Reports are submitted electronically by December 31 of each year. The Annual Report includes Federal interest liabilities, State interest liabilities, and State direct cost claims. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Finance and Management (Finance) improperly calculated State interest liabilities for multiple programs on the FY2024 CMIA Annual Report. Context: Finance is the entity responsible for calculation of State and Federal interest liabilities and completion of the CMIA Annual Report. The annual interest rate is established by the U.S. Treasury and published on its CMIA website. This rate must be used when calculating State and Federal interest liabilities in the Annual Report. Finance receives drawdown detail support from other State agencies which it uses to compile the State’s Annual Report submission. When Finance prepared the FY2024 Annual Report, it failed to verify that the correct interest rate was applied to calculate interest liabilities, resulting in an underreporting of the State interest liability for several programs. Specifically, we noted that the State’s interest liability was underreported for the following programs: • SNAP Cluster: $579 • Temporary Assistance for Needy Families: $2,589 • CCDF Cluster: $500 Cause: Finance’s procedures were not sufficient to ensure that the FY2024 interest rate established by the U.S. Treasury was applied for all programs when interest liabilities were calculated. Internal controls did not prevent or detect the errors. Effect: The State’s interest liability was underreported to the U.S. Treasury, resulting in the State earning interest on Federal funds to which it was not entitled. Questioned costs: $3,668, the total State interest liability that was underreported on the FY2024 CMIA Annual Report. Recommendation: We recommend that Finance review and enhance its internal controls and procedures over the CMIA Annual Report to ensure that it verifies the correct interest rate is applied and that State and Federal interest liabilities are properly calculated in accordance with 2 CFR section 200.514. Views of responsible officials: Management agrees with the finding.

Reference Number: 2024-027 Prior Year Finding: No Federal Agency: U.S. Department of Agriculture U.S. Department of Health and Human Services State Agency: Department of Human Resources Agency of Human Services Federal Program: SNAP Cluster Temporary Assistance for Needy Families Child Support Services CCDF Cluster Medicaid Cluster Assistance Listing Number: 10.551, 10.561, 93.558, 93.563, 93.575, 93.596, 93.775, 93.777, 93.778 Award Number and Year: 4VT400406 (10/1/2022 – 9/30/2023) 4VT402513 (10/1/2023 – 9/30/2024) 2301VTTANF (10/1/2022 – 9/30/2023) 2401VTTANF (10/1/2023 – 9/30/2024) 2401VTSCSS (10/1/2023 – 9/30/2024) 2301VTCCDD (10/1/2022 – 9/30/2025) 2401VTCCDD (10/1/2023 – 9/30/2026) 2305VT5MAP (10/1/2022 – 9/30/2023) Compliance Requirement: Allowable Costs/Cost Principles – Time and Effort Reporting Type of Finding: Significant Deficiency in Internal Control Over Compliance Criteria or specific requirement: Compliance: Per 2 CFR section 200.403(c), to be allowable under Federal awards, except where otherwise authorized by statute, costs must be consistent with policies and procedures that apply uniformly to both federally financed and other activities of the recipient or subrecipient. Compensation for exempt attorneys in the State of Vermont are determined by the State of Vermont’s Attorney Pay Plan which governs the hiring level, compensation and promotion of exempt attorneys. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The hourly rate used to compensate an exempt attorney was higher than the maximum limit identified for the position in the State of Vermont’s Attorney Pay Plan. Context: The Department of Human Resources (Department) manages and updates the VTHR Human Resource information system which is the system used for managing employee data and processing payroll for all State employees. The Agency of Human Services (Agency) allocates payroll costs to federal programs using methodologies approved in its Cost Allocation Plan. After allocation, compensation for positions may be charged by the Agency to multiple federal programs. During cost allocation testing, auditors determined one employee’s rate of pay exceeded the limit identified for the position in the State of Vermont’s Attorney Pay Plan. The maximum hourly rate for the General Counsel I position is $59.61 or up to the Department Head’s Salary, whichever is lower. The employee selected for testing was compensated at the hourly rate of $62.06 which exceeds the maximum for the position. Cause: The Department of Human Resources used the department head’s salary as the maximum for the General Counsel I position in VTHR. It did not implement a control to ensure that the employee’s salary also did not exceed the maximum hourly rate identified for the position. Effect An employee was compensated at a rate higher than the maximum limit identified for the position in the State of Vermont’s Attorney Pay Plan. Internal controls did not detect or prevent the error. Questioned costs: Undetermined. Recommendation: We recommend that the Department review and enhance procedures and internal controls to ensure that VTHR uses rates of pay for attorneys that align with the maximum pay rates established by the Attorney Pay Plan. Views of responsible officials: Management agrees with the finding.

Reference Number: 2024-028 Prior Year Finding: 2023-034 Federal Agency: U.S. Department of Homeland Security State Agency: Department of Public Safety Federal Program: Disaster Grants - Public Assistance (Presidentially Declared Disasters) Assistance Listing Number: 97.036 Award Number and Year: FEMA-4474-DR-VT (2020), FEMA-4532-DR-VT (2020), FEMA-4621-DR-VT (2021), FEMA-4695-DR-VT (2023), FEMA-4720-DR-VT (2023) Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. The following key data elements must be reported: Subawardee Name and Data Universal Numbering System (DUNS) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $25,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Public Safety (Department) was not in compliance with FSRS reporting requirements. Subawards and subaward modifications were not reported timely or accurately to FSRS. Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Context: This is a repeat finding from the prior year and auditors note that progress has been made, though the corrective action plan from the prior year has not been fully implemented. Ninety-six subawards were selected for testing, including thirty-two which were issued in a prior year and sixty-four which were issued during FY2024. The following exceptions were noted: • 24 of 96 subawards were not reported to FSRS, totaling $17,306,440. o Of the exceptions noted, FY2024 subawards not reported were 13 of 64 and totaling $7,627,387 of $17,741,626. • 5 of 96 subawards were not reported timely to FSRS, totaling $10,937,684. o Of the exceptions noted, FY2024 subawards reported late were 4 of 64 and totaling $9,609,432 of $17,741,626. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE Cause: The Department’s procedures were not sufficient to ensure that subawards were reported timely or accurately to FSRS. Internal controls did not prevent or detect the errors. The corrective action plan from the prior year has not been fully implemented. Effect: The Department’s subaward reporting to FSRS was incomplete and inaccurate. Questioned costs: None noted. Recommendation: We recommend the Department complete implementation of its corrective action plan from the prior year. The Department should continue to improve its procedures and internal controls to ensure that all required subawards and subaward modifications are reported accurately and timely to FSRS no later than the end of the month following the month of issuance in accordance with FFATA reporting requirements. Views of responsible officials: Management agrees with the finding.

Reference Number: 2023-003 Prior Year Finding: 2022-006 Federal Agency: U.S. Department of Education State Agency: Agency of Education Federal Program: Child Nutrition Cluster Assistance Listing Number: 10.553, 10.555, 10.556, 10.559, 10.582 Award Number and Year: 4VT300307 (2021-2023), 4VT310307 (2020-2023), 4VT308907 (2022-2023) Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. The following key data elements must be reported: Subawardee Name and Data Universal Numbering System (DUNS) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $25,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Condition: The Agency of Education (Agency) was not in compliance with FSRS reporting requirements. Subawards and subaward modifications were not reported timely or accurately to FSRS. Context: Sixty subawards were selected for testing and many of these subawards were amended multiple times for a total of 573 transactions tested. Specifically, the following exceptions were noted: • 3 of 60 original subawards were not reported to FSRS. • 14 of 513 subaward amendments were not reported to FSRS. • 9 of 60 original subawards were not reported timely to FSRS. • 127 of 513 subaward amendments were not reported timely to FSRS. • 1 of 60 original subawards reported an incorrect amount to FSRS. • 2 of 513 subaward amendments reported an incorrect amount to FSRS. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE Cause: The Agency’s procedures were not sufficient to ensure that all subawards and subaward amendments were reported timely and accurately to FSRS. Internal controls did not prevent or detect the errors. Effect: Subawards were not reported timely or accurately to FSRS in accordance with FFATA requirements. Questioned costs: None noted. Recommendation: We recommend the Agency review and enhance internal controls and procedures to ensure that all required subawards and subaward amendments are reported accurately and timely to FSRS no later than the end of the month following the month of issuance. Views of responsible officials: Management agrees with the finding.

Reference Number: 2023-004 Prior Year Finding: No Federal Agency: U.S. Department of Agriculture State Agency: Agency of Education Department of Finance and Management Federal Program: Child Nutrition Cluster Assistance Listing Number: 10.553, 10.555, 10.556, 10.559, 10.582 Award Number and Year: 4VT300307 (2021-2023), 4VT310307 (2020-2023), 4VT308907 (2022-2023) Compliance Requirement: Cash Management Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: US Department of the Treasury (Treasury) regulations at 31 CFR Part 205 implement the Cash Management Improvement Act of 1990 (CMIA), as amended (Pub. L. No. 101-453; 31 USC 6501 et seq.). Subpart A of those regulations requires state recipients to enter into Treasury-State Agreements that prescribe specific methods of drawing down federal funds (funding techniques) for federal programs listed in the Assistance Listing (Catalog of federal Domestic Assistance) that meet the funding threshold for a major federal assistance program under the CMIA. Treasury-State Agreements also specify the terms and conditions under which an interest liability would be incurred. Programs not covered by a Treasury-State Agreement are subject to procedures prescribed by Treasury in Subpart B of 31 CFR Part 205 (Subpart B), which at 31 CFR section 205.33(a) include the requirement for a state to minimize the time between the drawdown of federal funds and their disbursement for federal program purposes. Per 2 CFR section 200.514(a)(5), if a State fails to request funds timely as set forth in 2 CFR section 205.29, or otherwise fails to apply a funding technique properly, we may deny any resulting Federal interest liability, notwithstanding any other provision of this section. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Agency of Education (Agency) was not in compliance with the funding techniques included in the State’s CMIA Treasury-State Agreement. The Department of Finance and Management (Finance) improperly calculated Federal interest liabilities for the program on the CMIA Annual Report. Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Context: The funding techniques for the program require that cash draws are performed on a bi-weekly basis, or 26 times during the fiscal year. The Agency performed only ten cash draws during the fiscal year. Finance is the responsible State entity for calculation of interest and completion of the CMIA Annual Report. Since the Agency failed to request funds timely in accordance with the Treasury-State Agreement, Finance should not have calculated a federal interest liability for the program, however, a federal interest liability was reported in the amount of $7,966. Cause: The Agency’s procedures were not sufficient to ensure that cash draws were performed timely per the terms of the Treasury-State Agreement. Internal controls did not detect or prevent these errors. Finance’s CMIA Annual Report procedures were not sufficient to ensure that it calculated a federal interest liability for the program only when the State was entitled to the interest. Internal controls did not detect the error prior to submission of the CMIA Annual Report. Effect: The Cash Management Improvement Act is intended to minimize the time between the transfer of federal funds to States and the payout of those funds for program purposes. When the Agency does not draw down federal funds timely per the funding techniques included in the Treasury-State Agreement, it causes the State to advance its own funds for federal program purposes, negatively impacting the State’s cash flow. Improperly calculating the Federal interest liability could potentially allow the State to receive an interest payment to which it is not entitled per 2 CFR section 200.514. Questioned costs: $7,966, the amount of the federal interest liability improperly calculated and included on the Annual Report. Recommendation: We recommend the Agency review and enhance internal controls and procedures over cash management to ensure that cash draws are performed timely and in accordance with the funding techniques included in the State’s Treasury-State Agreement. We further recommend that Finance enhance its procedures and internal controls to ensure that federal interest liabilities are properly calculated in accordance with 2 CFR section 200.514. Views of responsible officials: Management agrees with the finding.

Reference Number: 2023-005 Prior Year Finding: 2022-012 Federal Agency: Department of Labor State Agency: Vermont Department of Labor Federal Program: Unemployment Insurance, COVID-19 – Unemployment Insurance Assistance Listing Number: 17.225 Award Number and Year: State UC, UCFE and UCX (7/1/2022 - 6/30/2023) Compliance Requirement: Reporting Type of Finding: Material Weakness in Internal Control over Compliance, Material Noncompliance Criteria or specific requirement: Compliance: ETA 191, Financial Status of UCFE/UCX (OMB No. 1205-0162) – Quarterly report on UCFE and UCX expenditures and the total amount of benefits paid to claimants of specific federal agencies (ET Handbook 401). ETA 9050, Time Lapse of All First Payments except Workshare – The ETA 9050 report contains monthly information on first payment time lapse. This report concerns the time it takes states to pay benefits to claimants for the first compensable week of unemployment. That data addressed first payment time lapse for total unemployment only. The report is submitted electronically to the ETA National Office on the 20th of the month following the month to which the data relates. ETA 9052, Nonmonetary Determination Time Lapse Detection - The ETA 9052 report contains monthly information on the time it take states to issue nonmonetary determinations from the date the issues are first detected by the agency. Single-claimant and multi-claimant nonmonetary determinations are included in the report. Nonmonetary determinations made by organizational units such as Benefits Accuracy Measurement (BAM) and Benefit Payment Control (BPC) are also included in the report. Note: Overpayment notices on uncontested earnings detected by any method (e.g., crossmatch) should not be included. The report is submitted electronically to the ETA National Office on the 20th of the month following the month to which the data relates. ETA 9055, Appeals Case Aging - The ETA 9055 report gathers monthly information on the inventory of lower authority and higher authority single claimant appeals cases that have been filed but not decided. Appeals case aging provides information about the number of days from the date an appeal was filed through the end of the month covered by the report. Also included are the average and median ages of the pending single claimant appeals cases. The report is submitted electronically to the ETA National Office on the 20th of the month following the month to which the data relates. Section III – Findings and Questioned Costs – Major Federal Programs (Continued) ETA 2208A, Quarterly UI Above-Base Report - The ETA 2208A is a quarterly report of staff years worked and paid by program category. Reports are submitted electronically to the National Office by the 30th of the month following the close of the quarter. Internal Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with the guidance in "Standards for Internal Control in the Federal Government" issued by the Comptroller General of the United States or the "Internal Control-Integrated Framework," issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Labor (the Department) was not able to provide support that it had submitted required financial, performance, and special reports by the due dates nor that reports had been reviewed and approved by an authorized State official prior to submission. Context: We reviewed a sample of the financial, performance, and special reports filed during FY 2023. The following exceptions were noted: ETA 191: Support could not be provided that 2 of 2 reports reviewed had been reviewed and approved prior to submission. ETA 9050: Support could not be provided that 4 of 4 reports reviewed had been reviewed and approved prior to submission. ETA 9052: Support could not be provided that 4 of 4 reports reviewed were submitted by the required due date nor that the reports had been reviewed and approved prior to submission. The reports were all submitted 20 days late. ETA 9055: Support could not be provided that 4 of 4 reports reviewed were submitted by the required due date nor that the reports had been reviewed and approved prior to submission. The reports were all submitted 20 days late. ETA 2208A: One of two quarterly reports reviewed was submitted after the required due date. The report for the quarter ending 12/31/2022 was due by 1/30/2023 but was submitted on 2/3/2023, or four days late. Cause: The Department does not have sufficient internal controls in place over compliance with Unemployment Insurance reporting requirements to ensure that reports are submitted timely and that they are reviewed and approved prior to submission. Effect: Performance and special reports were consistently submitted late. A lack of review and approval of reports could allow incorrect data to be reported for the program which could misrepresent the State’s financial and programmatic performance in the program. Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Questioned costs: Undetermined. Recommendation: We recommend that policies and procedures be implemented to ensure that all financial, performance, and special reports are filed timely and accurately and that reports are reviewed and approved by an authorized State official prior to submission. Views of responsible officials: The Department acknowledges and accepts this finding.

Reference Number: 2023-006 Prior Year Finding: No Federal Agency: U.S. Department of Labor State Agency: Vermont Department of Labor Federal Program: Unemployment Insurance, COVID-19 – Unemployment Insurance Assistance Listing Number: 17.225 Award Number and Year: State UC (7/1/2022 – 6/30/2023) Compliance Requirement: Special Tests and Provisions - Match with IRS 940 FUTA Tax Form Type of Finding: Material Weakness in Internal Control over Compliance, Material Noncompliance Criteria or specific requirement: Compliance: Per 26 CFR sections 31.3302(a)-3(a), states are required to annually certify for each taxpayer the total amount of contributions required to be paid under the state law for the calendar year and the amounts and dates of such payments in order for the taxpayer to be allowed the credit against the Federal Unemployment Tax Act (FUTA). In order to accomplish this certification, states annually perform a match of employer tax payments with credit claimed for these payments on the employer’s IRS 940 FUTA tax form. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Labor (Department) did not retain the IRS 940 FUTA match data file and therefore, it was unavailable for testing by auditors. Context: FUTA match data was submitted to the IRS and proof of submission was retained for internal control purposes. However, since the match data file was not retained, auditors were unable to verify the accuracy of the match certification performed by the Department. Cause: The Department’s procedures and internal controls were not sufficient to ensure that it retained the FUTA match data file and that this file was available for audit. Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Effect: Auditors were unable to verify that the Department accurately performed a match of employer tax payments with credit claimed for these payments on the employer’s IRS 940 FUTA tax form. Specifically, auditors were unable to verify that the taxable wages used by the Department agreed to the IRS matching result file, that timely and late payments were properly distinguished in the match results, and that the tax payment met the stated criteria for FUTA tax credits allowance. Questioned costs: Undetermined. Recommendation: We recommend the Department reviews and enhances its procedures and controls to ensure that it retains the IRS 940 FUTA match data file and this file is available for testing by auditors. Views of responsible officials: The Department acknowledges and accepts this finding.

Reference Number: 2023-007 Prior Year Finding: 2023-016 Federal Agency: U.S. Department of Labor State Agency: Vermont Department of Labor Federal Program: Unemployment Insurance Assistance Listing Number: 17.225 Award Number and Year: UI393532355A50 (10/1/2022 – 12/31/2025) Compliance Requirement: Allowable Costs/Cost Principles Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Compliance: 2 CFR section 200.403 states, in part, except where otherwise authorized by statute, costs must meet the following general criteria in order to be allowable under Federal awards: (a) Be necessary and reasonable for the performance of the Federal award and be allocable thereto under these principles. (b) Conform to any limitations or exclusions set forth in these principles or in the Federal award as to types or amount of cost items. (c) Be consistent with policies and procedures that apply uniformly to both federally-financed and other activities of the non-Federal entity. (d) Be accorded consistent treatment. A cost may not be assigned to a Federal award as a direct cost if any other cost incurred for the same purpose in like circumstances has been allocated to the Federal award as an indirect cost. (e) Be determined in accordance with generally accepted accounting principles (GAAP), except, for state and local governments and Indian tribes only, as otherwise provided for in this part. (f) Not be included as a cost or used to meet cost sharing or matching requirements of any other federally-financed program in either the current or a prior period. (g) Be adequately documented. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Labor (Department) charged costs to the program that were issued without documentation of supervisory review and approval. Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Context: For four of sixty general disbursement transactions selected for testing, the Department was unable to provide documentation of supervisory review and approval prior to issuance of payment to the vendor. Cause: The Department’s procedures were not sufficient to ensure that payments were reviewed and approved prior to issuance of payment. Internal controls did not prevent or detect the errors. Effect: Unallowable costs could be charged to the program if disbursements are not reviewed by a supervisor who is knowledgeable of program regulations regarding allowable costs. Questioned costs: None noted. The costs were determined to be allowable. Recommendation: We recommend the Department reviews and enhances its procedures and controls regarding payment processing to ensure that, prior to charging costs to the program, they are reviewed by a supervisor who is knowledgeable of the regulations regarding allowable program costs and that documentation of the review is maintained. Views of responsible officials: The Department acknowledges and accepts this finding.

Reference Number: 2023-008 Prior Year Finding: 2022-017 Federal Agency: U.S. Department of Labor State Agency: Vermont Department of Labor Federal Program: Unemployment Insurance, COVID-19 – Unemployment Insurance Assistance Listing Number: 17.225 Award Number and Year: UI393532355A50 (10/1/2022 – 12/31/2025) Compliance Requirement: Period of Performance Type of Finding: Significant Deficiency in Internal Control over Compliance, Other Matters Criteria or specific requirement: Compliance: A non-federal entity may charge only allowable costs incurred during the approved budget period of a federal award’s period of performance and any costs incurred before the federal awarding agency or pass-through entity made the federal award that were authorized by the federal awarding agency or pass-through entity (2 CFR sections 200.308 200.309 and 200.403(h)). A period of performance may contain one or more budget periods. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Labor (Department) charged costs to the federal grant prior to the allowable start of the period of performance. Payments were also issued without review and approval by supervisory staff. Context: Sixty transactions were selected for testing and the following exceptions were noted: • Five of sixty transactions were charged to the award before the allowable period of performance. The grant award start date was October 1, 2022 but costs, totaling $2,277, were incurred in June, July and September 2022. • The Department’s key control is that all payments are supported by an invoice approved by a program manager who is aware of the grant’s period of performance. Four of sixty transactions did not have evidence of supervisory approval prior to issuance of payment. Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Cause: The Department’s procedures and internal controls were not operating sufficiently to ensure that expenditures charged to the program were incurred within the award’s period of performance. Effect: Costs could be deemed unallowable by the awarding agency if funds are expended outside of the allowable period of performance. Questioned costs: Below the reportable limit. Recommendation: The Department should review and enhance its procedures and internal controls to ensure that it charges expenditures to the program that are incurred within an award’s allowable period of performance. Views of responsible officials: The Department acknowledges and accepts this finding.

Reference Number: 2023-009 Prior Year Finding: No Federal Agency: U.S. Department of the Treasury State Agency: Agency of Administration Federal Program: COVID-19 – Coronavirus State and Local Fiscal Recovery Funds Assistance Listing Number: 21.027 Award Number and Year: SLFRP4407 (3/1/2021 – 12/31/2024) Compliance Requirement: Reporting Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or specific requirement: Compliance: Per the U.S. Treasury’s Project and Expenditure Report User Guide, each State and Local Fiscal Recovery Fund (SLFRF) recipient is required to submit periodic reports with current performance and/or financial information including background information about the SLFRF projects that are the subjects of the reports; and financial information with details about obligations, expenditures, direct payments, and subawards. Financial information includes: a. Current period obligation b. Cumulative obligation c. Current period expenditure d. Cumulative expenditure Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: Current period obligations reported did not agree to supporting documentation. Context: Two of four quarterly project and expenditure reports were selected for testing. The 12/31/2022 quarter included obligations and expenditures for 113 projects. Of the projects reported, supporting documentation indicated that 35 projects incurred current period obligations, but the Agency of Administration (Agency) reported $0 current period obligations for 34 of 35 projects. Thirty-four projects were incorrectly reported. Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Cause: The Agency’s procedures over project and expenditure reporting were insufficient to ensure that financial information was reported accurately and tied to supporting documentation. The Agency utilizes upload templates to populate the Treasury reporting portal. When obligation and expenditure data was uploaded for the 12/31/2022 quarter, their procedures and controls did not detect that current period obligations had been incorrectly reported to the reporting portal. Effect: Current period obligation data was inaccurately reported to Treasury. Questioned costs: Undetermined. Recommendation: We recommend the Agency review and enhance internal controls and procedures to ensure that financial information reported is accurate and ties to supporting documentation. Views of responsible officials: Management agrees with the finding.

Reference Number: 2023-010 Prior Year Finding: 2022-021 Federal Agency: U.S. Department of the Treasury State Agency: Agency of Administration Federal Program: COVID-19 – Coronavirus State and Local Fiscal Recovery Funds Assistance Listing Number: 21.027 Award Number and Year: SLFRP4407 (3/1/2021 – 12/31/2024) Compliance Requirement: Subrecipient Monitoring Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance – 2 CFR §200.332(a) - Requirements for Pass-Through Entities, states in part, that all pass-through entities must ensure that every subaward is clearly identified to the subrecipient as a subaward and includes information at the time of the subaward and if any of these data elements change, include the changes in subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward. Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: Required federal award information was omitted from subaward agreements issued using program funds. Context: The Agency of Administration (Agency) has oversight responsibility for Coronavirus State and Local Fiscal Recovery Funds expenditures and reporting for the State of Vermont (the State). Multiple agencies and departments within the State incur costs and issue subawards with program funding. Twenty-nine subrecipients were selected for testing, consisting of thirty-seven individual subawards issued by multiple agencies and departments. For 10 of 37 subaward agreements selected for testing, the Department of Public Service (Department) omitted the following required Federal information: • Federal Award Identification Number (FAIN) • Federal Award Date Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Cause: The Department did not establish effective internal controls and procedures over subrecipient monitoring. It was unable to ensure that it provided all required information to its subrecipients upon award issuance. The Agency’s oversight of the program did not detect the error. Effect: Excluding the required federal grant award information at the time of subaward issuance may cause subrecipients and their auditors to be uninformed about specific program and other regulations that apply to the funds they receive. There is also the potential for subrecipients to have incomplete Schedules of Expenditures of Federal Awards (SEFA) in their Single Audit reports. Questioned costs: Undetermined. Recommendation: We recommend the Agency work with the Department to review and enhance internal controls and procedures to ensure that all required federal award information is included in subawards. We further recommend that the Agency review its oversight procedures and controls to ensure that all State agencies and departments that issue subawards under the program are in compliance with federal requirements. Views of responsible officials: Management agrees with the finding.

Reference Number: 2023-011 Prior Year Finding: No Federal Agency: U.S. Department of Transportation State Agency: Agency of Transportation Federal Program: Formula Grants for Rural Areas and Tribal Transit Program Assistance Listing Number: 20.509 Award Number and Year: VT2016-007-02 (9/23/2016 – 6/20/2023), VT-2017-007-01 (8/3/2017 – 6/21/2023), VT-2019-006-01 (9/20/2017 – 9/30/2022), VT-2020-005-00 (5/26/2020 – 9/30/2022), VT-2020-011-00 (9/9/2020 – 9/30/2023), VT-2020-012-00 (9/18/2020 – 9/30/2023), VT-2021-014-01 (9/20/2021 – 9/30/2023), VT-2022-001-02 (5/12/2022 – 6/30/2028) Compliance Requirement: Subrecipient Monitoring Type of Finding: Significant Deficiency in Internal Control over Compliance, Other Matters Criteria or specific requirement: Compliance – Per 2 CFR section 200.332, the following requirements are imposed on pass-through entities: (a) Ensure that every subaward is clearly identified to the subrecipient as a subaward and includes information at the time of the subaward and if any of these data elements change, include the changes in subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward. Required information includes: (1) (iii) Federal Award Identification Number (FAIN); (iv) Federal Award Date; (b) Evaluate each subrecipient's risk of noncompliance with Federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate subrecipient monitoring described in paragraphs (d) and (e) of this section, which may include consideration of such factors as: (1) The subrecipient's prior experience with the same or similar subawards; (2) The results of previous audits including whether or not the subrecipient receives a Single Audit in accordance with Subpart F of this part, and the extent to which the same or similar subaward has been audited as a major program; (3) Whether the subrecipient has new personnel or new or substantially changed systems; and (4) The extent and results of Federal awarding agency monitoring (e.g., if the subrecipient also receives Federal awards directly from a Federal awarding agency). (c) Consider imposing specific subaward conditions upon a subrecipient if appropriate as described in § 200.208. Section III – Findings and Questioned Costs – Major Federal Programs (Continued) (d) Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. Pass-through entity monitoring of the subrecipient must include: (1) Reviewing financial and performance reports required by the pass-through entity. (2) Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the Federal award provided to the subrecipient from the pass-through entity detected through audits, on-site reviews, and written confirmation from the subrecipient, highlighting the status of actions planned or taken to address Single Audit findings related to the particular subaward. (3) Issuing a management decision for applicable audit findings pertaining only to the Federal award provided to the subrecipient from the pass-through entity as required by § 200.521. (4) The pass-through entity is responsible for resolving audit findings specifically related to the subaward and not responsible for resolving crosscutting findings. If a subrecipient has a current Single Audit report posted in the Federal Audit Clearinghouse and has not otherwise been excluded from receipt of Federal funding (e.g., has been debarred or suspended), the pass-through entity may rely on the subrecipient's cognizant audit agency or cognizant oversight agency to perform audit follow-up and make management decisions related to cross-cutting findings in accordance with section § 200.513(a)(3)(vii). Such reliance does not eliminate the responsibility of the pass-through entity to issue subawards that conform to agency and award-specific requirements, to manage risk through ongoing subaward monitoring, and to monitor the status of the findings that are specifically related to the subaward. (e) Depending upon the pass-through entity's assessment of risk posed by the subrecipient (as described in paragraph (b) of this section), the following monitoring tools may be useful for the pass-through entity to ensure proper accountability and compliance with program requirements and achievement of performance goals: (1) Providing subrecipients with training and technical assistance on program-related matters; and (2) Performing on-site reviews of the subrecipient's program operations; (3) Arranging for agreed-upon-procedures engagements as described in § 200.425. Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Vermont Agency of Transportation (VTrans) omitted required federal award information from subawards it issued in the program and did not adequately monitor subrecipients. Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Context: Seven subawards were selected for testing and the following exceptions were noted: • For seven of seven subawards selected for testing, the FAIN and federal award date were not included on the subaward agreement. • For three of seven subawards selected for testing, the last on-site subrecipient monitoring visits were performed in FY 2020 and the next on-site monitoring is not scheduled to take place until FY 2024. Per the VTrans subrecipient monitoring plan, on-site monitoring must be performed no less than every three years. Cause: Procedures and internal controls were not sufficient to ensure that subawards included all required federal information. Although VTrans subsequently modified its subaward issuance process, controls in effect during the audit period were not sufficient to ensure that subawards included all required information. Procedures and internal controls were also not sufficient to ensure that timely on-site monitoring visits were performed in accordance with its monitoring plan. Effect: Excluding the required federal grant award information at the time of subaward issuance may cause subrecipients and their auditors to be uninformed about specific program and other regulations that apply to the funds they receive. There is also the potential for subrecipients to have incomplete Schedules of Expenditures of Federal Awards (SEFA) in their Single Audit reports. Failure to conduct adequate subrecipient monitoring may result in a failure of VTrans to detect that subawards were used for unauthorized purposes, were managed in violation of the terms and conditions of the subawards, or that subaward performance goals were not achieved. There is an increased risk that subrecipients could be inappropriately spending and/or inaccurately tracking and reporting federal funds over multiple year periods, and these discrepancies may not be properly monitored, detected, and corrected by VTrans personnel on a timely basis. Questioned costs: Undetermined. Recommendation: VTrans should review and enhance internal controls and procedures to ensure that all required federal award information is included in subawards and that on-site subrecipient monitoring is conducted timely per the terms of its subrecipient monitoring plan. Views of responsible officials: Management agrees with the finding.

Reference Number: 2023-012 Prior Year Finding: 2022-024 Federal Agency: U.S. Department of Education State Agency: Agency of Education Federal Program: Special Education Cluster, COVID-19 – Special Education Cluster Assistance Listing Number: 84.027 and 84.173 Award Number and Year: H027A210098 (7/1/2021 – 9/30/2022), H173A200106 (7/1/2020 – 9/30/2022), H173A210106 (7/1/2021 – 9/30/2022), H027A220098 (7/1/2022 – 9/30/2023) Compliance Requirement: Cash Management Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: US Department of the Treasury (Treasury) regulations at 31 CFR Part 205 implement the Cash Management Improvement Act of 1990 (CMIA), as amended (Pub. L. No. 101-453; 31 USC 6501 et seq.). Subpart A of those regulations requires state recipients to enter into Treasury-State Agreements that prescribe specific methods of drawing down federal funds (funding techniques) for federal programs listed in the Assistance Listing (Catalog of federal Domestic Assistance) that meet the funding threshold for a major federal assistance program under the CMIA. Treasury-State Agreements also specify the terms and conditions under which an interest liability would be incurred. Programs not covered by a Treasury-State Agreement are subject to procedures prescribed by Treasury in Subpart B of 31 CFR Part 205 (Subpart B), which at 31 CFR section 205.33(a) include the requirement for a state to minimize the time between the drawdown of federal funds and their disbursement for federal program purposes. Per 2 CFR section 200.514(a)(5), if a State fails to request funds timely as set forth in 2 CFR section 205.29, or otherwise fails to apply a funding technique properly, we may deny any resulting Federal interest liability, notwithstanding any other provision of this section. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Agency of Education (Agency) was not in compliance with the funding techniques included in the State’s FY2023 CMIA Treasury-State Agreement. Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Context: The funding techniques for the program require that cash draws are performed on a bi-weekly basis, or 26 times during the fiscal year. Instead, the Agency performed cash draws on a random basis throughout the year. Cause: The Agency’s corrective action plan from the FY2022 audit finding was in-process and had not been fully implemented during FY2023. Effect: The Cash Management Improvement Act is intended to minimize the time between the transfer of federal funds to States and the payout of those funds for program purposes. When the Agency does not draw down federal funds timely per the funding techniques included in the Treasury-State Agreement, it causes the State to advance its own funds for federal program purposes, negatively impacting the State’s cash flow. Questioned costs: Undetermined. Recommendation: We recommend the Agency complete its FY2022 corrective action plan to ensure that cash draws are performed timely and in accordance with the funding techniques included in the State’s Treasury-State Agreement. Views of responsible officials: Management agrees with the finding.

Reference Number: 2023-013 Prior Year Finding: No Federal Agency: U.S. Department of Education State Agency: Agency of Education Federal Program: Special Education Cluster, COVID-19 – Special Education Cluster Assistance Listing Number: 84.027 and 84.173 Award Number and Year: H027A210098 (7/1/2021 – 9/30/2022), H173A200106 (7/1/2020 – 9/30/2022), H173A210106 (7/1/2021 – 9/30/2022), H027A220098 (7/1/2022 – 9/30/2023) Compliance Requirement: Allowable Costs/Cost Principles Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Compliance: 2 CFR section 200.403 states, in part, except where otherwise authorized by statute, costs must meet the following general criteria in order to be allowable under Federal awards: (a) Be necessary and reasonable for the performance of the Federal award and be allocable thereto under these principles. (b) Conform to any limitations or exclusions set forth in these principles or in the Federal award as to types or amount of cost items. (c) Be consistent with policies and procedures that apply uniformly to both federally-financed and other activities of the non-Federal entity. (d) Be accorded consistent treatment. A cost may not be assigned to a Federal award as a direct cost if any other cost incurred for the same purpose in like circumstances has been allocated to the Federal award as an indirect cost. (e) Be determined in accordance with generally accepted accounting principles (GAAP), except, for state and local governments and Indian tribes only, as otherwise provided for in this part. (f) Not be included as a cost or used to meet cost sharing or matching requirements of any other federally-financed program in either the current or a prior period. (g) Be adequately documented. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Condition: Documentation provided to auditors by the Agency of Education (Agency) supporting a subrecipient payment did not agree to the payment made. Context: For six of forty subrecipient payment transactions selected for testing, the Agency did not follow its procedures to verify that supporting documentation provided for reimbursement by the Local Educational Agency (LEA) agreed with the payment requested. Cause: Internal controls were not sufficient to ensure that the Agency followed its established procedures to review and maintain documentation supporting reimbursement requests submitted by LEAs prior to the issuance of payments. Effect: When payment processing procedures are not followed, reimbursement for unallowable or unsupported expenditures could occur. Although the Agency did not follow its procedures at the time of payment, documentation was subsequently provided supporting the payment, and allowability was verified. Questioned costs: None noted. Allowability of the payment amount was verified. Recommendation: We recommend the Agency reviews and enhances its controls regarding subrecipient payment processing to ensure that, prior to issuing reimbursement payments, support provided by LEAs is reviewed for completeness and allowability and that supporting documentation is maintained. Views of responsible officials: Management agrees with the finding.

Reference Number: 2023-014 Prior Year Finding: No Federal Agency: U.S. Department of Education State Agency: Agency of Education Federal Program: Special Education Cluster, COVID-19 – Special Education Cluster Assistance Listing Number: 84.027 and 84.173 Award Number and Year: H027A210098 (7/1/2021 – 9/30/2022), H173A200106 (7/1/2020 – 9/30/2022), H173A210106 (7/1/2021 – 9/30/2022), H027A220098 (7/1/2022 – 9/30/2023) Compliance Requirement: Subrecipient Monitoring Type of Finding: Significant Deficiency in Internal Control over Compliance, Other Matters Criteria or specific requirement: Compliance – Per 2 CFR section 200.332, the following requirements are imposed on pass-through entities: (b) Ensure that every subaward is clearly identified to the subrecipient as a subaward and includes information at the time of the subaward and if any of these data elements change, include the changes in subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward. Required information includes: (2) (vii) Amount of Federal Funds Obligated by this action by the pass-through entity to the subrecipient. Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Vermont Agency of Education (Agency) omitted required information from subawards it issued for the program. Context: For 2 of 8 subawards selected for testing, the amount of federal funds obligated by this action was not included on the subaward agreement. Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Cause: Procedures and internal controls were not sufficient to ensure that subawards included all required information. Effect: Excluding the required federal grant award information at the time of subaward issuance may cause subrecipients and their auditors to be uninformed about specific program and other regulations that apply to the funds they receive. There is also the potential for subrecipients to have incomplete Schedules of Expenditures of Federal Awards (SEFA) in their Single Audit reports. Questioned costs: None noted. Recommendation: The Agency should review and enhance internal controls and procedures to ensure that all required federal award information is included in subaward agreements. Views of responsible officials: Management agrees with the finding.

Reference Number: 2023-015 Prior Year Finding: No Federal Agency: U.S. Department of Education State Agency: Agency of Education Federal Program: Supporting Effective Instruction State Grants (formerly Improving Teacher Quality State Grants) Assistance Listing Number: 84.367 Award Number and Year: S367A210043 (7/1/2021 – 9/30/2022), S367A220043 (7/1/2022 – 9/30/2023) Compliance Requirement: Allowable Costs/Cost Principles Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Compliance: 2 CFR section 200.403 states, in part, except where otherwise authorized by statute, costs must meet the following general criteria in order to be allowable under Federal awards: (a) Be necessary and reasonable for the performance of the Federal award and be allocable thereto under these principles. (b) Conform to any limitations or exclusions set forth in these principles or in the Federal award as to types or amount of cost items. (c) Be consistent with policies and procedures that apply uniformly to both federally-financed and other activities of the non-Federal entity. (d) Be accorded consistent treatment. A cost may not be assigned to a Federal award as a direct cost if any other cost incurred for the same purpose in like circumstances has been allocated to the Federal award as an indirect cost. (e) Be determined in accordance with generally accepted accounting principles (GAAP), except, for state and local governments and Indian tribes only, as otherwise provided for in this part. (f) Not be included as a cost or used to meet cost sharing or matching requirements of any other federally-financed program in either the current or a prior period. (g) Be adequately documented. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: Documentation provided to auditors by the Agency of Education (Agency) supporting a subrecipient payment did not agree to the payment made. Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Context: For one of forty subrecipient payment transactions selected for testing, the Agency did not follow its procedures to verify that supporting documentation provided for reimbursement by the Local Educational Agency (LEA) agreed with the payment requested. Cause: Internal controls were not sufficient to ensure that the Agency followed its established procedures to review and maintain documentation supporting reimbursement requests submitted by LEAs prior to the issuance of payments. Effect: When payment processing procedures are not followed, reimbursement for unallowable or unsupported expenditures could occur. Although the Agency did not follow its procedures at the time of payment, documentation was subsequently provided supporting the payment and allowability was verified. Questioned costs: None noted. Allowability of the payment amount was verified. Recommendation: We recommend the Agency reviews and enhances its controls regarding subrecipient payment processing to ensure that, prior to issuing reimbursement payments, support provided by LEAs is reviewed for completeness and allowability and that supporting documentation is maintained. Views of responsible officials: Management agrees with the finding.

Reference Number: 2023-016 Prior Year Finding: No Federal Agency: U.S. Department of Education State Agency: Agency of Education Federal Program: Supporting Effective Instruction State Grants (formerly Improving Teacher Quality State Grants) Assistance Listing Number: 84.367 Award Number and Year: S367A210043 (7/1/2021 – 9/30/2022), S367A220043 (7/1/2022 – 9/30/2023) Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. The following key data elements must be reported: Subawardee Name and Data Universal Numbering System (DUNS) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $25,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Condition: Subawards were not reported timely or accurately to FSRS in accordance with FFATA requirements. Context: Nine subawards were selected for testing which included the original subawards and eighteen subaward amendments for a total of twenty-seven transactions tested. Specifically, the following exceptions were noted: • 7 of 27 subawards were not reported timely to FSRS. • 4 of 18 subaward amendments reported an incorrect amount to FSRS. When reporting the amendments, the Agency reported the cumulative subaward amount rather than only the current amendment amount. This resulted in an overstatement of the total amount reported for these subawards. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE Cause: The Agency’s procedures were not sufficient to ensure that all subawards and subaward amendments were reported timely and accurately to FSRS. Internal controls did not prevent or detect the errors. Effect: Subawards were not reported timely or accurately to FSRS in accordance with FFATA requirements. Questioned costs: None noted. Recommendation: We recommend the Agency review and enhance internal controls and procedures to ensure that all required subawards and subaward amendments are reported accurately and timely to FSRS no later than the end of the month following the month of issuance. Views of responsible officials: Management agrees with the finding.

Reference Number: 2023-017 Prior Year Finding: No Federal Agency: U.S. Department of Education State Agency: Agency of Education Federal Program: Supporting Effective Instruction State Grants (formerly Improving Teacher Quality State Grants) Assistance Listing Number: 84.367 Award Number and Year: S367A210043 (7/1/2021 – 9/30/2022), S367A220043 (7/1/2022 – 9/30/2023) Compliance Requirement: Subrecipient Monitoring Type of Finding: Significant Deficiency in Internal Control over Compliance, Other Matters Criteria or specific requirement: Compliance – Per 2 CFR section 200.332, the following requirements are imposed on pass-through entities: (c) Ensure that every subaward is clearly identified to the subrecipient as a subaward and includes information at the time of the subaward and if any of these data elements change, include the changes in subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward. Required information includes: (3) (ii) Subrecipient's unique entity identifier; (vii) Amount of Federal Funds Obligated by this action by the pass-through entity to the subrecipient. Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Vermont Agency of Education (Agency) omitted required information from subawards it issued for the program. Context: Eight subawards were selected for testing and the following exceptions were noted: • For 1 of 8 subawards selected for testing, the subrecipient’s unique entity identifier was not included on the subaward agreement. Section III – Findings and Questioned Costs – Major Federal Programs (Continued) • For 3 of 8 subawards selected for testing, the amount of federal funds obligated by this action was not included on the subaward agreement. Cause: Procedures and internal controls were not sufficient to ensure that subawards included all required information. Effect: Excluding the required federal grant award information at the time of subaward issuance may cause subrecipients and their auditors to be uninformed about specific program and other regulations that apply to the funds they receive. There is also the potential for subrecipients to have incomplete Schedules of Expenditures of Federal Awards (SEFA) in their Single Audit reports. Questioned costs: None noted. Recommendation: The Agency should review and enhance internal controls and procedures to ensure that all required federal award information is included in subaward agreements. Views of responsible officials: Management agrees with the finding.

Reference Number: 2023-018 Prior Year Finding: 2022-029 Federal Agency: U.S. Department of Education State Agency: Agency of Education Federal Program: COVID-19 – Governor’s Emergency Education Relief Fund COVID-19 – Elementary and Secondary School Emergency Relief Fund (ESSER) COVID-19 – American Rescue Plan – Elementary and Secondary School Emergency Relief (ARP ESSER) Assistance Listing Number: 84.425C, 84.425D, 84.425U Award Number and Year: S425C210009 (1/8/2021 – 9/30/2022) S425D210011 (1/5/2021 – 9/30/2022) S425U210011 (3/24/2021 – 9/30/2023) Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or specific requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. The following key data elements must be reported: Subawardee Name and Data Universal Numbering System (DUNS) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $25,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Agency of Education (Agency) was not in compliance with FSRS reporting requirements. Subawards and subaward modifications were not reported to FSRS or were not reported timely. Context: Fifty-one subawards were selected for testing which included twenty-two original subawards and twenty-nine subaward amendments. Thirty-nine of fifty-one subawards selected for testing were not in compliance with FFATA reporting requirements. The following exceptions were noted: • 6 of 29 subaward amendments were not reported to FSRS. • 5 of 29 subaward amendments were not reported accurately to FSRS. When reporting the amendments, the Agency reported the cumulative subaward amount rather than only the current amendment amount. This resulted in an overstatement of the total amount reported for these subawards. • 29 of 51 subawards and subaward amendments were not reported timely to FSRS. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE Cause: The Agency’s procedures were not sufficient to ensure that all subawards and subaward amendments were reported timely and accurately to FSRS. Internal controls did not prevent or detect the errors. Effect: Subawards were not reported accurately or timely to FSRS in accordance with FFATA requirements. Questioned costs: None noted. Recommendation: We recommend the Agency review and enhance internal controls and procedures to ensure that all required subawards and subaward amendments are reported accurately and timely to FSRS no later than the end of the month following the month of issuance. Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Views of responsible officials: Management agrees with the finding.

Reference Number: 2023-019 Prior Year Finding: 2022-026 Federal Agency: U.S. Department of Education State Agency: Agency of Education (Agency) Federal Program: COVID-19 – Elementary and Secondary School Emergency Relief Fund (ESSER) Assistance Listing Number: 84.425D Award Number and Year: S425D200011 (4/29/2020 – 9/30/2021) Compliance Requirement: Special Tests and Provisions – Participation of Private School Children Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or specific requirement: Compliance: For programs under ESSER I and GEER I (Assistance Listing 84.425C and D), an LEA that receives funds under one or both of those programs must provide equitable services in the same manner as provided under section 1117 of Title I, Part A of the ESEA (20 USC 6320) (Assistance Listing 84.010) to students and teachers in private schools as determined in consultation with private school officials (section 18005(a) of the CARES Act). To meet this requirement, a Local Education Agency (LEA) must determine the proportional share of ESSER I or GEER I funds available for equitable services in accordance with section 1117(a)(4)(A) of the ESEA (20 USC 6320(a)(4)(A)). Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Agency of Education (Agency) was not able to support the calculation of Participation of Private School Children set-aside amounts. Context: For 12 of 12 LEAs selected for testing, the Agency was unable to provide support to validate that the ESSER set-aside amounts for private school children had been determined appropriately. The total set asides were determined at the school district level and support was maintained at the LEA and not at the non-public (independent) school level. Therefore, auditors could not verify the accuracy of the set-aside calculations. Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Cause: The Agency’s procedures and internal controls were not sufficient to ensure it maintained documentation supporting private school set-aside calculations. Effect: Auditors were unable to verify that set-aside calculations were accurate and determined properly. Questioned costs: Undetermined. Recommendation: We recommend the Agency review and enhance internal controls and procedures over participation of private school children and that documentation supporting set-aside calculations is maintained and available for auditor review. Views of responsible officials: Management agrees with the finding.

Reference Number: 2022-020 Prior Year Finding: No Federal Agency: U.S. Department of Education State Agency: Agency of Education Federal Program: COVID-19 – Elementary and Secondary School Emergency Relief Fund (ESSER) COVID-19 – American Rescue Plan – Elementary and Secondary School Emergency Relief (ARP ESSER) Assistance Listing Number: 84.425D, 84.425U Award Number and Year: S425D210011 (1/5/2021 – 9/30/2022) S425U210011 (3/24/2021 – 9/30/2023) Compliance Requirement: Subrecipient Monitoring Type of Finding: Significant Deficiency in Internal Control over Compliance, Other Matters Criteria or specific requirement: Compliance – Per 2 CFR section 200.332, the following requirements are imposed on pass-through entities: (d) Ensure that every subaward is clearly identified to the subrecipient as a subaward and includes information at the time of the subaward and if any of these data elements change, include the changes in subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward. Required information includes: (4) (ii) Subrecipient's unique entity identifier; (vii) Amount of Federal Funds Obligated by this action by the pass-through entity to the subrecipient. Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Vermont Agency of Education (Agency) omitted required information from subawards it issued for the program. Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Context: Twenty-seven subawards were selected for testing and the following exceptions were noted: • For 4 of 27 subawards selected for testing, the subrecipient’s unique entity identifier was not included on the subaward agreement. • For 8 of 27 subawards selected for testing, the amount of federal funds obligated by this action was not included on the subaward agreement. Cause: Procedures and internal controls were not sufficient to ensure that subawards included all required information. Effect: Excluding the required federal grant award information at the time of subaward issuance may cause subrecipients and their auditors to be uninformed about specific program and other regulations that apply to the funds they receive. There is also the potential for subrecipients to have incomplete Schedules of Expenditures of Federal Awards (SEFA) in their Single Audit reports. Questioned costs: None noted. Recommendation: The Agency should review and enhance internal controls and procedures to ensure that all required federal award information is included in subaward agreements. Views of responsible officials: Management agrees with the finding.

Reference Number: 2023-021 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Agency of Human Services Federal Program: Low-Income Home Energy Assistance, COVID-19 – Low-Income Home Energy Assistance Assistance Listing Number: 93.568 Award Number and Year: 2101VTLIEA (10/1/2020 – 9/30/2022), 2101VTLWC5 (5/28/2021 – 9/30/2023), 2101VTLWC6 (5/28/2021 – 9/30/2023), 2101VTE5C6 (3/11/2021 – 9/30/2022), 2301VTLIEA (10/1/2022 – 9/30/2024), 2301VTLIEE (10/1/2022 – 9/30/2024), 2301VTLIEI (10/1/2022 – 9/30/2024) Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. The following key data elements must be reported: Subawardee Name and Data Universal Numbering System (DUNS) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $25,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Agency of Human Services (Agency) did not report subaward information to FSRS in accordance with FFATA reporting requirements. Context: Eleven subawards were selected for testing which included seven initial subawards and four amendments. We noted the following exceptions: • Two of seven initial subawards were not reported to FSRS until after auditors requested samples for testing. • One of four amendments was not reported to FSRS. • Two of seven initial subawards were not reported to FSRS timely. The subawards were reported 28 days late. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE Cause: The Agency’s internal controls were not operating sufficiently to ensure that subawards were reported to FSRS in accordance with FFATA reporting requirements. Two of the subaward exceptions were not reported to FSRS until after auditors had selected them for testing. In addition, the Agency noted that for Weatherization subawards, their internal procedure is to amend the total subaward amount at the end of the grant period, but the Agency does not report these amendments to FSRS. Effect: The program was not in compliance with FFATA reporting requirements. Questioned costs: None noted. Recommendation: We recommend the Agency review and enhance internal controls and procedures to ensure that all required subawards are reported timely to FSRS no later than the end of the month following the month of issuance or amendment, in accordance with FFATA requirements. Views of responsible officials: Management agrees with the finding.

Reference Number: 2023-022 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Agency of Human Services Federal Program: Low-Income Home Energy Assistance, COVID-19 – Low-Income Home Energy Assistance Assistance Listing Number: 93.568 Award Number and Year: 2101VTLWC6 (5/28/2021 – 9/30/2023) Compliance Requirement: Reporting Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: The SF-425 Federal Financial Report is due annually no later than December 31st via the Payment Management System (PMS). This report concerns the obligation balances for each federal fiscal year and for each type of Low-Income Home Energy Assistance Program (LIHEAP) grant award (block grants, reallotment, emergency contingency, Leveraging, and REACH). A report is required from those recipients expending up to 5 percent of funds under section 2605(b)(16) (42 USC 8624(b)(16)). Low Income Household Water Assistance Program (LIHWAP) recipients must track, account for, and report on, the LIHWAP funding separate from the rest of their funding. The Office of Community Services provided guidance to LIHWAP grant recipients of an extension to the annual report deadline for reports for the period ending September 30, 2022. The due date for this report was extended to no later than January 30, 2023. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Agency of Human Services (Agency) did not submit the annual SF-425 Federal Financial Report for the 2021 LIHWAP award by the January 30, 2023 extended due date. Context: Five annual SF-425 Federal Financial Reports were selected for testing, and we noted that one of five reports was not submitted timely. The 2021 LIHWAP annual report for the period ending September 30, 2022 was due no later than January 30, 2023 but was not submitted until February 24, 2023, or 25 days late. Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Cause: Procedures and controls were insufficient to ensure that annual Federal Financial reports were filed timely. Effect: Untimely filing of annual reports could impact the federal agency’s ability to monitor the program. Questioned costs: None noted. Recommendation: We recommend the Agency review and enhance internal controls and procedures to ensure that all required annual reports are filed timely. Views of responsible officials: Management agrees with the finding.

Reference Number: 2023-023 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Department of Finance and Management Federal Program: Low-Income Home Energy Assistance COVID-19 – Low-Income Home Energy Assistance Assistance Listing Number: 93.568 Award Number and Year: 2101VTLIEA (10/1/2020 – 9/30/2022), 2101VTLWC5 (5/28/2021 – 9/30/2023), 2101VTLWC6 (5/28/2021 – 9/30/2023), 2101VTE5C6 (3/11/2021 – 9/30/2022), 2301VTLIEA (10/1/2022 – 9/30/2024), 2301VTLIEE (10/1/2022 – 9/30/2024), 2301VTLIEI (10/1/2022 – 9/30/2024) Compliance Requirement: Cash Management Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: US Department of the Treasury (Treasury) regulations at 31 CFR Part 205 implement the Cash Management Improvement Act of 1990 (CMIA), as amended (Pub. L. No. 101-453; 31 USC 6501 et seq.). Subpart A of those regulations requires state recipients to enter into Treasury-State Agreements that prescribe specific methods of drawing down federal funds (funding techniques) for federal programs listed in the Assistance Listing (Catalog of federal Domestic Assistance) that meet the funding threshold for a major federal assistance program under the CMIA. Treasury-State Agreements also specify the terms and conditions under which an interest liability would be incurred. Programs not covered by a Treasury-State Agreement are subject to procedures prescribed by Treasury in Subpart B of 31 CFR Part 205 (Subpart B), which at 31 CFR section 205.33(a) include the requirement for a state to minimize the time between the drawdown of federal funds and their disbursement for federal program purposes. Annual Reports are submitted electronically by December 31 of each year. The Annual Report includes Federal interest liabilities, State interest liabilities, and State direct cost claims. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Condition: The Department of Finance and Management (Finance) improperly calculated the federal interest liability for the program on the CMIA Annual Report. Context: The annual interest rate is established by the U.S. Treasury and published on its CMIA website. Finance is the responsible State entity for calculation of interest and completion of the CMIA Annual Report. When it calculated interest for the program in preparation of the FY2023 Annual Report, Finance did not apply the correct interest rate. Cause: Finance’s CMIA Annual Report procedures were not sufficient to ensure that it used the interest rate established by the U.S. Treasury when it calculated interest liabilities for the program. Internal controls did not prevent or detect the error. Effect: Improperly calculating Federal interest liabilities could potentially allow the State to receive interest payments to which it is not entitled per 2 CFR section 200.514. Questioned costs: None. The error did not result in an unallowable federal interest liability. Recommendation: We recommend that Finance review and enhance its internal controls and procedures over cash management to ensure that federal interest liabilities are properly calculated in accordance with 2 CFR section 200.514. Views of responsible officials: Management agrees with the finding.

Reference Number: 2023-024 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Agency of Human Services Federal Program: COVID-19 - Activities to Support State, Tribal, Local and Territorial (STLT) Health Department Response to Public Health or Healthcare Crises Assistance Listing Number: 93.391 Award Number and Year: NH75OT000034 (6/1/2021 – 5/31/2024) Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or specific requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. The following key data elements must be reported: Subawardee Name and Data Universal Numbering System (DUNS) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $25,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Condition: Subawards were not reported timely to FSRS in accordance with FFATA requirements. Context: Four of eight subawards selected for testing were not reported to FSRS in accordance with FFATA requirements. Specifically, we noted the following exceptions: • Three of eight subawards were not reported to FSRS until after auditors requested samples for testing. The subawards were issued between 12/31/2021 and 4/1/2022 but were not reported to FSRS until 10/31/2023. • One of eight subawards was not reported to FSRS timely. The subaward should have been reported to FSRS by 3/31/2022, but it was not reported until 4/22/2022, or 22 days late. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE Cause: The Agency’s procedures were not sufficient to ensure that subawards were reported to FSRS in accordance with FFATA reporting requirements. Internal controls did not detect or prevent the errors. Effect: Subawards were not reported to FSRS in accordance with FFATA requirements. Questioned costs: None noted. Recommendation: We recommend the Agency review and enhance internal controls and procedures to ensure that all required subawards are reported timely to FSRS no later than the end of the month following the month of issuance or amendment, in accordance with FFATA requirements. Views of responsible officials: Management agrees with the finding.

Reference Number: 2023-025 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Agency of Human Services Federal Program: COVID-19 - Activities to Support State, Tribal, Local and Territorial (STLT) Health Department Response to Public Health or Healthcare Crises Assistance Listing Number: 93.391 Award Number and Year: NH75OT000034 (6/1/2021 – 5/31/2024) Compliance Requirement: Procurement Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: Per 2 CFR section 200.324(a), the non-Federal entity must perform a cost or price analysis in connection with every procurement action in excess of the Simplified Acquisition Threshold including contract modifications. The method and degree of analysis is dependent on the facts surrounding the particular procurement situation, but as a starting point, the non-Federal entity must make independent estimates before receiving bids or proposals. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Agency of Human Services (Agency) was unable to provide documentation that a cost analysis was performed for a procurement action in excess of the Simplified Acquisition Threshold. Context: For one of seven contracts selected for testing, the Agency was unable to provide documentation that a cost analysis was performed. Cause: The Agency’s procedures were not sufficient to ensure that a cost analysis was performed for all procurement actions in excess of the Simplified Acquisition Threshold. Internal controls did not detect or prevent the error. Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Effect: Failure to perform a cost analysis could result in the Agency procuring goods or services that are not cost-effective nor in the best interest of the Agency or the program. Questioned costs: Undetermined. Recommendation: We recommend the Agency review and enhance internal controls and procedures to ensure that it performs a cost analysis for all procurement actions in excess of the Simplified Acquisition Threshold, including contract modifications. We further recommend that cost analysis documentation is maintained and readily available for audit. Views of responsible officials: Management agrees with the finding.

Reference Number: 2023-026 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Agency of Human Services Federal Program: Adoption Assistance Assistance Listing Number: 93.659 Award Number and Year: 2201VTADPT (7/1/2022 – 9/30/2022), 2301VTADPT (10/1/2022 – 6/30/2023) Compliance Requirement: Eligibility Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: Per 42 USC 673, each State shall enter into adoption assistance agreements (as defined in section 675(3)) with the adoptive parents of children with special needs in accordance with its approved State plan. Adoption assistance subsidy payments may be paid on behalf of a child only if they are determined to meet the program’s eligibility requirements: • Categorical Eligibility – The child meets the definition of an “applicable or non-applicable child” and meets the corresponding eligibility requirements per 42 USC 673. • The child was determined by the Title IV-E agency as someone who cannot or should not be returned to the home of his or her parents (42 USC 673(c)(1)). • The child was determined by the Title IV-E agency to be a child with special needs. • The Title IV-E agency has made reasonable efforts to place the child for adoption without a subsidy. • The agreement for the subsidy was signed and was in effect before the final decree of adoption and contains information concerning the nature of services; the amount and duration of the subsidy; the child’s eligibility for Title XX services and Title XIX Medicaid; and covers the child should he/she move out of state with the adoptive family (42 USC 675(3)). • The prospective adoptive parent(s) must satisfactorily have met a criminal records check, including a fingerprint-based check (42 USC 671(a)(20)(A)). • The prospective adoptive parent(s) and any other adult living in the home who has resided in the provider home in the preceding five years must satisfactorily have met a child abuse and neglect registry check. • Once a child is determined eligible to receive Title IV-E adoption assistance, he or she remains eligible and the subsidy continues until the age of 18 (or 21 if the Title IV-E agency determines that the child has a mental or physical disability which warrants the continuation of assistance). Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or Section III – Findings and Questioned Costs – Major Federal Programs (Continued) the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Agency of Human Services (Agency) was unable to provide documentation that participants receiving benefits under the program met eligibility requirements. Context: For two of forty participants selected for testing, the Agency was unable to provide documentation that the children were eligible for the program. Specifically, we noted the following exceptions: • For one of forty participants, documentation could not be provided that the child was eligible for the program. • For one of forty participants, the child turned eighteen on 3/26/2022 but remained in the program until 6/10/2023. Documentation could not be provided for the continuation of benefits after the child’s 18th birthday. Cause: The Agency’s procedures were not sufficient to ensure that documentation was maintained that participants were eligible to participate in the program. Internal controls did not detect or prevent the errors. Effect Subsidy payments were made on behalf of children that were not eligible for the program. Questioned costs: $16,362, the federal share of subsidy payments made during FY 2023 for ineligible participants. Recommendation: We recommend that the Agency review and enhance procedures and controls to ensure that eligibility documentation is maintained for all program participants and that it is readily available for audit. We further recommend that the Agency review and enhance procedures and controls for children turning eighteen to ensure that benefits are terminated on a timely basis or that a determination is made and documented if the child has a mental or physical disability which warrants the continuation of assistance. Views of responsible officials: Management agrees with the finding.

Reference Number: 2023-027 Prior Year Finding: 2022-035 Federal Agency: U.S. Department of Health and Human Services State Agency: Agency of Human Services (Agency) Federal Program: Children’s Health Insurance Program (CHIP) Assistance Listing Number: 93.767 Award Number and Year: 2205VT5021 (10/1/2021 – 9/30/2023) 2305VT5021 (10/1/2022 – 9/30/2024) 2305VT3002 (10/1/2022 – 9/30/2024) Compliance Requirement: Eligibility Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: States verify the financial and nonfinancial factors of eligibility by checking electronic data sources in accordance with federal requirements at 42 CFR 457.380 and state requirements (as documented in the CHIP state plan, verification plan, and eligibility manual). The state is required (as described at 42 CFR 457.965) to maintain facts in the case file to support the eligibility determination. The State must provide each applicant or enrollee with timely and adequate written notice of any decision affecting his or her eligibility, including an approval, denial or termination, or suspension of eligibility, consistent with sections 457.315, 457.348, and 457.350. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Agency of Human Services (Agency) terminated benefits for a CHIP participant without providing notification to the participant. Context: For one of sixty CHIP participants selected for testing, the Agency performed a recertification on 6/9/2023 to determine if the participant should be moved to the Medicaid program. On 6/30/2023, while the income verification was pending, the participant was removed from CHIP benefits without notification. Cause: The Agency did not adequately follow procedures regarding eligibility in accordance with federal program requirements. Internal controls did not detect or prevent the error. Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Effect A participant’s benefits were terminated without proper notification. Questioned costs: Undetermined. Recommendation: We recommend that the Agency review and enhance procedures and controls for CHIP beneficiary eligibility determinations to ensure that it provides adequate written notice of any decision affecting a participant’s eligibility, including an approval, denial or termination, or suspension of eligibility, consistent with program regulations. Views of responsible officials: Management agrees with the finding.

Reference Number: 2023-028 Prior Year Finding: 2022-036 Federal Agency: U.S. Department of Health and Human Services State Agency: Agency of Human Services Federal Program: Children’s Health Insurance Program (CHIP) Assistance Listing Number: 93.767 Award Number and Year: 2205VT5021 (10/1/2021 – 9/30/2023) 2305VT5021 (10/1/2022 – 9/30/2024) 2305VT3002 (10/1/2022 – 9/30/2024) Compliance Requirement: Special Tests and Provisions - Provider Eligibility Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: In order to receive CHIP payments, CHIP providers must: (1) be licensed in accordance with federal, state, and local laws and regulations to participate in the CHIP program (42 CFR 457.900); (2) screened and enrolled in accordance with 42 CFR Part 455, Subpart E (sections 455.400 through 455.470); and make certain disclosures to the state (42 CFR 457.990(a), cross referencing 455.107). CHIP managed care network providers are subject to the same disclosure, screening, enrollment, and termination requirements that apply to Medicaid fee-for-service providers in accordance with 42 CFR Part 438, Subpart H. Control: Per 2 CFR section 200.303(a), the non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Agency of Human Services (Agency) did not maintain documentation to support provider eligibility to participate in the CHIP program. Documentation of the providers’ tax standing was not maintained in the Provider Management Module (PMM). Context: For five of sixty providers selected for testing, documentation was incomplete to support that the providers were in good tax standing. The provider eligibility requirement is administered by a 3rd-party that determines and documents each provider’s eligibility with the Agency’s requirements. For the exceptions noted, the provider files in PMM did not contain a copy of the tax standing letter. The providers’ tax standing was validated verbally or by email with the Vermont Tax Department and the PMM system was documented indicating the providers had been verified to be in good standing; however, the tax standing letter was not uploaded to the PMM system. As part of a prior year Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Corrective Action Plan (CAP), a process has been implemented to require letters of good standing be uploaded to the provider file in PMM. These tax case verifications occurred prior to the implementation of the CAP. Cause: The Agency did not adequately follow procedures regarding documentation of CHIP provider eligibility in accordance with federal program requirements. Although the Agency had begun implementation of its corrective action plan from a prior year audit, the plan has not been completed. Effect: The Agency was unable to support provider eligibility or consistent application of their internal control process. Failure to maintain complete provider files could allow program payments to be made to an ineligible provider. Questioned costs: Undetermined. Recommendation: We recommend the Agency review and enhance its procedures and controls to ensure that documentation is maintained in accordance with the federal program requirements. Views of responsible officials: Management agrees with the finding.

Reference Number: 2023-029 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Agency of Human Services Federal Program: Medicaid Cluster Assistance Listing Number: 93.775, 93.777, 93.778 Award Number and Year: 2205VT5MAP (10/1/2021 – 9/30/2022) 2305VT5MAP (10/1/2022 – 9/30/2023) Compliance Requirement: Special Tests and Provisions – ADP Risk Analysis and System Security Review Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or specific requirement: Compliance: Per 45 CFR 95.621, the State Medicaid Agency (SMA) must establish and maintain a program for conducting periodic risk analyses to ensure that appropriate and cost-effective safeguards are incorporated into new and existing systems. SMAs must perform risk analyses whenever significant system changes occur. SMAs shall review the ADP system security installations involved in the administration of U.S. Department of Health and Human Services (HHS) programs on a biennial basis. At a minimum, the reviews shall include an evaluation of physical and data security operating procedures, and personnel practices. The SMA shall maintain reports on its biennial ADP system security reviews, together with pertinent supporting documentation, for HHS on-site reviews. If risks or deficiencies are noted, the SMA must take corrective action to resolve the issues. Control: Per 2 CFR section 200.303(a), the non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Agency of Human Services (Agency) did not develop a corrective action plan to address risks and deficiencies noted in the security controls assessment performed over its ACCESS system. Context: The Agency entered into a consulting agreement with JANUS Associates (JANUS) to perform a security controls assessment of its ACCESS system. On October 13, 2022, JANUS issued its final report which identified numerous control risks and deficiencies. After receipt of the report, the Agency did not develop or implement a corrective action plan to mitigate the risks nor resolve the deficiencies noted. Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Cause: The Agency did not allocate resources to address the risks and deficiencies noted in the JANUS report. Effect: Failure to develop and implement a corrective action plan could leave the ACCESS system vulnerable to potential security risks. The Agency is unable to provide assurance that the system is adequately controlled nor that it properly safeguards sensitive Medicaid data. Questioned costs: Undetermined. Recommendation: The Agency should evaluate the risks identified in the JANUS report and develop a prioritized corrective action plan to mitigate and resolve these risks. The Agency should implement the corrective action plan as soon as possible to provide assurance that the system is adequately controlled and properly safeguards sensitive Medicaid data. Views of responsible officials: Management agrees with the finding.

Reference Number: 2023-030 Prior Year Finding: 2022-038 Federal Agency: U.S. Department of Health and Human Services State Agency: Agency of Human Services Federal Program: Medicaid Cluster Assistance Listing Number: 93.775, 93.777, 93.778 Award Number and Year: 2205VT5MAP (10/1/2021 – 9/30/2022) 2305VT5MAP (10/1/2022 – 9/30/2023) Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. The following key data elements must be reported: Subawardee Name and Data Universal Numbering System (DUNS) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $25,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Condition: Subawards were not reported timely to FSRS in accordance with FFATA requirements. Context: The Agency of Human Services (Agency) Internal Audit Group (IAG) reports subaward information in FSRS for its various departments using subaward information provided by the departments. Nine subawards totaling $8,406,069 were selected for testing, including eight initial subawards and one subaward amendment. The following exceptions were noted: • One of eight initial subawards was not reported timely. The subaward should have been reported by October 31, 2022, but it was not reported until December 26, 2022, or 56 days late. • One of one subaward amendments was not reported timely. It should have been reported by September 30, 2022, but it was not reported until December 26, 2022, or 87 days late. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE As part of a prior year Corrective Action Plan (CAP), the Agency implemented a process to report required subawards to FSRS timely. The exceptions noted occurred prior to the implementation of the CAP. Cause: The individual departments did not provide the IAG with complete subaward information on a timely basis which caused errors and omissions in subaward reporting to FSRS. Effect: Subawards were not reported to FSRS in accordance with FFATA requirements. Questioned costs: None noted. Recommendation: We recommend the Agency complete implementation of its prior year CAP to ensure that all required subawards and subaward modifications are reported timely to FSRS in accordance with FFATA requirements. Views of responsible officials: Management agrees with the finding.

Reference Number: 2023-031 Prior Year Finding: 2022-037 Federal Agency: U.S. Department of Health and Human Services State Agency: Agency of Human Services Federal Program: Medicaid Cluster Assistance Listing Number: 93.775, 93.777, 93.778 Award Number and Year: 2205VT5MAP (10/1/2021 – 9/30/2022) 205VT5MAP (10/1/2022 – 9/30/2023) Compliance Requirement: Special Tests and Provisions - Provider Health and Safety Standards Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: Providers must meet the prescribed health and safety standards for hospital, nursing facilities, and ICF/IID (42 CFR part 442). The standards may be modified in the State Plan. The Medicaid Provider Enrollment Compendium (MPEC) requires that State Medicaid Agencies perform screening of providers based upon their risk level. Screening includes verifications of licenses and compliance with all federal and state regulations of the program. Control: Per 2 CFR section 200.303(a), the non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Agency of Human Services (Agency) did not maintain documentation to support providers’ compliance with the prescribed health and safety standards. The Agency requires that providers complete a health and safety agreement in which they attest to compliance with the Agency’s health and safety requirements. The provider eligibility and health and safety requirements are administered by a 3rd-party that determines and documents providers’ eligibility with the Agency’s requirements in the provider management module (PMM). Health and safety documentation was not consistently maintained in provider files and compliance could not be verified. Context: Sixty samples were selected for testing and health and safety standards could not be verified for the following: 1. For one of sixty providers, payments were made without current license information maintained in the PMM. As part of a prior year audit’s corrective action plan, the Agency attempted to obtain Section III – Findings and Questioned Costs – Major Federal Programs (Continued) an updated license for the provider and when it was determined that the license had expired, the provider was terminated. 2. For two of sixty providers, documentation was incomplete to support that the providers were in good tax standing. The providers’ tax standing was validated verbally or by email with the Vermont Tax Department and the PMM system was documented indicating the providers had been verified to be in good standing; however, the tax standing letter was not uploaded to the PMM system. As part of a prior year Corrective Action Plan (CAP), a process has been implemented to require letters of good standing be uploaded to the provider file in PMM. These tax case verifications occurred prior to the implementation of the CAP. Cause: The Agency’s 3rd-Party provider did not consistently maintain current license and verification of tax standing documentation in the PMM. Although the Agency had begun implementation of its corrective action plan from a prior year audit, the plan has not been completed. Effect: Failure to verify and document compliance with health and safety standards could allow ineligible providers to perform services under the Medicaid program. Questioned costs: Undetermined. Recommendation: We recommend the Agency review and enhance its procedures and controls to ensure that documentation is maintained in accordance with program requirements and that all providers are compliant with required health and safety standards. Views of responsible officials: Management agrees with the finding.

Reference Number: 2023-032 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Department of Finance and Management Federal Program: Medicaid Cluster Assistance Listing Number: 93.775, 93.777, 93.778 Award Number and Year: 2205VT5MAP (10/1/2021 – 9/30/2022) 205VT5MAP (10/1/2022 – 9/30/2023) Compliance Requirement: Cash Management Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: US Department of the Treasury (Treasury) regulations at 31 CFR Part 205 implement the Cash Management Improvement Act of 1990 (CMIA), as amended (Pub. L. No. 101-453; 31 USC 6501 et seq.). Subpart A of those regulations requires state recipients to enter into Treasury-State Agreements that prescribe specific methods of drawing down federal funds (funding techniques) for federal programs listed in the Assistance Listing (Catalog of federal Domestic Assistance) that meet the funding threshold for a major federal assistance program under the CMIA. Treasury-State Agreements also specify the terms and conditions under which an interest liability would be incurred. Programs not covered by a Treasury-State Agreement are subject to procedures prescribed by Treasury in Subpart B of 31 CFR Part 205 (Subpart B), which at 31 CFR section 205.33(a) include the requirement for a state to minimize the time between the drawdown of federal funds and their disbursement for federal program purposes. Annual Reports are submitted electronically by December 31 of each year. The Annual Report includes Federal interest liabilities, State interest liabilities, and State direct cost claims. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Finance and Management (Finance) improperly calculated the federal interest liability for the program on the CMIA Annual Report. Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Context: The annual interest rate is established by the U.S. Treasury and published on its CMIA website. Finance is the responsible State entity for calculation of interest and completion of the CMIA Annual Report. When it calculated interest for the program in preparation of the FY2023 Annual Report, Finance did not apply the correct interest rate. Cause: Finance’s CMIA Annual Report procedures were not sufficient to ensure that it used the interest rate established by the U.S. Treasury when it calculated interest liabilities for the program. Internal controls did not prevent or detect the error. Effect: Improperly calculating Federal interest liabilities could potentially allow the State to receive interest payments to which it is not entitled per 2 CFR section 200.514. Questioned costs: $113, the amount of the federal interest liability claimed in error. Recommendation: We recommend that Finance review and enhance its internal controls and procedures over cash management to ensure that federal interest liabilities are properly calculated in accordance with 2 CFR section 200.514. Views of responsible officials: Management agrees with the finding.

Reference Number: 2023-033 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Agency of Human Services Federal Program: Block Grants for Prevention and Treatment of Substance Abuse; COVID-19 - Block Grants for Prevention and Treatment of Substance Abuse Assistance Listing Number: 93.959 Award Number and Year: B08TI084611 (10/1/2021 – 9/30/2024), B08TI083971 (9/1/2021 – 9/30/2025), B08TI083516 (3/15/2021 – 3/14/2023), B08TI083480 (10/1/2020 – 9/30/2022), B08TI084675 (10/1/2021 – 9/30/2023) Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. The following key data elements must be reported: Subawardee Name and Data Universal Numbering System (DUNS) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $25,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Agency of Human Services (Agency) did not report subaward information to FSRS in accordance with FFATA reporting requirements. Context: Thirteen subawards were selected for testing which included eight initial subawards and five amendments. We noted the following exceptions: • One of five amendments was not reported to FSRS. • Two of eight initial subawards were not reported to FSRS timely. The subawards were reported 22 and 29 days late. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE Cause: The Agency’s procedures were not sufficient to ensure that all subawards and subaward amendments were reported timely to FSRS. Internal controls did not prevent or detect the errors. Effect: The program was not in compliance with FFATA reporting requirements. Questioned costs: None noted. Recommendation: We recommend the Agency review and enhance internal controls and procedures to ensure that all required subawards and subaward amendments are reported timely to FSRS no later than the end of the month following the month of issuance, in accordance with FFATA requirements. Views of responsible officials: Management agrees with the finding.

Reference Number: 2023-034 Prior Year Finding: No Federal Agency: U.S. Department of Homeland Security State Agency: Department of Public Safety Federal Program: Disaster Grants - Public Assistance (Presidentially Declared Disasters) Assistance Listing Number: 97.036 Award Number and Year: FEMA-4445-DR-VT (2019), FEMA-4474-DR-VT (2020), FEMA-4532-DR-VT (2020), FEMA-4621-DR-VT (2021) Compliance Requirement: Reporting – Federal Funding Accountability and Transparency Act (FFATA) Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or specific requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. The following key data elements must be reported: Subawardee Name and Data Universal Numbering System (DUNS) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $25,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. §§ 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Section III – Findings and Questioned Costs – Major Federal Programs (Continued) Condition: The Department of Public Safety (Department) was not in compliance with FSRS reporting requirements. Subawards and subaward modifications were not reported timely or accurately to FSRS. Context: Forty-four subawards were selected for testing which included eight subawards and thirty-six amendments. Of the forty-four subawards selected, only one subaward, in the amount of $58,542, was reported timely and accurately. Specifically, the following exceptions were noted: • 38 of 44 subawards were not reported to FSRS, totaling $17,901,902. • 1 of 44 subawards was not reported timely to FSRS, totaling $9,609,432. • 4 of 44 subawards reported an incorrect amount to FSRS, with a net reported variance of $155,342. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE Cause: The Department’s procedures were not sufficient to ensure that subawards were reported timely or accurately to FSRS. Internal controls did not prevent or detect the errors. Effect: The Department’s subaward reporting to FSRS was incomplete and inaccurate. Questioned costs: None noted. Recommendation: We recommend the Department develop procedures and internal controls to ensure that all required subawards and subaward modifications are reported accurately and timely to FSRS no later than the end of the month following the month of issuance in accordance with FFATA reporting requirements. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award should be reported as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the Department must continue to report the subaward, including grant modifications. Views of responsible officials: Management agrees with the finding.

Reference Number: 2022-006 Prior Year Finding: No Federal Agency: U.S. Department of Agriculture State Agency: Agency of Education (Agency) Federal Program: Child Nutrition Cluster Assistance Listing Number: 10.553, 10.555, 10.556, 10.559, 10.582 Award Number and Year: 4VT300307 (2020-2022), 4VT310307 (2020-2022), 4VT308907 (2022-2023) Compliance Requirement: Reporting ? Federal Funding Accountability and Transparency Act (FFATA) Type of Finding Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or specific requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. The following key data elements must be reported: Subawardee Name and Data Universal Numbering System (DUNS) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $30,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. ?? 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Agency of Education (Agency) was not in compliance with FSRS reporting requirements. Subawards and subaward modifications were not reported accurately and/or timely to FSRS. Context: 40 subawards were selected for testing and many of these subawards were amended several times for a total of 370 transactions tested. Specifically, the following exceptions were noted: ? 6 of 40 original subawards were not reported to FSRS. ? 50 of 330 amendments were not reported to FSRS. ? 10 of 40 original subawards were not reported timely to FSRS. ? 35 of 330 subaward amendments were not reported timely to FSRS. ? 1 of 40 subawards reported an incorrect original subaward amount to FSRS. ? 85 of 330 subaward amendments reported an incorrect amount to FSRS. When reporting the amendments, the Agency frequently reported the cumulative subaward amount rather than only the current amendment amount which overstated the total amount reported for these subawards. Cause: The Agency?s procedures were not sufficient to ensure that all subawards and subaward amendments were reported timely and accurately to FSRS. Internal controls did not prevent or detect the errors. Effect: Subawards were not reported timely or accurately to FSRS in accordance with FFATA requirements. Questioned costs: None noted. Recommendation: We recommend the Agency review and enhance internal controls and procedures to ensure that all required subawards and subaward amendments are reported accurately and timely to FSRS no later than the end of the month following the month of issuance. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE Views of responsible officials: Management agrees with the finding.

Reference Number: 2022-007 Prior Year Finding: No Federal Agency: U.S. Department of Agriculture State Agency: Agency of Education (Agency) Federal Program: Child Nutrition Cluster Assistance Listing Number: 10.553, 10.555, 10.556, 10.559, 10.582 Award Number and Year: 4VT300307 (2020-2022), 4VT310307 (2020-2022), 4VT308907 (2022-2023) Compliance Requirement: Special Tests and Provisions ? Accountability for USDA-Donated Foods Type of Finding Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or specific requirement: Compliance: Distributing and sub distributing agencies (as defined at 7 CFR section 250.3) must maintain accurate and complete records with respect to the receipt, distribution, and inventory of USDA-donated foods, including end products processed from donated foods. Failure to maintain records required by 7 CFR section 250.16 shall be considered prima facie evidence of improper distribution or loss of donated foods, and the agency, processor, or entity may be required to pay USDA the value of the food or replace it in kind (7 CFR sections 250.16(a)(6) and 250.15(c)). Distributing and sub distributing agencies shall take a physical inventory of all storage facilities. Such inventory shall be reconciled annually with the storage facility?s inventory records and maintained on file by the agency that contracted with or maintained the storage facility. Corrective action shall be taken immediately on all deficiencies and inventory discrepancies and the results of the corrective action forwarded to the distributing agency (7 CFR section 250.14(e)). Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Agency of Education (Agency) acts as the State distributing agency for the USDA donated foods. Commodities received by the Agency are ultimately distributed to participating School Food Authorities (SFA) throughout the State of Vermont. Errors were detected in the Agency?s reconciliation process for USDA-Donated Foods. Context: On an annual basis, the Agency enters into a $0 contract with a third-party vendor to warehouse the brown box USDA foods once they are delivered to the State. The third-party vendor utilizes an inventory system, TRACS, to maintain inventory of the commodities in the warehouse and to track the distribution of donated foods to the SFAs. While the quantity of items is maintained in TRACS, the system does not track the value of the commodity items. The value of commodities and the number of commodity items are tracked through the USDA?s Web Based Supply Chain Management (WBSCM) system. Annually, the Agency notifies each SFA of the value of their commodities received. On a quarterly basis, the Agency reconciles commodities recorded in TRACS and WBSCM. Nine school reconciliations, including 58 products, were selected for testing. The following exceptions were noted: ? 31 of 58 products contained variances, but no follow-up on these variances was documented by the Agency. ? 2 of 9 school reconciliations contained an incorrect TRACS amount. ? For 9 of 9 school reconciliations, support could not be provided to demonstrate that the reconciliations performed were complete and accurate. Cause: The Agency?s procedures were not sufficient to ensure that reconciliations of the WBSCM and TRACS systems was performed accurately. Internal controls did not detect or prevent the errors. Effect: The Agency may not be accurately reporting the value of commodities received to the SFAs. In addition, variances may exist between TRACS and WBSCM that may not be identified and counted in a timely manner. Questioned costs: Undetermined. Recommendation: We recommend the Agency review and enhance its procedures and internal controls regarding quarterly WBSCM to TRACS reconciliations to ensure that the reconciliations are complete and accurate. We further recommend that variances identified during the reconciliation process are investigated and corrected timely. Views of responsible officials: Management agrees with the finding.

Reference Number: 2022-008 Prior Year Finding: No Federal Agency: U.S. Department of Agriculture State Agency: Agency of Education (Agency) Federal Program: Child Nutrition Cluster Assistance Listing Number: 10.553, 10.555, 10.556, 10.559, 10.582 Award Number and Year: 4VT300307 (2020-2022), 4VT310307 (2020-2022), 4VT308907 (2022-2023) Compliance Requirement: Reporting ? Financial Reporting Type of Finding Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: School Food Authorities (SFAs) and sponsors must submit monthly claims for reimbursement for meals and snacks served to eligible students within 60 days following the last day of the month covered by the claim (7 CFR sections 210.8, 220.11, 215.10, and 225.15(c)). The state agency has an additional 30 days to submit a consolidated report to FNS (7 CFR 210.5(d), 220.13(b)(2), 215.11(c)(2), and 225.8). Each month?s claim for reimbursement and all data used in the claims review process must be maintained on file. Accurate records must be maintained justifying all meals claimed and documenting that all Program funds were spent only on allowable Child Nutrition Program costs. Failure to maintain such records may be grounds for denial of reimbursement for meals served and/or administrative costs claimed during the period covered by the records in question. Records are required to be retained for a period of three years after submission of the final Claim for Reimbursement for the fiscal year. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Agency of Education (Agency) did not retain all supporting documentation for several summary lines of the monthly FNS-10 reports and auditors were unable to verify that the reported amounts were accurate for these rows. Context: Seven reports were filed for the three months which were selected for testing, consisting of 3 FNS-10 reports, 3 FNS-10 SSO reports and 1 FNS-418 report. For 2 of the 3 FNS-10 and FNS-10 SSO reports reviewed, detail supporting documentation provided to auditors for several summary rows did not agree to the amounts reported. Specifically, we noted the following: ? FNS-10 SSO ? August 2021: For 2 of 3 categories, detail reconciliations provided to auditors did not agree to the summary rows reported. ? FNS-10 ? November 2021: For 4 of 8 categories, detail reconciliations provided to auditors did not agree to the summary rows reported. ? FNS-10 SSO ? November 2021: For 2 of 3 categories, detail reconciliations provided to auditors did not agree to the summary rows reported. ? FNS-10 ? November 2021: For 2 of 8 categories, detail reconciliations provided to auditors did not agree to the summary rows reported. The Agency acknowledged that it had not retained detail reconciliations at the time of submission, and it provided revised reconciliations to auditors. Upon review, it was determined that several lines of the revised reconciliations did not agree to the submitted reports, therefore, auditors were unable to verify the accuracy of the reports filed for the reports. Cause: The Agency?s procedures were not sufficient to ensure that it retained all required supporting documentation for FNS-10 and FNS-10 SSO reports filed during FY 2022; including retaining copies of reconciliations performed between detail and summary data. Internal controls did not detect or prevent the errors. Effect: Auditors were unable to verify the accuracy of portions of the FNS-10 and FNS-10 SSO reports filed. Questioned costs: Undetermined. Recommendation: We recommend the Agency review and enhance its procedures and internal controls regarding monthly financial reporting to ensure that all supporting documentation is retained and available for audit. Views of responsible officials: Management agrees with the finding.

Reference Number: 2022-009 Prior Year Finding: No Federal Agency: Department of Defense State Agency: Military Department Federal Program: Military Construction, National Guard Assistance Listing Number: 12.400 Award Number and Year: W912LN-20-2-2102 (FY2020) W912LN-21-2-2101 (FY2021) Compliance Requirement: Reporting Type of Finding Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: The National Guard Bureau (NGB) Cooperative Agreement program operates on the basis that the grantee expends State government funds first and then submits request (vouchers) for reimbursement from NGB for allowable Cooperative Agreement (CA) costs. All approved CA agreement payments (to include Advances) made to the grantee by NGB are reimbursable payments. To process reimbursement payments the grantee shall provide an OMB Standard Form (SF) 271 - Outlay Report and Request for Reimbursement for Construction Programs with supporting documentation to the CA Program Manager. The supporting documentation will itemize the amount of funds expended and the corresponding grantee accounting classification to be reimbursed. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: Numerous reporting errors were noted on SF-271 reimbursement reports submitted by the Military Department (Department) for the Warfare School and Bennington projects. The amounts reported by cost category did not match supporting documentation and it was determined that budget amounts were reported as current expenditures instead of actual costs incurred to-date. Although individual line items were reported incorrectly, the total federal share requested was calculated correctly based on actual costs incurred to-date and reimbursements did not exceed the federal share of expenditures incurred. Context: Three monthly reports were reviewed for the Warfare School and two monthly reports were reviewed for Bennington. The following exceptions were noted: Warfare School ? 9/30/2021: 5 of 9 report detail lines were reported incorrectly, using the budget amount instead of the required total costs to-date. Of the incorrectly reported lines, two were summary calculations. ? 11/30/2021: 5 of 9 report detail lines were reported incorrectly, using the budget amount instead of the required total costs to-date. Of the incorrectly reported lines, two were summary calculations. ? 3/31/2022: 4 of 9 report detail lines were reported incorrectly, using the budget amount instead of the required total costs to-date. Of the incorrectly reported lines, two were summary calculations. Bennington ? 11/30/2021: 3 of 9 report detail lines were reported incorrectly, using the budget amount instead of the required total costs to-date. Of the incorrectly reported lines, two were summary calculations. ? 3/31/2022: 3 of 9 report detail lines were reported incorrectly, using the budget amount instead of the required total costs to-date. Of the incorrectly reported lines, two were summary calculations. Questioned costs: None noted. The Federal share requested was calculated correctly based on costs incurred to-date. Cause: The Department?s procedures were not sufficient to ensure the SF-271 ? Outlay Report and Request for Reimbursement for Construction Programs reports were submitted accurately. Internal controls did not prevent or detect the errors. Effect: Reporting the budget amount instead of actual costs incurred on detail report lines results in an overstatement of project costs incurred as of the report date. Further, reporting errors could result in an incorrect calculation of the Federal share requested for reimbursement. Recommendation: We recommend the Department enhance its SF-271 policies and procedures to verify that detail line items agree with supporting documentation. The Department should also improve its internal controls to ensure that SF-271 reports have been prepared accurately prior to submission and that the Federal share of reimbursement requests are calculated correctly. Views of responsible officials: Management agrees with the finding.

Reference Number: 2022-010 Prior Year Finding: No Federal Agency: U.S. Department of Housing and Urban Development State Agency: Agency of Commerce and Community Development Federal Program: Community Development Block Grant Assistance Listing Number: 14.228 Award Number and Year: B-20-DW-50-0001 (2020) B-20-DC-50-0001 (2020) B-21-DC-50-0001 (2021) Compliance Requirement: Subrecipient Monitoring Type of Finding Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: 2 CFR ?200.332 - Requirements for Pass-Through Entities states, in part, that all pass-through entities must: (b) Evaluate each subrecipient's risk of noncompliance with Federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate subrecipient monitoring described in paragraphs (d) and (e) of this section, which may include consideration of such factors as: (1) The subrecipient's prior experience with the same or similar subawards; (2) The results of previous audits including whether or not the subrecipient receives a Single Audit in accordance with Subpart F - Audit Requirements of this part, and the extent to which the same or similar subaward has been audited as a major program; (3) Whether the subrecipient has new personnel or new or substantially changed systems; (4) The extent and results of Federal awarding agency monitoring (e.g., if the subrecipient also receives Federal awards directly from a Federal awarding agency). (f) Verify that every subrecipient is audited as required by Subpart F - Audit Requirements of this part when it is expected that the subrecipient's Federal awards expended during the respective fiscal year equaled or exceeded the threshold set forth in ? 200.501 Audit requirements. Control: Per 2 CFR Section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The State of Vermont Agency of Commerce and Community Development was not able to provide support that it ensured its subrecipients were audited as required by 2 CFR Part 200 Subpart F ? Audit Requirements (Subpart F). Context: Exceptions were noted in three of eight subrecipients selected for testing: ? For three of eight subrecipients, the Agency was unable to provide support that it ensured the subrecipients were audited as required by Subpart F. Questioned costs: Undetermined. Cause: The Agency did not establish effective internal controls and procedures over subrecipient monitoring to ensure that it issued and monitored subawards in accordance with 2 CFR section 200.332. Effect: Failure to ensure subrecipients have obtained audits as required by Subpart F increases the risk that subrecipients may inappropriately spend and/or inaccurately track and report federal funds over multiple year periods, and these discrepancies may not be properly monitored, detected, or corrected on a timely basis. Questioned costs: Undetermined Recommendation: We recommend the Agency review and enhance internal controls and procedures to ensure that an evaluation of independent audits is performed. Views of responsible officials: Management agrees with the finding.

Reference Number: 2022-011 Prior Year Finding: No Federal Agency: U.S. Department of Housing and Urban Development State Agency: Agency of Commerce and Community Development Federal Program: Community Development Block Grant Assistance Listing Number: 14.228 Award Number and Year: B-20-DW-50-0001 (2020) B-20-DC-50-0001 (2020) B-21-DC-50-0001 (2021) Compliance Requirement: Reporting ? Federal Funding Accountability and Transparency Act (FFATA) Type of Finding Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. The following key data elements must be reported: Subawardee Name and Data Universal Numbering System (DUNS) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $30,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. ?? 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Agency of Commerce and Community Development was not in compliance with FSRS reporting requirements. Various subawards and subaward modifications were not reported to FSRS or inaccurately reported key data elements. Context: Three of eight subawards selected for testing were not in compliance with FFATA reporting requirements. The following exceptions were noted: ? 1 of 8 subawards were issued amendments to the original subaward, but the amendments were not reported to FSRS. ? 1 of 8 subawards were issued amendments to the original subaward, but the amendments were not reported accurately. ? 1 of 8 subawards reported the incorrect subaward obligation/action date (key data element). Cause: The Agency?s procedures were not sufficient to ensure that all subawards and subaward amendments were reported timely to FSRS. Internal controls did not prevent or detect the errors. Effect: Subawards were not reported accurately to FSRS in accordance with FFATA requirements. Questioned costs: None noted. Recommendation: We recommend the Agency review and enhance internal controls and procedures to ensure that all required subawards and subaward amendments are reported timely and accurately to FSRS no later than the end of the month following the month of issuance. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE Views of responsible officials: Management agrees with the finding.

Reference Number: 2022-012 Prior Year Finding: 2021-009 Federal Agency: Department of Labor State Agency: Vermont Department of Labor (Department) Federal Program: Unemployment Insurance, COVID-19 ? Unemployment Insurance Assistance Listing Number: 17.225 Award Number and Year: UI326301955A50 (5/20/2021 ? 12/31/2021) UI340892055A50 (10/1/2019 ? 12/31/2022) UI345252060A50 (1/1/2020 ? 9/30/2022) UI347462055A50 (4/1/2021 ? 6/30/2024) UI356792155A50 (10/1/2020 ? 12/31/2023) UI357352155A50 (10/1/2020 ? 9/30/2021) UI359762160A50 (1/1/2021 ? 9/30/2023) UI372542255A50 (10/1/2021 ? 12/31/2024) UI373112255A50 (10/1/2021 ? 9/30/2022) UI380102260A50 (1/1/2022 ? 9/30/2022) CARES Act PL 116-136 (3/13/2020 ? 9/6/2021) Compliance Requirement: Reporting Type of Finding Material Weakness in Internal Control over Compliance, Material Noncompliance Criteria or specific requirement: Compliance: ETA 191, Financial Status of UCFE/UCX (OMB No. 1205-0162) ? Quarterly report on UCFE and UCX expenditures and the total amount of benefits paid to claimants of specific federal agencies (ET Handbook 401). Per federal regulations, the ETA 191 should be submitted electronically to the National Office by the 25th of the month following the close of the quarter. ETA 2112, UI Financial Transaction Summary (OMB No. 1205-0154) ? A monthly summary of transactions, which account for all funds received in, passed through, or paid out of the state unemployment fund (ET Handbook 401). Per federal regulations, the ETA 2112 should be submitted electronically to the National Office by the 1st day of the second month following the close of the reporting month. ETA 9130, Financial Status Report, UI Programs ? All ETA grantees are required to submit quarterly financial reports for each grant award which they operate, including standard program and pilot, demonstration, and evaluation projects. Financial data is required to be reported cumulatively from grant inception through the end of each reporting period. A separate ETA 9130 is submitted for each of the following: UI, PEUC, and PUA Administration, DUA, TRA/RTAA, and UA Projects (administration and benefits). ETA 9050, Time Lapse of All First Payments except Workshare ? The ETA 9050 report contains monthly information on first payment time lapse. This report concerns the time it takes states to pay benefits to claimants for the first compensable week of unemployment. That data addressed first payment time lapse for total unemployment only. The report is submitted electronically to the ETA National Office on the 20th of the month following the month to which the data relates. ETA 9052, Nonmonetary Determination Time Lapse Detection - The ETA 9052 report contains monthly information on the time it take states to issue nonmonetary determinations from the date the issues are first detected by the agency. Single-claimant and multi-claimant nonmonetary determinations are included in the report. Nonmonetary determinations made by organizational units such as Benefits Accuracy Measurement (BAM) and Benefit Payment Control (BPC) are also included in the report. Note: Overpayment notices on uncontested earnings detected by any method (e.g., crossmatch) should not be included. The report is submitted electronically to the ETA National Office on the 20th of the month following the month to which the data relates. ETA 9055, Appeals Case Aging - The ETA 9055 report gathers monthly information on the inventory of lower authority and higher authority single claimant appeals cases that have been filed but not decided. Appeals case aging provides information about the number of days from the date an appeal was filed through the end of the month covered by the report. Also included are the average and median ages of the pending single claimant appeals cases. The report is submitted electronically to the ETA National Office on the 20th of the month following the month to which the data relates. ETA 2208A, Quarterly UI Above-Base Report - The ETA 2208A is a quarterly report of staff years worked and paid by program category. Reports are submitted electronically to the National Office by the 30th of the month following the close of the quarter. Internal Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with the guidance in "Standards for Internal Control in the Federal Government" issued by the Comptroller General of the United States or the "Internal Control-Integrated Framework," issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department was not able to provide support that it had submitted required financial and performance reports by the due dates nor that reports had been reviewed and approved by an authorized State official prior to submission. Questioned costs: Undetermined. Context: We reviewed a sample of the ETA 191, ETA 2112 and ETA 9130 financial reports, a sample of the ETA 9050, ETA 9052 and ETA 9055 performance reports, and a sample of ETA 2208A special reports filed during FY 2022. The following exceptions were noted: ETA 191: 2 of 2 quarterly reports reviewed were submitted after the required due date. Reports for the quarters ending 9/30/2021 and 3/31/2022 were both submitted 23 days late. In addition, support could not be provided to document that the reports had been reviewed and approved prior to submission. ETA 2112: Support could not be provided that 4 of 4 reports reviewed were submitted by the required due date. ETA 9130: Reports for the 9/30/2021 and 3/31/2022 quarters were reviewed which included 11 individual grant reports for each quarter, or 22 reports in total. 1 of 11 grant reports for the 9/30/2021 quarter was submitted after the due date. The report was due on 11/14/2021 but was submitted on 11/17/2021, or 3 days late. ETA 9050: Support could not be provided that 4 of 4 reports reviewed had been reviewed and approved prior to submission. ETA 9052: Support could not be provided that 4 of 4 reports reviewed were submitted by the required due date nor that the reports had been reviewed and approved prior to submission. ETA 9055: Support could not be provided that 4 of 4 reports reviewed were submitted by the required due date nor that the reports had been reviewed and approved prior to submission. ETA 2208A: 2 of 2 quarterly reports reviewed were submitted after the required due date. The report for the quarter ending 9/30/2021 was due by 10/30/2021 but was submitted on 11/10/2021, or 11 days late. The report for the quarter ending 3/31/2022 was due 4/30/2022 but was submitted on 6/17/2022, or 48 days late. Cause: The Department does not have sufficient internal controls in place over compliance with Unemployment Insurance reporting requirements to ensure that reports are submitted timely and that they are reviewed and approved prior to submission. Effect: Financial, performance and special reports were consistently submitted late. A lack of review and approval of financial and performance reports could allow incorrect data to be reported for the program which could misrepresent the State?s financial and programmatic performance in the program. Recommendation: We recommend that policies and procedures be implemented to ensure that all financial, performance, and special reports are filed timely and accurately and that reports are reviewed and approved by an authorized State official prior to submission. Views of responsible officials: Management agrees with the finding.

Reference Number: 2022-013 Prior Year Finding: 2021-012 Federal Agency: U.S. Department of Labor State Agency: Vermont Department of Labor (Department) Federal Program: Unemployment Insurance, COVID-19 ? Unemployment Insurance Assistance Listing Number: 17.225 Award Number and Year: CARES Act PL 116-136 (3/27/2020 ? 9/6/2021) Compliance Requirement: Eligibility Type of Finding Material Weakness in Internal Control over Compliance, Material Noncompliance Criteria or specific requirement: Compliance ? State Workforce Agencies (SWA) responsibilities include: (1) establishing specific, detailed policies and operating procedures which comply with the requirements of federal laws and regulations; (2) determining the state UI tax structure; (3) collecting state UI contributions from employers (commonly called ?unemployment taxes?); (4) determining claimant eligibility and disqualification provisions; (5) making payment of UI benefits to claimants; (6) managing the program?s revenue and benefit administrative functions; (7) administering the programs in accordance with established policies and procedures; and (8) enacting state UC law that conforms with federal UC law. UIPL No. 16-20 ? The Consolidated Appropriations Act, 2021 (Pub. L. 116-260), enacted on December 27, 2020, included the Continued Assistance for Unemployed Workers Act of 2020 (Continued Assistance Act) in Division N, Title II, Subtitle A. The Continued Assistance Act extended the PUA program and enacted several program integrity measures, including a requirement that all individuals receiving a PUA payment on or after December 27, 2020, submit documentation substantiating employment, self-employment, or the planned commencement of employment or self-employment. The PUA program ended September 6, 2021. Internal Control ? Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with the guidance in "Standards for Internal Control in the Federal Government" issued by the Comptroller General of the United States or the "Internal Control-Integrated Framework," issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Regular Unemployment Insurance program is administered by the Department of Labor (Department) and gives financial aid to unemployed individuals. In 2020, the federal government created new temporary unemployment insurance programs, including the Pandemic Unemployment Assistance (PUA) program, the Pandemic Emergency Unemployment Insurance (PEUC), and the Federal Pandemic Unemployment Compensation (FPUC) program, to further help individuals who lost their jobs due to COVID-19. The COVID-19 pandemic significantly increased the unemployment rate nationally and in Vermont. Before the pandemic, the national unemployment rate was about 4% in January 2020 and about 3% in Vermont. By April 2020, the national unemployment rate, and the Vermont rate both increased to about 15%. While the State?s unemployment rate declined to 2.2% percent in June 2022, the estimated unsupported claims and payments from these programs were significant to the State. Questioned costs: Undetermined. Context: Tests of effectiveness over controls surrounding PUA claims identified that thirty-eight (38) out of thirty-eight (38) PUA claims samples tested had no evidence of review nor timely review of wage support. Cause: The Department was unable to respond in a timely and effective manner to address the significant increase in claims and federal funds that continued throughout fiscal year 2022. Effect: The Department paid a significant amount of unsupported claims through the unemployment insurance program as a result of the COVID-19 pandemic. Claims were paid without the required wage support documentation and without review by the Department as required by USDOL. Recommendation: We recommend the State and the Department perform a thorough risk assessment over the unemployment insurance program and design controls and processes to address identified risks. Seeking continuous improvement to its risk assessment and internal processes is key to strengthening governance, risk management, internal controls, program management and overall operations within the program. Views of responsible officials: The Department acknowledges and accepts this finding, and as this is a repeat finding from last year?s ACFR audit, the Department maintains the same response and corrective action plan. The Pandemic Unemployment Assistance (PUA) program did not exist prior to the COVID-19 global health pandemic. Unlike the unemployment insurance program, which has been in existence since 1935, the PUA program did not have the inherent checks and balances built into the system to ensure proper program administration. Instead, state workforce agencies were expected to build the PUA program from the ground up with little guidance from the USDOL all the while managing through a pandemic that caused unprecedented upheaval in the employment status of millions of citizens. It is accurate that the Vermont Department of Labor was not able to implement the necessary checks and balances into the PUA program to ensure proper program eligibility. As has been pointed out in the audit finding, it was not until nine months after the start of the PUA program that Congress passed legislation that required documentation to be provided to substantiate program eligibility. At that time, due to the significant and unprecedented strains on the Department of Labor?s resources, the newly established documentation requirements were not able to be implemented prior to the end of the PUA program. The Department acknowledges that the lack of the ability to review claimant financial eligibility may have resulted in improper payments. It is important to point out that UIPL 16-20, Change 4 was issued on January 8, 2021, providing no time for UI programs to implement the required changes while still continuing to provide vital economic assistance to tens of thousands of individuals. The only other recourse available to the Department at that time would have been to stop program payments from issuing until the new eligibility requirements were reviewed. This would have left claimants without benefits for months while the Department used our limited financial and staff resources to implement the necessary changes. This is the result of the continuously changing eligibility requirements built from hastily implemented legislation and program design. In calendar year 2022, the Department began the process of retroactively reviewing all PUA claims that were filed and paid after the date of UIPL 16-20, Change 4 to ensure that proper documentation was provided to ensure program eligibility. Where appropriate, claims are being placed into an overpayment status and collection efforts will ensue.

Reference Number: 2022-014 Prior Year Finding: 2021-010 Federal Agency: Department of Labor State Agency: Vermont Department of Labor (Department) Federal Program: Unemployment Insurance, COVID-19 ? Unemployment Insurance Assistance Listing Number: 17.225 Award Number and Year: State UC, UCFE, and UCX (7/1/2021 ? 6/31/2022) Compliance Requirement: Special Tests and Provisions: UI Benefit Payments Type of Finding Significant Deficiency in Internal Control over Compliance, Other Matters Criteria or specific requirement: Compliance ? The State Workforce Agency (SWA) is required by 20 CFR section 602.11(d) to operate and maintain a quality control system. The Benefits Accuracy Measurement (BAM) program is DOL?s quality control system designed to assess the accuracy of UI benefit payments and denied claims, unless the SWA is excepted from such requirement (20 CFR section 602.22). The program estimates error rates, that is, numbers of claims improperly paid or denied and dollar amounts of benefits improperly paid or denied, by projecting the results from investigations of statistically sound random samples to the universe of all claims paid and denied in a state. Specifically, the SWA?s BAM unit is required to draw a weekly sample of payments and denied claims, complete prompt, and in-depth investigations to determine if the administration of the UC program is consistent with state and federal law (20 CFR section 602.21(d)). As presented in the ET Handbook No. 395, the investigation involves a review of state agency records, as well as contacting the claimant, employers, and third parties (either in-person, by telephone, or by fax) to conduct new and original fact-finding related to all of the information pertinent to the paid or denied claim that was sampled. BAM investigators review cases for adherence to federal and state law as well as official policy. The following time limits are established for completion of all cases for the year. The "year" includes all batches of weeks ending in the calendar year. Completion of Paid Claims Cases: ? a minimum of 70 percent of cases must be completed within 60 days of the week ending date of the batch; ? 95 percent of cases must be completed within 90 days of the week ending date of the batch; ? a minimum of 98 percent of cases for the year must be completed within 120 days of the ending date of the calendar year. Completion of Denied Claims Cases: ? a minimum of 60 percent of cases must be completed within 60 days of the week ending date of the batch; ? 85 percent of cases must be completed within 90 days of the week ending date of the batch; ? a minimum of 98 percent of cases for the year must be completed within 120 days of the ending date of the Calendar Year. Internal Control ? Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with the guidance in "Standards for Internal Control in the Federal Government" issued by the Comptroller General of the United States or the "Internal Control-Integrated Framework," issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Labor (Department) did not complete BAM case investigations within the time limits established in ET Handbook No. 395. Questioned costs: Undetermined. Context: Forty cases were selected for testing, of which 18 were Paid Claims and 22 were Denied Claims. We noted the following exceptions: ? The Department did not meet the required time limits for closing Paid Claims cases within 90 days. We noted that 83% of cases tested were closed within 90 days which is less than the required 95%. ? 2 of 40 cases were missing documentation of supervisory review and approval. Cause: The Department?s procedures were not sufficient to ensure that BAM case investigations were completed within the time limits required by the program and that documentation was maintained. Internal controls did not prevent or detect the errors. Effect: Noncompliance with BAM case investigation time limits and documentation requirements could delay the detection and correction of inaccurate benefit payments and denied claims. Recommendation: We recommend that the Department review and enhance procedures and controls to ensure that BAM case investigations are completed timely, and that documentation of supervisory review and approval is maintained. Views of responsible officials: Management agrees with the finding.

Reference Number: 2022-015 Prior Year Finding: 2021-011 Federal Agency: Department of Labor State Agency: Vermont Department of Labor (Department) Federal Program: Unemployment Insurance, COVID-19 ? Unemployment Insurance Assistance Listing Number: 17.225 Award Number and Year: UI345252060A50 (1/1/2020 ? 9/30/2022) UI359762160A50 (1/1/2021 ? 9/30/2023) UI380102260A50 (1/1/2022 ? 9/30/2022) Compliance Requirement: Special Tests and Provisions: UI Reemployment Programs: RESEA Type of Finding Significant Deficiency in Internal Control over Compliance, Other Matters Criteria or specific requirement: Compliance: The UI program serves as one of the principal ?gateways? to the workforce system. It is often the first workforce program accessed by individuals who need workforce services. The WPRS and RESEA programs serve as UI?s primary programs that facilitate the reemployment needs of UI claimants. WPRS, which is mandated by Section 303(j) of the Social Security Act, is designed to identify UI claimants who are most likely to exhaust their benefits and need reemployment assistance to return to work, and refer them to appropriate reemployment services, such as: job search and job placement assistance; counseling; testing; provision of occupational and labor market information; and assessments. WPRS provides reemployment services to selected claimants through an early intervention process. The number of individuals served under WPRS is determined by the state (and/or local areas) based on its capacity to serve these individuals. UIPL No. 41-94 provides guidance on WPRS requirements. RESEA is authorized by Section 306 of the Social Security Act and builds on the success of RESEA?s predecessor, the former UI Reemployment and Eligibility Assessment (REA) program. RESEA uses an evidence-based integrated approach that combines an eligibility assessment for continuing UI eligibility and the provision of reemployment services. State administration of the RESEA is voluntary and under certain circumstances may be designed to also satisfy WPRS requirements. Operating guidance for the RESEA program is updated annually. UIPL 13-21 provides RESEA operating Guidance for FY 2021. Internal Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with the guidance in "Standards for Internal Control in the Federal Government" issued by the Comptroller General of the United States or the "Internal Control-Integrated Framework," issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department did not retain documentation required by the RESEA program to verify compliance with federal program regulations. Controls were not working sufficiently to document that a staff member at the Department with knowledge of the program reviewed eligibility requirements prior to admission of participants to the RESEA program. Questioned costs: Undetermined. Context: Sixty cases were selected for testing and the following exceptions were noted: ? 5 of 60 samples selected were missing the Eligibility Review Questionnaire form and subsequently a lack of proper eligibility review and approval. ? 1 of 60 samples selected was missing a copy of the JobLink status and subsequently a lack of proper eligibility review and approval. ? 1 of 60 samples selected was missing documentation of adjudication. Cause: The Department?s procedures and internal controls are not sufficient to ensure compliance with RESEA requirements. Effect: Without clear documentation supporting a participant?s eligibility and supervisory review, it is possible that ineligible participants could receive benefits from the program. Recommendation: We recommend that policies and procedures be implemented to ensure that internal controls over RESEA include retention of documentation of each participant?s eligibility and review by a UI supervisor. Views of responsible officials: Management agrees with the finding.

Reference Number: 2022-016 Prior Year Finding: No Federal Agency: Department of Labor State Agency: Vermont Department of Labor (Department) Federal Program: Unemployment Insurance, COVID-19 ? Unemployment Insurance Assistance Listing Number: 17.225 Award Number and Year: UI340892055A50 (10/1/2019 ? 12/31/2022) UI356792155A50 (10/1/2020 ? 12/31/2023) UI372542255A50 (10/1/2021 ? 12/31/2024) Compliance Requirement: Allowable Costs/Cost Principles Type of Finding Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Compliance: 2 CFR section 200.403 states, in part, except where otherwise authorized by statute, costs must meet the following general criteria in order to be allowable under Federal awards: (a) Be necessary and reasonable for the performance of the Federal award and be allocable thereto under these principles. (b) Conform to any limitations or exclusions set forth in these principles or in the Federal award as to types or amount of cost items. (c) Be consistent with policies and procedures that apply uniformly to both federally-financed and other activities of the non-Federal entity. (d) Be accorded consistent treatment. A cost may not be assigned to a Federal award as a direct cost if any other cost incurred for the same purpose in like circumstances has been allocated to the Federal award as an indirect cost. (e) Be determined in accordance with generally accepted accounting principles (GAAP), except, for state and local governments and Indian tribes only, as otherwise provided for in this part. (f) Not be included as a cost or used to meet cost sharing or matching requirements of any other federally-financed program in either the current or a prior period. (g) Be adequately documented. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Labor (Department) charged costs to the program that were issued without documentation of supervisory review and approval. Questioned costs: None noted. The costs were determined to be allowable. Context: For five of forty general disbursement transactions selected for testing, the Department was unable to provide documentation of supervisory review and approval prior to issuance of payment to the vendor. Cause: The Department?s procedures were not sufficient to ensure that payments were reviewed and approved prior to issuance of payment. Internal controls did not prevent or detect the errors. Effect: Unallowable costs could be charged to the program if disbursements are not reviewed by a supervisor who is knowledgeable of program regulations regarding allowable costs. Recommendation: We recommend the Department reviews and enhances its procedures and controls regarding payment processing to ensure that, prior to charging costs to the program, they are reviewed by a supervisor who is knowledgeable of the regulations regarding allowable program costs and that documentation of the review is maintained. Views of responsible officials: Management agrees with the finding.

Reference Number: 2022-017 Prior Year Finding: No Federal Agency: Department of Labor State Agency: Vermont Department of Labor (Department) Federal Program: Unemployment Insurance, COVID-19 ? Unemployment Insurance Assistance Listing Number: 17.225 Award Number and Year: UI372542255A50 (10/1/2021 ? 12/31/2024) Compliance Requirement: Period of Performance Type of Finding Significant Deficiency in Internal Control over Compliance, Other Matters Criteria or specific requirement: Compliance: A non-federal entity may charge only allowable costs incurred during the approved budget period of a federal award?s period of performance and any costs incurred before the federal awarding agency or pass-through entity made the federal award that were authorized by the federal awarding agency or pass-through entity (2 CFR sections 200.308 200.309 and 200.403(h)). A period of performance may contain one or more budget periods. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: Costs were incurred and charged to the federal grant prior to the allowable start of the period of performance. Questioned costs: Below the reportable limit. Context: One of forty transactions was charged to the award before the allowable period of performance. The grant award start date was 10/1/2021 but a transaction dated 8/31/2021 in the amount of $7,421 was charged to the award. Cause: The Department of Labor?s (Department?s) procedures were not sufficient to ensure that expenditures charged to the program were incurred within the award?s period of performance. Internal controls did not prevent or detect the error. Effect: Costs could be deemed unallowable by the awarding agency if funds are expended outside of the allowable period of performance. Recommendation: The Department should review and enhance its procedures and internal controls to ensure that it charges expenditures to the program that are incurred within an award?s allowable period of performance. Views of responsible officials: Management agrees with the finding.

Reference Number: 2022-018 Prior Year Finding: 2021-013 Federal Agency: Department of the Treasury State Agency: Department of Finance and Management (Finance) Federal Program: COVID-19 ? Coronavirus Relief Fund COVID-19 ? Emergency Rental Assistance COVID-19 ? Coronavirus State and Local Fiscal Recovery Funds Assistance Listing Number: 21.019, 21.023, 21.027 Award Number and Year: SLT0049 (2020), SLT0083 (2020) ERA0029 (2021), ERAE0054 (2021), ERAE1023 (2021) SLFRP4407 (2021), SLFRP4563 (2021), SLFRP4453 (2021-2022) Compliance Requirement: Reporting: Schedule of Expenditures of Federal Awards Type of Finding Significant Deficiency in Internal Control Over Compliance Criteria or specific requirement: Compliance: Per 2 CFR 200 Section 510(b), the auditee must prepare a schedule of expenditures of Federal awards for the period covered by the auditee?s financial statements which must include the total Federal awards expended as determined in accordance with Section 200.502. The schedule must list individual Federal programs by Federal agency and provide total Federal awards expended for each individual Federal program and the Assistance Listings Number or other identifying number when the Assistance Listings information is not available. The schedule must also include the total amount provided to subrecipients from each Federal program. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: Errors were detected in the Schedule of Expenditures of Federal Awards (SEFA) submitted to auditors, including errors in both total expenditures and the amount provided to subrecipients. Context: The following SEFA reporting errors were noted during audit test work: 1. The amount provided to subrecipients under assistance listing 21.023 ? Emergency Rental Assistance was understated by $118.8 million, or 99%. The amount originally reported was $1.3 million but during audit test work it was determined that this amount should have been $120.1 million. 2. The amount provided to subrecipients under assistance listing 21.027 ? Coronavirus State and Local Fiscal Recovery Funds was understated by $77.3 million, or 89%. The amount originally reported was $9.7 million but during audit test work it was determined that this amount should have been $87 million. 3. Total expenditures reported under assistance listing 21.027 ? Coronavirus State and Local Fiscal Recovery Funds were overstated by $6.2 million, or 6%. The amount originally reported was $107.8 million but during audit test work it was determined that this amount should have been $101.6 million. The original reported amount included duplicate expenditures of approximately $6 million. 4. The amount provided to subrecipients under assistance listing 21.019 ? Coronavirus Relief Fund could not be verified. During the prior year?s audit, significant reporting errors were noted in the amount provided to subrecipients. During the current year?s audit, Finance indicated that it had not yet fully implemented the FY 2021 corrective action plan for this issue and, as a result, it was unable to verify the accuracy of the amount reported as provided to subrecipients during FY 2022. Questioned costs: Undetermined. Cause: Individual State agencies/departments prepare their own sections of the SEFA and submit them to Finance which compiles the State?s consolidated report. Procedures and internal controls were not sufficient to ensure that expenditures reported by Finance on the SEFA were accurate and were supported by detail expenditure transactions recorded in the State?s accounting system. On the initial SEFA submitted to auditors, approximately $6 million had been duplicated in total expenditures under 21.027 - Coronavirus State and Local Fiscal Recovery Funds. Payments to subrecipients under Emergency Rental Assistance and Coronavirus State and Local Fiscal Recovery Funds were improperly coded in the State?s accounting system which caused them to be excluded when the SEFA was initially prepared. Further, the prior year?s corrective action plan had not been fully implemented to allow Finance to verify the accuracy of the amount reported as provided to subrecipients under the Coronavirus Relief Fund during FY 2022. Effect: The amount provided to subrecipients was incorrectly reported on the SEFA submitted to auditors which effected testing of subrecipient monitoring for the programs. Recommendation: We recommend that Finance improve its SEFA compilation process to ensure that program expenditures and the amounts provided to subrecipients reported on the State?s SEFA are complete and accurate. We further recommend that Finance work with the State?s agencies and departments to review and enhance procedures and controls to ensure that subrecipient payments are accurately recorded in the State?s accounting system and that expenditure information submitted to Finance for inclusion on the State?s SEFA is accurate and ties to detail expenditure transactions in the State?s accounting system. Views of responsible officials: Management agrees with the finding.

Reference Number: 2022-019 Prior Year Finding: No Federal Agency: Department of the Treasury State Agency: Agency of Commerce and Community Development Federal Program: COVID-19 ? Homeowner Assistance Fund Assistance Listing Number: 21.026 Award Number and Year: HAF0030 (5/3/2021 ? 9/30/2026) Compliance Requirement: Cash Management Type of Finding Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: Per 2 CFR 200.305(b)(9), interest earned amounts up to $500 per year may be retained by the non-Federal entity for administrative expense. Any additional interest earned on Federal advance payments deposited in interest-bearing accounts must be remitted annually to the Department of Health and Human Services Payment Management System (PMS) through an electronic medium using either Automated Clearing House (ACH) network or a Fedwire Funds Service payment. Per the U.S. Treasury?s Homeowner Assistance Fund (HAF) Frequently Asked Questions on Reporting Requirements, Question 1.15, in accordance with 2 CFR 200.305(b)(9)(ii), HAF participants may retain up to $500 in earned interest annually. Any additional interest must be remitted annually to the Department of Health and Human Services Payment Management System (PMS) through an electronic medium using either Automated Clearing House (ACH) network or a Fedwire Funds Service payment. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: HAF Program funds transferred to the Agency of Commerce and Community Development (Agency) by the U.S. Treasury were deposited into an interest-bearing account, but interest earned over $500 per year was not remitted to the Department of Health and Human Services Payment Management System as required. Context: The Agency received two deposits from the U.S. Treasury for the program, $5,000,000 received on 8/27/2021 and $45,000,000 received on 2/1/2022 after approval of the HAF Plan. Funds were deposited into an interest-bearing account, but interest earned on HAF funds was not calculated. As a result of the audit, the Vermont State Treasurer?s Office calculated interest earned for the program during calendar year 2021 and calendar year 2022. Total interest earned in excess of $500 per year is $2,165 for 2021 and $325,564 for 2022. Cause: The Agency did not develop sufficient procedures and internal controls to calculate interest earned on program funds and was unaware that it had earned interest in excess of $500 per year which should have been remitted to the Department of Health and Human Services. Effect: The State of Vermont retained interest earned on program funds and did not remit earnings over $500 per year to the Department of Health and Human Services as required. Questioned costs: Undetermined. Recommendation: We recommend the Agency work with U.S. Treasury officials regarding resolution of this matter. Views of responsible officials: Management agrees with the finding.

Reference Number: 2022-020 Prior Year Finding: No Federal Agency: Department of the Treasury State Agency: Agency of Administration Federal Program: COVID-19 ? Coronavirus State and Local Fiscal Recovery Funds Assistance Listing Number: 21.027 Award Number and Year: SLFRP4407 (3/1/2021 ? 12/31/2024) Compliance Requirement: Allowable Costs/Cost Principles Type of Finding Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: 2 CFR Section 200.430 (8)(i) Standards for Documentation of Personnel Expenses states that: Charges to Federal awards for salaries and wages must be based on records that accurately reflect the work performed. These records must: (i) Be supported by a system of internal control which provides reasonable assurance that the charges are accurate, allowable, and properly allocated; (ii) Be incorporated into the official records of the non-Federal entity; (iii) Reasonably reflect the total activity for which the employee is compensated by the non-Federal entity, not exceeding 100% of compensated activities; (iv) Encompass both federally assisted and all other activities compensated by the non-Federal entity on an integrated basis, but may include the use of subsidiary records as defined in the non-Federal entity's written policy; (v) Comply with the established accounting policies and practices of the non-Federal entity; (vi) Support the distribution of the employee's salary or wages among specific activities or cost objectives if the employee works on more than one Federal award; a Federal award and non-Federal award; an indirect cost activity and a direct cost activity; two or more indirect activities which are allocated using different allocation bases; or an unallowable activity and a direct or indirect cost activity. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: Payments to subrecipients were incorrectly recorded in the Agency of Administration?s (Agency?s) accounting system as payments for Unemployment Compensation. Context: Sixty payroll related expenditures were selected for testing, including two payments recorded as Unemployment Compensation. The two unemployment compensation payments were determined to be payments to subrecipients and were not payroll related. Although the payments, totaling $652,937, were incorrectly charged as Unemployment Compensation in the Agency?s accounting system, the costs were allowable subrecipient costs. Cause: The Agency?s procedures and controls were not sufficient to ensure that payments were properly recorded in the accounting system. Data entry errors occurred when the accounts payable transactions were recorded for payment and supervisory review and approval of the transactions did not detect the errors. Effect: Program expenditures were improperly recorded in the Agency?s accounting system. Failure to accurately record payments in the accounting system could lead to reporting errors, including incorrectly reporting payments to subrecipients. Questioned costs: None noted. Although the payments had been miscoded in the accounting system, the payments were allowable subrecipient costs. Recommendation: We recommend the Agency review and enhance procedures and internal controls to ensure that accounts payable transactions are properly recorded. Views of responsible officials: Management agrees with the finding.

Reference Number: 2022-021 Prior Year Finding: No Federal Agency: Department of the Treasury State Agency: Agency of Administration Federal Program: COVID-19 ? Coronavirus State and Local Fiscal Recovery Funds Assistance Listing Number: 21.027 Award Number and Year: SLFRP4407 (3/1/2021 ? 12/31/2024) Compliance Requirement: Subrecipient Monitoring Type of Finding Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: 2 CFR ?200.332 - Requirements for Pass-Through Entities states, in part, that all pass-through entities must: (a) Ensure that every subaward is clearly identified to the subrecipient as a subaward and includes information at the time of the subaward and if any of these data elements change, include the changes in subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward. Required information includes: (1)(iii) Federal Award Identification Number (FAIN); Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: Required federal award information was omitted from a subaward issued from the program. Context: The Agency of Administration (Agency) has oversight responsibility for Coronavirus State and Local Fiscal Recovery Funds expenditures and reporting for the State of Vermont (the State). Multiple agencies and departments within the State incur costs and issue subawards charged to the program. Twelve subrecipients were selected for testing and the Department of Public Service (Department) issued a subaward to 1 of the 12 subrecipients. The Federal Award Identification Number (FAIN) was not included on this subaward. Cause: The Department did not establish effective internal controls and procedures over subrecipient monitoring. It was unable to ensure that it provided all required information to its subrecipients upon award issuance. The Agency?s oversight of the program did not detect the error. Effect: Excluding the required federal grant award information at the time of subaward issuance may cause subrecipients and their auditors to be uninformed about specific program and other regulations that apply to the funds they receive. There is also the potential for subrecipients to have incomplete Schedules of Expenditures of Federal Awards (SEFA) in their Single Audit reports. Questioned costs: Undetermined. Recommendation: We recommend the Agency work with the Department to review and enhance internal controls and procedures to ensure that all required federal award information is included in subawards. We further recommend that the Agency review its oversight procedures and controls to ensure that all State agencies and departments that issue subawards under the program are in compliance with federal requirements. Views of responsible officials: Management agrees with the finding.

Reference Number: 2022-022 Prior Year Finding: No Federal Agency: U.S. Department of Education State Agency: Agency of Education (Agency) Federal Program: Title I Grants to Local Educational Agencies Assistance Listing Number: 84.010 Award Number and Year: S010A200045 (7/1/2020 ? 9/30/2021) S01A210045 (7/1/2021-9/30/2022) Compliance Requirement: Reporting ? Financial Reporting Type of Finding Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: Per 2 CFR 200.302, each state must expend and account for the Federal award in accordance with state laws and procedures for expending and accounting for the state's own funds. In addition, the state's and the other non-Federal entity's financial management systems, including records documenting compliance with Federal statutes, regulations, and the terms and conditions of the Federal award, must be sufficient to permit the preparation of reports required by general and program-specific terms and conditions; and the tracing of funds to a level of expenditures adequate to establish that such funds have been used according to the Federal statutes, regulations, and the terms and conditions of the Federal award. Recipients of U.S. Department of Education funds use the G5 system to simultaneously request cash reimbursements and report expenditures. The G5 system is in lieu of the SF-270 ? Request for Advance or Reimbursement. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Agency of Education (Agency) was not able to support that the amount it had reported for drawdown in the G5 system was accurate and was supported by expenditures recorded in its accounting system and reported on the Schedule of Expenditures of Federal Awards (SEFA). The total draws by the Agency were less than the total expenditures on the SEFA. Context: The Agency of Education (Agency) was unable to provide supporting documentation for the amount it had reported and drawn down in the G5 system for the program as compared to expenditures it had incurred and reported on the Schedule of Expenditures of Federal Awards (SEFA). Auditors noted the total reported draws were $5.9 million (approximately 16%) less than expenditures reported on the SEFA. The Agency was unable to reconcile this variance. Cause: The Agency?s procedures and internal controls were not sufficient to account for timing differences and ensure that cash draws were complete, accurate and tied to expenditures incurred in its accounting system as reported on the SEFA. Effect: Auditors were unable to verify that cash draws in the G5 system were complete, accurate and supported by documentation recorded in the Agency?s accounting system. Questioned costs: Undetermined. Recommendation: We recommend the Agency review and enhance internal controls and procedures over financial reporting to ensure that cash draws requested in the G5 system are complete, accurate, and that supporting documentation is maintained and agrees with expenditures recorded in its accounting system. Views of responsible officials: Management agrees with the finding.

Reference Number: 2022-023 Prior Year Finding: No Federal Agency: U.S. Department of Education State Agency: Agency of Education (Agency) Federal Program: Title I Grants to Local Educational Agencies Assistance Listing Number: 84.010 Award Number and Year: S010A200045 (7/1/2020 ? 9/30/2021) S01A210045 (7/1/2021-9/30/2022) Compliance Requirement: Reporting ? Federal Funding Accountability and Transparency Act (FFATA) Type of Finding Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. The following key data elements must be reported: Subawardee Name and Data Universal Numbering System (DUNS) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $30,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. ?? 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Agency of Education (Agency) was not in compliance with FSRS reporting requirements. Several subawards and subaward modifications were not reported accurately to FSRS or were not reported timely. Context: Nineteen subawards were selected for testing and many of these subawards were amended several times for a total of sixty transactions tested. Specifically, the following exceptions were noted: ? 9 of 41 subaward amendments reported an incorrect amount to FSRS. When reporting the amendments, the Agency frequently reported the cumulative subaward amount rather than only the current amendment amount which overstated the total amount reported for these subawards. ? 1 of 41 amendments were not reported to FSRS. ? 1 of 19 original subawards were not reported timely to FSRS. ? 1 of 41 subaward amendments were not reported timely to FSRS. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE Cause: The Agency?s procedures were not sufficient to ensure that all subawards and subaward amendments were reported timely and accurately to FSRS. Internal controls did not prevent or detect the errors. Effect: Subawards were not reported timely or accurately to FSRS in accordance with FFATA requirements. Questioned costs: None noted. Recommendation: We recommend the Agency review and enhance internal controls and procedures to ensure that all required subawards and subaward amendments are reported accurately and timely to FSRS no later than the end of the month following the month of issuance. Views of responsible officials: Management agrees with the finding.

Reference Number: 2022-024 Prior Year Finding: No Federal Agency: U.S. Department of Labor U.S. Department of Education State Agency: Department of Labor Agency of Education Department of Finance and Management Federal Program: Unemployment Insurance Title I Grants to Local Educational Agencies Special Education Cluster Assistance Listing Number: 17.225, 84.010, 84.027 and 84.173 Award Number and Year: UI340892055A50 (10/1/2019 ? 12/31/2022) UI356792155A50 (10/1/2020 ? 12/31/2023) UI372542255A50 (10/1/2021 ? 12/31/2024) S010A200045 (7/1/2020 ? 9/30/2021), S01A210045 (7/1/2021-9/30/2022) H027A200098 (7/1/2020 ? 9/30/2021), H173A200106 (7/1/2020 ? 9/30/2021), H027A210098 (7/1/2021 ? 9/30/2022), H173A210106 (7/1/2021 ? 9/30/2022) Compliance Requirement: Cash Management Type of Finding Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: US Department of the Treasury (Treasury) regulations at 31 CFR Part 205 implement the Cash Management Improvement Act of 1990 (CMIA), as amended (Pub. L. No. 101-453; 31 USC 6501 et seq.). Subpart A of those regulations requires state recipients to enter into Treasury-State Agreements that prescribe specific methods of drawing down federal funds (funding techniques) for federal programs listed in the Assistance Listing (Catalog of federal Domestic Assistance) that meet the funding threshold for a major federal assistance program under the CMIA. Treasury-State Agreements also specify the terms and conditions under which an interest liability would be incurred. Programs not covered by a Treasury-State Agreement are subject to procedures prescribed by Treasury in Subpart B of 31 CFR Part 205 (Subpart B), which at 31 CFR section 205.33(a) include the requirement for a state to minimize the time between the drawdown of federal funds and their disbursement for federal program purposes. Per 2 CFR section 200.514(a)(5), if a State fails to request funds timely as set forth in 2 CFR section 205.29, or otherwise fails to apply a funding technique properly, we may deny any resulting Federal interest liability, notwithstanding any other provision of this section. Annual Reports are submitted electronically by December 31 of each year. The Annual Report includes Federal interest liabilities, State interest liabilities, and State direct cost claims. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department of Labor (Department) and the Agency of Education (Agency) were not in compliance with the funding techniques included in the State? CMIA Treasury-State Agreement. Federal interest liabilities were improperly calculated on the CMIA Annual Report by the Department of Finance and Management (Finance) for Unemployment Insurance, Title I Grants to Local Educational Agencies, and the Special Education Cluster. Context: The following exceptions were noted when testing compliance with Cash Management: Department of Labor ? The Department was not in compliance with the Prior Month Actual funding technique included in the State?s Treasury-State Agreement. The funding technique requires cash draws to occur on a monthly basis, however, the Department performed multiple cash draws during certain months and other cash draws were performed inconsistently with this funding technique. We noted that the Department did not perform cash draws early, therefore, there is no State interest liability for these exceptions. Agency of Education ? The Agency was not in compliance with the funding techniques included in the State?s Treasury-State Agreement for the Title I Grants to Local Educational Agencies program and for the Special Education Cluster. The funding techniques for these programs required cash draws occur on a bi-weekly basis, or 26 times during the fiscal year. Instead, the Agency performed 11 cash draws on a random basis throughout the year. Department of Finance and Management ? Finance is the responsible State agency for submission of the CMIA Annual Report. The interest liability for the Unemployment Insurance program was calculated incorrectly and since the Agency of Education failed to request funds timely in accordance with the Treasury-State Agreement, a federal interest liability should not have been calculated for the Title I Grants to Local Education Agencies program nor for the Special Education Cluster. The following specific federal interest liability calculation errors were noted on the FY 2022 CMIA Annual Report: o $448 for Unemployment Insurance should have been calculated as $120. o $17,067 for Title I Grants to Local Educational Agencies should have been $0. o $12,706 for the Special Education Cluster should have been $0. Cause: The Agency?s and Department?s procedures were not sufficient to ensure that cash draws were performed timely per the terms of the Treasury-State Agreement. Internal controls did not detect or prevent these errors. Finance prepares the CMA Annual Report using data provided by the Agency and the Department. Finance?s CMIA Annual Report procedures were not sufficient to ensure that it calculated federal interest liabilities for these programs only when the State was entitled to this interest. Internal controls did not detect these errors prior to submission of the CMIA Annual Report. Effect: The Cash Management Improvement Act is intended to minimize the time between the transfer of federal funds to States and the payout of those funds for program purposes. When the Agency and Department do not draw down federal funds timely per the funding techniques included in the Treasury-State Agreement, it causes the State to advance its own funds for federal program purposes, negatively impacting the State?s cash flow. Improperly calculating Federal interest liabilities could potentially allow the State to receive interest payments to which it is not entitled per 2 CFR section 200.514. Questioned costs: Federal interest liabilities improperly calculated and included on the Annual Report: ? $328 for Unemployment Insurance, the difference between the $448 claimed and the allowable $120. ? $17,067 for Title I Grants to Local Educational Agencies ? $12,706 for the Special Education Cluster Recommendation: We recommend the Agency and the Department review and enhance their internal controls and procedures over cash management to ensure that cash draws are performed timely and in accordance with the funding techniques included in the State?s Treasury-State Agreement. We further recommend that Finance enhance its procedures and internal controls to ensure that federal interest liabilities are properly calculated in accordance with 2 CFR section 200.514. Views of responsible officials: Management agrees with the finding.

Reference Number: 2022-025 Prior Year Finding: No Federal Agency: U.S. Department of Education State Agency: Agency of Education (Agency) Federal Program: Special Education Cluster Assistance Listing Number: 84.027, 84.173 Award Number and Year: H027A200098 (FY2020) H027A200098 - 20A (FY2021) H173A200106 (FY2020) H027A210098 (FY2021) H027A210098 - 21A (FY2022) H173A210106 (FY2021) Compliance Requirement: Reporting ? Federal Funding Accountability and Transparency Act (FFATA) Type of Finding Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or specific requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. The following key data elements must be reported: Subawardee Name and Data Universal Numbering System (DUNS) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $30,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. ?? 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Agency of Education (Agency) was not in compliance with FSRS reporting requirements. Subawards and subaward amendments were not reported to FSRS, were not reported accurately, or were not reported timely. Context: Twenty-six subawards were selected for testing and many of these subawards were amended several times for a total of fifty-two transactions tested. Specifically, the following exceptions were noted: ? 19 of 26 subawards were not reported to FSRS. Of these exceptions, 18 subawards were subsequently reported to FSRS after auditors requested samples for testing. ? 26 of 26 amendments were not reported to FSRS. ? 6 of 19 original subawards were reported incorrectly when reported to FSRS. ? 6 of 19 original subawards were not reported timely to FSRS. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE Cause: The Agency?s procedures were not sufficient to ensure that all subawards and subaward amendments were reported timely to FSRS. Internal controls did not prevent or detect the errors. Effect: Subawards were not reported accurately to FSRS in accordance with FFATA requirements. Questioned costs: None noted. Recommendation: We recommend the Agency review and enhance internal controls and procedures to ensure that all required subawards and subaward amendments are reported timely to FSRS no later than the end of the month following the month of issuance. Views of responsible officials: Management agrees with the finding.

Reference Number: 2022-026 Prior Year Finding: No Federal Agency: U.S. Department of Education State Agency: Agency of Education (Agency) Federal Program: COVID-19 ? Governor?s Emergency Education Relief Fund COVID-19 ? Elementary and Secondary School Emergency Relief Fund (ESSER) Assistance Listing Number: 84.425C, 84.425D Award Number and Year: S425D200011 (4/29/2020 ? 9/30/2021) S425D210011 (1/5/2021 ? 9/30/2022) S425C200009 (5/6/2020 ? 9/30/2021) S425C210009 (1/8/2021 ? 9/30/2022) Compliance Requirement: Special Tests and Provisions ? Participation of Private School Children Type of Finding Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or specific requirement: Compliance: For programs under ESSER I and GEER I (Assistance Listing 84.425C and D), an LEA that receives funds under one or both of those programs must provide equitable services in the same manner as provided under section 1117 of Title I, Part A of the ESEA (20 USC 6320) (Assistance Listing 84.010) to students and teachers in private schools as determined in consultation with private school officials (section 18005(a) of the CARES Act). To meet this requirement, a Local Education Agency (LEA) must determine the proportional share of ESSER I or GEER I funds available for equitable services in accordance with section 1117(a)(4)(A) of the ESEA (20 USC 6320(a)(4)(A)). Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Agency of Education (Agency) was not able to support the calculation of Participation of Private School Children set-aside amounts. Context: For 12 of 12 LEAs selected for testing, the Agency was unable to provide support to validate that the set-aside amounts for private school children had been determined appropriately. The total set asides were determined at the school district level and support was maintained at the LEA and not at the non-public (independent) school level. Therefore, auditors could not verify the accuracy of the set-aside calculations. Cause: The Agency?s procedures and internal controls were not sufficient to ensure it maintained documentation supporting private school set-aside calculations. Effect: Auditors were unable to verify that set-aside calculations were accurate and determined properly. Questioned costs: Undetermined. Recommendation: We recommend the Agency review and enhance internal controls and procedures over participation of private school children and that documentation supporting set-aside calculations is maintained and available for auditor review. Views of responsible officials: Management agrees with the finding.

Reference Number: 2022-027 Prior Year Finding: No Federal Agency: U.S. Department of Education State Agency: Agency of Education (Agency) Federal Program: COVID-19 ? Governor?s Emergency Education Relief Fund COVID-19 ? Elementary and Secondary School Emergency Relief Fund (ESSER) COVID-19 ? Coronavirus Response and Relief Supplemental Appropriations Act, 2021 ? Emergency Assistance to Non-Public Schools (CRRSA EANS) COVID-19 ? American Rescue Plan ? Elementary and Secondary School Emergency Relief (ARP ESSER) Assistance Listing Number: 84.425C, 84.425D, 84.425R, 84.425U Award Number and Year: S425D200011 (4/29/2020 ? 9/30/2021) S425D210011 (1/5/2021 ? 9/30/2022) S425C200009 (5/6/2020 ? 9/30/2021) S425C210009 (1/8/2021 ? 9/30/2022) S425U210011 (3/24/2021 ? 9/30/2023) S425R210033 (2/23/2021 ? 9/30/2022) S425W210047 (4/23/2021 ? 9/30/2023) S425V210033 (1/21/2021 ? 9/30/2023) Compliance Requirement: Cash Management Type of Finding Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: Per 2 CFR 200.302, each state must expend and account for the Federal award in accordance with state laws and procedures for expending and accounting for the state's own funds. In addition, the state's and the other non-Federal entity's financial management systems, including records documenting compliance with Federal statutes, regulations, and the terms and conditions of the Federal award, must be sufficient to permit the preparation of reports required by general and program-specific terms and conditions; and the tracing of funds to a level of expenditures adequate to establish that such funds have been used according to the Federal statutes, regulations, and the terms and conditions of the Federal award. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Agency of Education (Agency) was not able to support that the amount it had drawn down for the program was accurate and was supported by expenditures recorded in its accounting system and reported on the Schedule of Expenditures of Federal Awards (SEFA.) The total draws by the Agency were less than the total expenditures on the SEFA. Context: The Agency of Education (Agency) was unable to provide supporting documentation for the amount it had drawn down for the program as compared to expenditures it had incurred and reported on the Schedule of Expenditures of Federal Awards (SEFA). Auditors noted that total draws were $7.4 million (approximately 10%) less than expenditures reported on the SEFA. The Agency was unable to reconcile this variance. Cause: The Agency?s procedures and internal controls were not sufficient to account for timing differences and ensure that cash draws were complete, accurate and tied to expenditures incurred in its accounting system as reported on the SEFA. Effect: Auditors were unable to verify that cash draw population provided for testing was complete, accurate and supported by documentation recorded in the Agency?s accounting system. Questioned costs: Undetermined. Recommendation: We recommend the Agency review and enhance internal controls and procedures over cash management to ensure that cash draws are complete, accurate, and that supporting documentation is maintained and agrees with expenditures recorded in its accounting system. Views of responsible officials: Management agrees with the finding.

Reference Number: 2022-028 Prior Year Finding: No Federal Agency: U.S. Department of Education State Agency: Agency of Education (Agency) Federal Program: COVID-19 ? Governor?s Emergency Education Relief Fund Assistance Listing Number: 84.425C, 84.425R Award Number and Year: S425C200009 (5/6/2020 ? 9/30/2021) S425C210009 (1/8/2021 ? 9/30/2022) S425R210033 (2/23/2021 ? 9/30/2022) S425V210033 (1/21/2021 ? 9/30/2023) Compliance Requirement: Equipment/Real Property Management Type of Finding Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: Per 2 CFR section 200.313(b), a state must use, manage, and dispose of equipment acquired under a federal award in accordance with state laws and procedures. Per 2 CFR section 200.313(d), procedures for managing equipment (including replacement equipment), whether acquired in whole or in part under a Federal award, until disposition takes place will, as a minimum, meet the following requirements: (1) Property records must be maintained that include a description of the property, a serial number or other identification number, the source of funding for the property (including the FAIN), who holds title, the acquisition date, and cost of the property, percentage of Federal participation in the project costs for the Federal award under which the property was acquired, the location, use and condition of the property, and any ultimate disposition data including the date of disposal and sale price of the property. (2) A physical inventory of the property must be taken and the results reconciled with the property records at least once every two years. (3) A control system must be developed to ensure adequate safeguards to prevent loss, damage, or theft of the property. Any loss, damage, or theft must be investigated. (4) Adequate maintenance procedures must be developed to keep the property in good condition. (5) If the non-Federal entity is authorized or required to sell the property, proper sales procedures must be established to ensure the highest possible return. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Agency of Education (Agency) was unable to provide supporting documentation for equipment purchased with program funds. The Agency did not maintain an equipment ledger or track equipment in accordance with 2 CFR section 200.313. Context: When auditors conducted an initial risk assessment of the program, the Agency was unable to provide an equipment ledger or other supporting documentation of equipment purchased with program funds and, therefore, materiality could not be determined. The Agency conducted a manual assessment over all personal property/equipment purchased with federal program funding. This assessment determined that approximately $78,000 of equipment was purchased using GEER funding. While this amount is immaterial to total funding dollars, materiality could only be determined due to the additional assessments performed. Cause: The Agency?s procedures and internal controls were not sufficient to ensure it maintained documentation of equipment purchased with program funds. Effect: Equipment purchased with program funds was not managed and accounted for in accordance with State laws and procedures and in accordance with 2 CFR section 200.313. Questioned costs: Undetermined. Recommendation: We recommend the Agency review and enhance internal controls and procedures over equipment to ensure that it purchases and records equipment purchased with program funds in accordance with State laws and procedures and in accordance with 2 CFR section 200.313. Views of responsible officials: Management agrees with the finding.

Reference Number: 2022-029 Prior Year Finding: 2021-018 Federal Agency: U.S. Department of Education State Agency: Agency of Education (Agency) Federal Program: COVID-19 ? Governor?s Emergency Education Relief Fund COVID-19 ? Elementary and Secondary School Emergency Relief Fund (ESSER) COVID-19 ? American Rescue Plan ? Elementary and Secondary School Emergency Relief (ARP ESSER) Assistance Listing Number: 84.425C, 84.425D, 84.425U Award Number and Year: S425D210011 (1/5/2021 ? 9/30/2022) S425U210011 (3/24/2021 ? 9/30/2023) Compliance Requirement: Reporting ? Federal Funding Accountability and Transparency Act (FFATA) Type of Finding Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. The following key data elements must be reported: Subawardee Name and Data Universal Numbering System (DUNS) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $30,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. ?? 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Agency of Education (Agency) was not in compliance with FSRS reporting requirements. Several subawards and subaward modifications were not reported to FSRS or were not reported timely. Context: Ten of thirty-two subawards selected for testing were not in compliance with FFATA reporting requirements. The following exceptions were noted: ? 2 of 32 subawards were not reported to FSRS. ? 5 of 32 subawards were issued amendments to the original subaward, but the amendments were not reported to FSRS. ? 2 of 32 subawards were not reported timely to FSRS. ? 1 of 32 subawards were issued amendments to the original subaward, but the amendments were not reported timely to FSRS. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE Cause: The Agency?s procedures were not sufficient to ensure that all subawards and subaward amendments were reported timely to FSRS. Internal controls did not prevent or detect the errors. Effect: Subawards were not reported accurately to FSRS in accordance with FFATA requirements. Questioned costs: None noted. Recommendation: We recommend the Agency review and enhance internal controls and procedures to ensure that all required subawards and subaward amendments are reported timely to FSRS no later than the end of the month following the month of issuance. Views of responsible officials: Management agrees with the finding.

Reference Number: 2022-030 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Agency of Human Services (Agency) Federal Program: Immunization Cooperative Agreements, COVID-19 - Immunization Cooperative Agreements Assistance Listing Number: 93.268 Award Number and Year: 19NH23IP922615 (7/1/2020 ? 6/30/2024) Compliance Requirement: Allowable Costs Type of Finding Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: Per 2 CFR section 200.403(a), except where otherwise authorized by statute, in order for a cost to be allowable under Federal awards it must be necessary and reasonable for the performance of the Federal award and be allocable thereto under these principles. Per 2 CFR section 200.405, a cost is allocable to a particular Federal award or other cost objective if the goods or services involved are chargeable or assignable to that Federal award or cost objective in accordance with relative benefits received. This standard is met if the cost: (1) Is incurred specifically for the Federal award; (2) Benefits both the Federal award and other work of the non-Federal entity and can be distributed in proportions that may be approximated using reasonable methods; and (3) Is necessary to the overall operation of the non-Federal entity and is assignable in part to the Federal award in accordance with the principles in this subpart. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Agency included an unallowable cost in an administrative cost pool which was allocated to the program. Context: The Agency?s Department of Health (Department) charged a settlement payment of $3,891.30 related to a Superfund site lawsuit to an administrative cost pool, and a portion of this payment was allocated to the program. The allocated cost was not necessary or reasonable for the performance of the Federal award nor was it assignable in part to the Federal award as a cost necessary to the overall operation of the Department. Cause: The Agency?s internal controls were not operating sufficiently to ensure that costs charged to an administrative cost pool were allowable and allocable per the requirements of 2 CFR sections 200.403 and 200.405. Effect: Unallowable costs were allocated to the program. Questioned costs: Undetermined, due to the distribution of costs through the Department?s approved cost allocation plan. Recommendation: We recommend the Agency review and enhance internal controls and procedures to ensure that costs charged to administrative cost pools are allowable and allocable per 2 CFR sections 200.403 and 200.405. Views of responsible officials: Management agrees with the finding.

Reference Number: 2022-031 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Agency of Human Services (Agency) Federal Program: Immunization Cooperative Agreements, COVID-19 - Immunization Cooperative Agreements Assistance Listing Number: 93.268 Award Number and Year: 19NH23IP922615 (7/1/2020 ? 6/30/2024) Compliance Requirement: Reporting ? Federal Funding Accountability and Transparency Act (FFATA) Type of Finding Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. The following key data elements must be reported: Subawardee Name and Data Universal Numbering System (DUNS) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $30,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. ?? 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: Subaward information was not reported to FSRS timely. The reporting deadline is no later than the last day of the month following the month in which a subaward is issued, but the Agency submitted reports after the due date. Context: Five of five subawards selected for testing were not reported timely to FSRS. Four of the five subawards tested were reported between 6 and 68 days late. One of the five subawards tested was issued in March 2022, but was not reported to FSRS until September 2022, or about five months after the due date. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE Cause: The Agency?s internal controls were not operating sufficiently to ensure that subawards were reported timely to FSRS. For one of the exceptions noted, the late report was initially caused by a delay in the grantee obtaining a Unique Entity ID (UEI), however, the Agency failed to report the subaward timely after the grantee?s UEI became available. Effect: Subawards were not reported to FSRS in accordance with FFATA requirements. Questioned costs: None noted. Recommendation: We recommend the Agency review and enhance internal controls and procedures to ensure that all required subawards are reported timely to FSRS no later than the end of the month following the month of issuance, in accordance with FFATA requirements. Views of responsible officials: Management agrees with the finding.

Reference Number: 2022-032 Prior Year Finding: 2021-019 Federal Agency: U.S. Department of Health and Human Services State Agency: Agency of Human Services (Agency) Federal Program: Epidemiology and Laboratory Capacity for Infectious Diseases (ELC), COVID-19 ? Epidemiology and Laboratory Capacity for Infectious Diseases (ELC) Assistance Listing Number: 93.323 Award Number and Year: 19NU50CK000520 (8/1/2019 ? 7/30/2022) Compliance Requirement: Reporting Type of Finding Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: Non-federal entities are required to submit quarterly Performance Measure Reports and Financial Reports, no later than 30 days after the end of each quarter, in accordance with the terms and conditions of the Federal award. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Agency did not submit Performance Measure reports in a timely manner and documentation to support both Performance Measures and Financial reports was either missing or did not agree to submitted reports. Context: Performance Measure Reports: Reports for two quarters were selected for testing in which six performance reports were reviewed. Financial Reports: Reports for two quarters were selected for testing in which ten financial reports were reviewed. We noted the following exceptions: ? 2 of 6 Performance Measure Data Reports were not filed in a timely manner. One report was submitted 15 days late and another was submitted 64 days late. ? For 2 of 6 Performance Measure reports, supporting documentation could not be provided. ? For 1 of 10 Financial reports, supporting documentation provided for unliquidated obligations did not agree with the information reported. Support indicated that $7,900 was unliquidated, but the amount reported was $790. Cause: Procedures and controls were insufficient to ensure that supporting documentation was maintained and available for audit and that reports were filed accurately and timely. The reports are filed electronically, and the Agency did not maintain copies of all supporting documentation used to prepare Performance Measure reports. In addition, the Agency made a data entry error on one of the Financial reports and controls did not detect or prevent the error. Effect: Performance measure data reported for the program was untimely and unsupported with adequate documentation. The Agency reported the incorrect value of unliquidated obligations on one Financial report. Questioned costs: Undetermined due to a lack of supporting documentation. Recommendation: We recommend the Agency review and enhance internal controls and procedures to ensure that all required reports are filed accurately and timely and that supporting documentation is maintained and is available for audit. Views of responsible officials: Management agrees with the finding.

Reference Number: 2022-033 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Agency of Human Services (Agency) Federal Program: Epidemiology and Laboratory Capacity for Infectious Diseases (ELC), COVID-19 ? Epidemiology and Laboratory Capacity for Infectious Diseases (ELC) Assistance Listing Number: 93.323 Award Number and Year: 19NU50CK000520 (8/1/2019 ? 7/30/2022) Compliance Requirement: Reporting ? Federal Funding Accountability and Transparency Act (FFATA) Type of Finding Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. The following key data elements must be reported: Subawardee Name and Data Universal Numbering System (DUNS) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $30,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. ?? 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: Subaward information was not reported to FSRS timely. The reporting deadline is no later than the last day of the month following the month in which a subaward is issued, but the Agency submitted several reports after the due date. Context: Four of five subawards selected for testing were not reported timely to FSRS. The subawards were issued in February 2022 and should have been reported no later than March 31, 2022, but they were all reported on April 22, 2022, which was 22 days after the due date. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE Cause: The Agency?s internal controls were not operating sufficiently to ensure that subawards were reported timely to FSRS. Effect: Subawards were not reported to FSRS in accordance with FFATA requirements. Questioned costs: None noted. Recommendation: We recommend the Agency review and enhance internal controls and procedures to ensure that all required subawards are reported timely to FSRS no later than the end of the month following the month of issuance, in accordance with FFATA requirements. Views of responsible officials: Management agrees with the finding.

Reference Number: 2022-034 Prior Year Finding: No Federal Agency: U.S. Department of Health and Human Services State Agency: Agency of Human Services (Agency) Federal Program: Foster Care ? Title IV-E Assistance Listing Number: 93.658 Award Number and Year: 2101VTFOST (10/1/2020 ? 9/30/2021) 2201VTFOST (10/1/2021 ? 9/30/2022) Compliance Requirement: Eligibility Type of Finding Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: A foster care provider, whether a foster family home or a child-care institution must be fully licensed by the proper State or tribal foster care licensing authority responsible for licensing such homes or child care institutions. The term ?child care institution? as defined in 45 CFR section 1355.20 includes a private child care institution, or a public child care institution which accommodates no more than 25 children, which is licensed by the State in which it is situated or has been approved, by the agency of such State responsible for licensing or approval of institutions of this type, as meeting the standards established for such licensing, but does not include detention facilities, forestry camps, training schools, or facilities operated primarily for the purpose of detention of children who are determined to be delinquent (42 USC 671(a)(10) and 672(c)). Effective October 1, 2010, the existing statutory definition of a child care institution includes a supervised setting in which an individual who has attained 18 years of age is living independently, consistent with conditions the Secretary establishes in regulations (42 USC 672(c)(2)). Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Agency of Human Services (Agency) was unable to provide documentation that all providers were fully licensed and determined eligible by the State foster care licensing authority to provide Foster Care services prior to issuance of payment for services provided to the program. Context: Sixty cases were selected for testing and the following exceptions were noted: ? For 2 of 60 cases, the providers were unlicensed at the time payment was made. License packets contain the criminal background and child abuse registry checks, therefore these criteria were unable to be verified. ? For 1 of 60 cases, the Agency was unable to provide documentation that the provider had been determined eligible. The Federal Share paid to the provider was $480. Cause: The Agency did not have sufficient controls in place to ensure that all providers were properly licensed and determined eligible to provide Foster Care services prior to issuance of payment. Effect The Agency made payments to unlicensed providers, and it was unable to provide documentation that another provider was properly licensed and eligible to provide services prior to issuing payments using Foster Care funds. Questioned costs: Below the reportable limit. Recommendation: We recommend the Agency review its procedures and controls over the licensing of providers to ensure that it maintains documentation that all providers are fully licensed and eligible to provide services prior to paying for services using federal Foster Care funds. Views of responsible officials: Management agrees with the finding.

Reference Number: 2022-035 Prior Year Finding: 2021-023 Federal Agency: U.S. Department of Health and Human Services State Agency: Agency of Human Services (Agency) Federal Program: Children?s Health Insurance Program (CHIP) Assistance Listing Number: 93.767 Award Number and Year: 2005VT5021 (10/1/2019 ? 9/30/2021) 2105VT5021 (10/1/2020 ? 9/30/2022) Compliance Requirement: Eligibility Type of Finding Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: Eligibility is based on the application of modified adjusted gross income and household definition, in addition to other permissible eligibility standards, for example standards relating to geographic area, age (up to, but not including age 19), and insurance status. States are directed at 42 CFR 457.340(d) to determine eligibility promptly and without undue delay and 42 CFR 435.912(c)(3) states that the determination of eligibility may not exceed 45 days. Over the course of the COVID-19 public health emergency, state Medicaid and CHIP agencies adopted many flexibilities offered by the Centers for Medicare and Medicaid Services (CMS) to respond effectively to local outbreaks, including changes to modify eligibility requirements and benefit packages. States have made policy, programmatic, and systems changes to respond effectively to COVID-19 including satisfying a ?continuous enrollment condition? for most Medicaid and CHIP beneficiaries who were enrolled in the program as of or after March 18, 2020. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Agency of Human Services (Agency) did not document that a participant had turned 19 during the year and should be removed from enrollment at the conclusion of the Public Health Emergency (PHE). It also did not complete eligibility determinations in a timely manner. Context: Sixty participants were selected for testing and the following exceptions were noted: ? One of sixty participants selected for testing turned 19 during the fiscal year. Due to the ?continuous enrollment condition? of the PHE, the participant could not be removed from enrollment, but the Agency did not document that the participant should be removed from enrollment at the conclusion of the PHE. ? For one of sixty participants, eligibility determination exceeded 45 days. Cause: The Agency did not adequately follow procedures regarding eligibility in accordance with federal program requirements and internal controls did not detect or prevent the errors. Effect Failure to document that a participant should be removed from enrollment at the conclusion of the PHE could result in an ineligible participant receiving benefits from the program. Failure to complete eligibility determination timely could result in a delay in issuing benefits to participants. Questioned costs: Undetermined. Recommendation: We recommend that the Agency review and enhance procedures and controls for CHIP beneficiary eligibility determination to ensure that eligibility is determined promptly within federal requirements. We further recommend that participants who become ineligible during the PHE are documented in a timely manner to ensure that benefits to ineligible participants are properly terminated at the conclusion of the PHE. Views of responsible officials: Management agrees with the finding.

Reference Number: 2022-036 Prior Year Finding: 2021-022 Federal Agency: U.S. Department of Health and Human Services State Agency: Agency of Human Services (Agency) Federal Program: Children?s Health Insurance Program (CHIP) Medicaid Cluster Assistance Listing Number: 93.767, 93.775, 96.777, 93.778 Award Number and Year: 2105VT5021 (10/1/2020 ? 9/30/2021) 2205VT5021 (10/1/2021 ? 9/30/2022) 2105VT5MAP (10/1/2020 ? 9/30/2021) 2205VT5MAP (10/1/2021 ? 9/30/2022) Compliance Requirement: Special Tests and Provisions - Provider Eligibility Type of Finding Material Weakness in Internal Control Over Compliance, Material Non-compliance Criteria or specific requirement: Compliance: In order to receive Medicaid or CHIP payments, providers must: (1) be licensed in accordance with Federal, State, and local laws and regulations to participate in the Medicaid or CHIP programs (42 CFR sections 431.107, 447.10 and 457.900); and Section 1902(a)(9) of the Social Security Act (42 USC 396a(a)(9)); (2) screened and enrolled in accordance with 42 CFR Part 455, Subpart E (sections 455.400 through 455.470); and make certain disclosures to the State (42 CFR part 455, subpart B, sections 455.100 through 455.106). Medicaid or CHIP managed care network providers are subject to the same disclosure, screening, enrollment, and termination requirements that apply to Medicaid fee-for-service providers in accordance with 42 CFR Part 438, Subpart H. Control: Per 2 CFR section 200.303(a), the non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Agency did not maintain documentation to support provider eligibility to participate in the Medicaid and CHIP programs. The provider eligibility requirement is administered by a 3rd-party that is required to determine and document the provider?s eligibility with the Agency?s requirements. License renewal information was not updated on a timely basis in the Provider Management Module (PMM). Context: Sixty Medicaid and sixty CHIP providers were selected for testing. Specifically, we noted the following exceptions: 1. 2 of 60 Medicaid and 2 of 60 CHIP provider files did not have current license information in the PMM. 2. For 3 of 60 Medicaid providers, the State did not maintain proper documentation that revalidation occurred within the required 5-year time frame. These providers were due for revalidation prior to the onset of the Public Health Emergency. 3. Documentation was incomplete to support that 6 of 60 CHIP providers were compliant with Vermont State law that providers must be in good tax standing to receive Medicaid funding. Cause: The Agency did not adequately follow procedures regarding Medicaid and CHIP provider eligibility in accordance with federal program requirements. Internal controls did not detect or prevent the errors. Effect: The Agency was unable to support provider eligibility or consistent application of their internal control process. Failure to maintain complete provider files and ensure that provider licenses are kept current could allow program payments to be made to an ineligible and/or unlicensed provider. Questioned costs: Undetermined. Recommendation: We recommend the Agency review its procedures and controls to ensure that documentation is maintained in accordance with the federal program requirements and that provider revalidations are performed timely. Views of responsible officials: Management agrees with the finding.

Reference Number: 2022-037 Prior Year Finding: 2021-025 Federal Agency: U.S. Department of Health and Human Services State Agency: Agency of Human Services Federal Program: Medicaid Cluster Assistance Listing Number: 93.775, 93.777, 93.778 Award Number and Year: 2105VT5MAP (10/1/2020 ? 9/30/2021) 2205VT5MAP (10/1/2021 ? 9/30/2022) Compliance Requirement: Special Tests and Provisions - Provider Health and Safety Standards Type of Finding Material Weakness in Internal Control Over Compliance, Material Non-compliance Criteria or specific requirement: Compliance: Providers must meet the prescribed health and safety standards for hospital, nursing facilities, and ICF/IID (42 CFR part 442). The standards may be modified in the State Plan. The Medicaid Provider Enrollment Compendium (MPEC) requires that State Medicaid Agencies perform screening of providers based upon their risk level. Screening includes verifications of licenses and compliance with all federal and state regulations of the program. Control: Per 2 CFR section 200.303(a), the non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: We noted that the Agency did not maintain documentation to support providers? compliance with the prescribed health and safety standards. The Agency requires that providers complete a health and safety agreement in which they attest to compliance with the Agency?s health and safety requirements. The provider eligibility and health and safety requirements are administered by a 3rd-party that is required to determine and document providers? eligibility with the Agency?s requirements in the provider management module (PMM). Health and safety documentation was not consistently maintained in provider files and compliance could not be verified. Context: Of the 60 samples selected for testing, health and safety standards could not be verified for the following: 1. 39 of 60 provider files did not have current license information maintained in the PMM and the monthly screening process was not followed to validate the licenses. 2. One provider file was not available for review. 3. 3 of 60 provider files did not contain documentation that the provider was in good tax standing. Cause: The Agency?s 3rd-Party provider did not consistently maintain current documentation in the provider management module and controls did not detect or prevent the errors. Effect: Failure to verify and document compliance with health and safety standards could allow ineligible providers to perform services under the Medicaid program. Questioned costs: Undetermined. Recommendation: We recommend the Agency review its procedures and controls to ensure that documentation is maintained in accordance with program requirements and that all providers are compliant with required health and safety standards. Views of responsible officials: Management agrees with the finding.

Reference Number: 2022-038 Prior Year Finding: 2021-026 Federal Agency: U.S. Department of Health and Human Services State Agency: Agency of Human Services Federal Program: Medicaid Cluster Assistance Listing Number: 93.775, 93.777, 93.778 Award Number and Year: 2105VT5MAP (10/1/2020 ? 9/30/2021) 2205VT5MAP (10/1/2021 ? 9/30/2022) Compliance Requirement: Reporting ? Federal Funding Accountability and Transparency Act (FFATA) Type of Finding Material Weakness in Internal Control Over Compliance, Material Non-compliance Criteria or specific requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. The following key data elements must be reported: Subawardee Name and Data Universal Numbering System (DUNS) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $30,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. ?? 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: Subawards were not reported to FSRS in accordance with FFATA requirements. The following errors were noted: ? Eighteen subawards and subaward amendments were not reported to FSRS. ? Three subawards and subaward amendments were not reported timely. ? One subaward was reported under an incorrect DUNS number. Context: The Agency of Human Services (Agency) Internal Audit Group (IAG) reports subaward information in FSRS for its various departments using subaward information provided by the departments. Thirty-two subawards, totaling $10,711,156, were selected for testing and the following reporting errors were noted: ? Agency of Human Services Central Office (AHS-CO): Two subawards totaling $558,000 were not reported to FSRS. The subawards were issued on 10/1/2021 but were not reported to FSRS until after auditors selected them for testing. ? Department of Children and Families (DCF): One subaward of $32,284 was not reported timely. The subaward should have been reported no later than 1/31/2022 but it was reported on 2/17/2022, or 17 days late. ? Department of Mental Health (DMH): One subaward of $59,790 was not reported timely. The subaward should have been reported no later than 6/30/2022 but it was reported on 7/19/2022, or 19 days late. Three subaward amendments, totaling $31,475 were not reported to FSRS. ? Department of Aging and Independent Living (DAIL): One subaward of $42,369 was not reported timely. In addition, an amendment for the subaward was not reported. The amount not reported to FSRS was $8,400. ? Department of Vermont Health Access (DVHA): Two subawards totaling $130,231 were not reported to FSRS. One subaward of $38,364 was reported under an incorrect DUNS number. ? Vermont Department of Health (VDH): Eleven subawards totaling $7,416,814 were not reported to FSRS. SEE SCHEDULE OF FINDINGS AND QUESTIONED COSTS FOR CHART/TABLE Cause: The individual departments did not provide the IAG with complete subaward information on a timely basis which caused errors and omissions in subaward reporting to FSRS. Effect: Subawards were not reported to FSRS in accordance with FFATA requirements. Questioned costs: None noted. Recommendation: We recommend the Agency review and enhance internal controls and procedures to ensure that all required subawards and subaward modifications are reported accurately to FSRS in accordance with FFATA requirements. Views of responsible officials: Management agrees with the finding.

Reference Number: 2022-039 Prior Year Finding: 2021-024 Federal Agency: U.S. Department of Health and Human Services State Agency: Agency of Human Services (Agency) Federal Program: Medicaid Cluster Assistance Listing Number: 93.775, 96.777, 93.778 Award Number and Year: 2105VT5MAP (10/1/2020 ? 9/30/2021) 2205VT5MAP (10/1/2021 ? 9/30/2022) Compliance Requirement: Special Tests and Provisions ? Medical Loss Ratio (MLR) Type of Finding Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: For all contracts, the state must ensure that each Managed Care Organization (MCO), Prepaid Inpatient Health Plan (PIHP), and Prepaid Ambulatory Health Plan (PAHP) submits a report with the data elements specified in 42 CFR sections 438.8(k) and 438.8(n). The report should contain the required 13 data elements in the regulation, reflect the correct reporting years, and contain an attestation of accuracy regarding the calculation of the medical loss ratio. Managed care plans are required to submit the annual report in the time and manner established by the state, which must be within 12 months after the end of the MLR reporting year. The state should have a policy and procedure to indicate when the report(s) are due from plans and should not accept multiple submissions from plans unless the capitation payments are revised retroactively. Control: Per 2 CFR section 200.303(a), the non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The 2020 Medical Loss Ratio report for the State?s Prepaid Inpatient Health Plan (PIHP) was not submitted within twelve months after the end of the reporting year. Context: The Agency of Human Services, Department of Vermont Health Access (DVHA) acts as its own PIHP. DVHA was required to submit the PIHP?s Medical Loss Ratio report for the year ending 12/31/2020 no later than 12/31/2021 but the report was not submitted until 2/2/2022. Cause: The Agency did not adequately follow procedures regarding timely submission of the Medical Loss Ratio report for its PIHP. Effect: The Agency is out of compliance with MLR reporting requirements. Questioned costs: Undetermined. Recommendation: We recommend the Agency review and enhance its procedures and controls regarding Medical Loss Ratio reporting to ensure that reports for its PIHP are submitted timely. Views of responsible officials: Management agrees with the finding.

Reference Number: 2021-005 Prior Year Finding: N/A Federal Agency: U.S. Department of Agriculture State Agency: Agency of Human Services (Agency) Federal Program: SNAP Cluster Assistance Listing Number: 10.551, 10.561 Award Number and Year: 4VT430446 (10/1/2019 ? 9/30/2020) 4VT400406 (10/1/2019 ? 9/30/2020) 4VT430426 (10/1/2020 ? 9/30/2021) 4VT430446 (10/1/2020 ? 9/30/2021) 4VT400406 (10/1/2020 ? 9/30/2021) 4VT400466 (10/1/2020 ? 9/30/2021) Compliance Requirement: Procurement, Suspension and Debarment Type of Finding Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: Procurement ? When procuring property and services, states must use the same policies and procedures they use for procurements from their non-federal funds (2 CFR section 200.317). The State of Vermont follows Bulletin 3.5 ? Procurement and Contracting Procedures (Bulletin 3.5) which is applicable to purchases made by Vermont State agencies for both state and federal programs. Suspension and Debarment - Non-federal entities are prohibited from contracting with or making subawards under covered transactions to parties that are suspended or debarred. ?Covered transactions? include contracts for goods and services awarded under a non-procurement transaction (e.g., grant or cooperative agreement) that are expected to equal or exceed $25,000 or meet certain other criteria as specified in 2 CFR section 180.220. All non-procurement transactions entered into by a pass-through entity (i.e., subawards to subrecipients), irrespective of award amount, are considered covered transactions, unless they are exempt as provided in 2 CFR section 180.215. When a non-federal entity enters into a covered transaction with an entity at a lower tier, the non-federal entity must verify that the entity, as defined in 2 CFR section 180.995 and agency adopting regulations, is not suspended or debarred or otherwise excluded from participating in the transaction. This verification may be accomplished by (1) checking the System for Award Management (SAM) Exclusions maintained by the General Services Administration (GSA) and available at https://www.beta.sam.gov/, (2) collecting a certification from the entity, or (3) adding a clause or condition to the covered transaction with that entity (2 CFR section 180.300). Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: We noted the Agency was unable to provide supporting documentation to show that it complied with the procurement and suspension and debarment requirements contained in the State?s procurement policy, Bulletin 3.5. Context: Two of eleven vendors selected for procurement testing did not have contracts or other supporting documentation available for review. Purchases from these vendors exceeded $100,000 each but were made without using a competitive bidding process and without signed contracts in place as required by Bulletin 3.5. Two of six samples selected for suspension and debarment testing did not have documentation to support that the vendor?s suspension and debarment status had been verified. Cause: The Agency made purchases from the vendors in prior years and those transactions were below the State?s competitive bidding threshold. When the total amount purchased by the program increased above the State?s competitive bidding threshold, the Agency failed to implement the required procurement and suspension and debarment procedures contained in Bulletin 3.5. Effect: The Agency is not compliant with Federal and State procurement and suspension and debarment requirements. Failure to adhere to procurement policies and procedures may result in obtaining goods or services under terms that are not in the best interest of the Federal program and/or the State. Failure to adhere to suspension and debarment requirements may result in the State doing business with a vendor that is suspended or debarred and not authorized to provide goods and services to the program. Questioned costs: Undetermined due to the lack of documentation. Statistically Valid Sample: Yes Recommendation: We recommend the Agency review and enhance procedures and controls to ensure that it follows the State?s procurement policy, including suspension and debarment requirements, for all goods and services charged to the program. Views of Responsible Officials: Management agrees with the finding. Reference Number: 2021-005 Prior Year Finding: N/A Federal Agency: U.S. Department of Agriculture State Agency: Agency of Human Services (Agency) Federal Program: SNAP Cluster Assistance Listing Number: 10.551, 10.561 Award Number and Year: 4VT430446 (10/1/2019 ? 9/30/2020) 4VT400406 (10/1/2019 ? 9/30/2020) 4VT430426 (10/1/2020 ? 9/30/2021) 4VT430446 (10/1/2020 ? 9/30/2021) 4VT400406 (10/1/2020 ? 9/30/2021) 4VT400466 (10/1/2020 ? 9/30/2021) Compliance Requirement: Procurement, Suspension and Debarment Type of Finding Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: Procurement ? When procuring property and services, states must use the same policies and procedures they use for procurements from their non-federal funds (2 CFR section 200.317). The State of Vermont follows Bulletin 3.5 ? Procurement and Contracting Procedures (Bulletin 3.5) which is applicable to purchases made by Vermont State agencies for both state and federal programs. Suspension and Debarment - Non-federal entities are prohibited from contracting with or making subawards under covered transactions to parties that are suspended or debarred. ?Covered transactions? include contracts for goods and services awarded under a non-procurement transaction (e.g., grant or cooperative agreement) that are expected to equal or exceed $25,000 or meet certain other criteria as specified in 2 CFR section 180.220. All non-procurement transactions entered into by a pass-through entity (i.e., subawards to subrecipients), irrespective of award amount, are considered covered transactions, unless they are exempt as provided in 2 CFR section 180.215. When a non-federal entity enters into a covered transaction with an entity at a lower tier, the non-federal entity must verify that the entity, as defined in 2 CFR section 180.995 and agency adopting regulations, is not suspended or debarred or otherwise excluded from participating in the transaction. This verification may be accomplished by (1) checking the System for Award Management (SAM) Exclusions maintained by the General Services Administration (GSA) and available at https://www.beta.sam.gov/, (2) collecting a certification from the entity, or (3) adding a clause or condition to the covered transaction with that entity (2 CFR section 180.300). Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: We noted the Agency was unable to provide supporting documentation to show that it complied with the procurement and suspension and debarment requirements contained in the State?s procurement policy, Bulletin 3.5. Context: Two of eleven vendors selected for procurement testing did not have contracts or other supporting documentation available for review. Purchases from these vendors exceeded $100,000 each but were made without using a competitive bidding process and without signed contracts in place as required by Bulletin 3.5. Two of six samples selected for suspension and debarment testing did not have documentation to support that the vendor?s suspension and debarment status had been verified. Cause: The Agency made purchases from the vendors in prior years and those transactions were below the State?s competitive bidding threshold. When the total amount purchased by the program increased above the State?s competitive bidding threshold, the Agency failed to implement the required procurement and suspension and debarment procedures contained in Bulletin 3.5. Effect: The Agency is not compliant with Federal and State procurement and suspension and debarment requirements. Failure to adhere to procurement policies and procedures may result in obtaining goods or services under terms that are not in the best interest of the Federal program and/or the State. Failure to adhere to suspension and debarment requirements may result in the State doing business with a vendor that is suspended or debarred and not authorized to provide goods and services to the program. Questioned costs: Undetermined due to the lack of documentation. Statistically Valid Sample: Yes Recommendation: We recommend the Agency review and enhance procedures and controls to ensure that it follows the State?s procurement policy, including suspension and debarment requirements, for all goods and services charged to the program. Views of Responsible Officials: Management agrees with the finding.

Reference Number: 2021-006 Prior Year Finding: N/A Federal Agency: U.S. Department of Agriculture State Agency: Agency of Human Services (Agency) Federal Program: SNAP Cluster Assistance Listing Number: 10.551, 10.561 Award Number and Year: 4VT430446 (10/1/2019 ? 9/30/2020) 4VT400406 (10/1/2019 ? 9/30/2020) 4VT430426 (10/1/2020 ? 9/30/2021) 4VT430446 (10/1/2020 ? 9/30/2021) 4VT400406 (10/1/2020 ? 9/30/2021) 4VT400466 (10/1/2020 ? 9/30/2021) Compliance Requirement: Special Tests and Provisions ? EBT Card Security Type of Finding Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: The state is required to maintain adequate security over, and documentation/records for, EBT cards to prevent their theft, embezzlement, loss, damage, destruction, unauthorized transfer, negotiation, or use (7 CFR section 274.8(b)(3)). Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: We noted that the Agency did not maintain documentation and records to support the required EBT Card Security procedures. Context: For three out of forty daily issued/destroyed card reconciliations completed, the reconciliation did not have the proper preparer and reviewer signatures. For one out of forty days selected, the daily issued/destroyed card reconciliation was not completed. Cause: The Agency did not adequately follow its procedures for completing daily issued/destroyed card reconciliations as part of the EBT Card Security process and controls did not detect or prevent the errors. Effect: The Agency is not compliant with the EBT Card Security documentation requirement and may be subject to disallowed program costs by the grantor. In addition, a lack of controls over EBT Card Security could result in improper use of EBT benefits. Questioned costs: Undetermined due to the lack of documentation. Statistically Valid Sample: Yes Recommendation: We recommend the Agency review and enhance its procedures and controls over EBT Card Security to ensure that documentation is maintained in accordance with the federal program requirements. Views of Responsible Officials: Management agrees with the finding.

Reference Number: 2021-007 Prior Year Finding: N/A Federal Agency: U.S. Department of Agriculture State Agency: Agency of Human Services (Agency) Federal Program: SNAP Cluster Assistance Listing Number: 10.551, 10.561 Award Number and Year: 4VT430446 (10/1/2019 ? 9/30/2020) 4VT400406 (10/1/2019 ? 9/30/2020) 4VT430426 (10/1/2020 ? 9/30/2021) 4VT430446 (10/1/2020 ? 9/30/2021) 4VT400406 (10/1/2020 ? 9/30/2021) 4VT400466 (10/1/2020 ? 9/30/2021) Compliance Requirement: Special Tests and Provisions ? EBT Card Security Type of Finding Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: States must have systems in place to reconcile all funds entering into, exiting from, and remaining in the system each day with the state?s benefit account with Treasury and EBT contractor records. This includes a reconciliation of the state?s issuance files of postings to recipient accounts with the EBT contractor. States (generally through the EBT contractor that operates the EBT system) must also have systems in place to reconcile retailer credit activity as reported into the banking system to client transactions maintained by the processor and to the funds drawn down from the EBT benefit account with Treasury. States? EBT system processors should maintain audit trails that document the cycle of client transactions from posting to point-of-sale transactions at retailers through settlement of retailer credits. The financial and management data that comes from the EBT processor is reconciled by the state to the SNAP issuance files and settlement data to ensure that benefits are authorized by the state and funds have been properly drawn down. States may only draw federal funds for authorized transactions (e.g., electronic point-of-sale purchases supported by entry of a valid personal identification number (PIN) or purchases using manual vouchers with telephone verification supported by a client signature and an EBT contractor authorization number) (7 CFR sections 274.3(a)(1) and 274.4(a)). Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: We noted that the Agency did not maintain proper documentation to support the required EBT Reconciliations. Context: For one out of forty EBT Reconciliations sampled, the completed reconciliation did not have the proper preparer and reviewer signatures. Cause: The Agency did not adequately follow its procedures for retaining proper support over the EBT reconciliation process and controls did not detect or prevent the error. Effect: The Agency is not compliant with the EBT Reconciliation requirement and may be subject to disallowed program costs by the grantor. Improper controls over the EBT reconciliation process could result in ineligible costs being charged to the program. Questioned costs: Undetermined due to the lack of documentation. Statistically Valid Sample: Yes Recommendation: We recommend the Agency review and enhance procedures and controls to ensure that documentation for EBT reconciliations is maintained in accordance with the federal program requirements. Views of Responsible Officials: Management agrees with the finding.

Reference Number: 2021-008 Prior Year Finding: N/A Federal Agency: U.S. Department of Agriculture State Agency: Department of Finance and Management (Finance) Federal Program: COVID-19 ? Pandemic EBT Food Benefits Assistance Listing Number: 10.542 Award Number and Year: 2020 ? 2021 Compliance Requirement: Reporting: Schedule of Expenditures of Federal Awards Type of Finding Material Weakness in Internal Control Over Compliance Criteria or specific requirement: Compliance: Per 2 CFR 200 Section 510(b), the auditee must prepare a schedule of expenditures of Federal awards for the period covered by the auditee?s financial statements which must include the total Federal awards expended as determined in accordance with Section 200.502. The schedule must list individual Federal programs by Federal agency and provide total Federal awards expended for each individual Federal program and the Assistance Listings Number or other identifying number when the Assistance Listings information is not available. Per Section 502(g), Federal non-cash assistance, such as free rent, food commodities, donated property, or donated surplus property, must be valued at fair market value at the time of receipt or the assessed value provided by the Federal agency. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Schedule of Expenditures of Federal Awards (SEFA) submitted to auditors for test work was missing a new non-cash assistance program which was later determined to be a new Type A program. Context: When reconciling support to the SEFA submitted to auditors during test work, it was discovered that approximately $15.2 million in non-cash assistance for assistance listing 10.542-Pandemic EBT Food Benefits had been omitted. After the error was detected, this program was determined to be a new major program. Questioned costs: Undetermined. Cause: Procedures and internal controls were not sufficient to ensure that non-cash assistance reported on the SEFA was complete and accurate and tied to supporting documentation. Individual State agencies/departments prepare their own sections of the SEFA and submit them to Finance which compiles the State?s consolidated report. Controls did not prevent nor detect that a new non-cash assistance program had been omitted. Effect: Federal non-cash assistance was incorrectly compiled and reported on the SEFA which was used to determine Type A and Type B programs for the FY 2021 Single Audit. After the error was detected and corrected, Assistance Listing 10.542 was required to be audited as a new major program. Statistically Valid Sample: N/A Recommendation: We recommend that Finance improve its SEFA compilation process to ensure that program expenditures reported on the State?s SEFA are complete and accurate. Procedures and controls should include a process to identify non-cash assistance programs that are new to the State and ensure they are included on the SEFA. We further recommend that Finance work with the State?s agencies and departments to review and update their SEFA compilation procedures to ensure that non-cash assistance reported on the SEFA is accurate and that it ties to supporting documentation. Views of responsible officials: Management agrees with the finding.

Reference Number: 2021-009 Prior Year Finding: 2020-009, 2020-010 Federal Agency: U.S. Department of Labor State Agency: Department of Labor (Department) Federal Program: Unemployment Insurance, COVID-19 ? Unemployment Insurance Assistance Listing Number: 17.225 Award Number and Year: UI347462055A50 (4/1/2020 ? 6/30/2023) UI326301955A50 (10/1/2018 ? 12/31/2021) UI340892055A50 (10/1/2019 ? 12/31/2022) UI341952055A50 (10/1/2019 ? 9/30/2020) UI345252060A50 (1/1/2020 ? 9/30/2022) Compliance Requirement: Reporting Type of Finding Material Weakness in Internal Control over Compliance, Material Noncompliance Criteria or specific requirement: Compliance ? ETA 191, Financial Status of UCFE/UCX (OMB No. 1205-0162) ? Quarterly report on UCFE and UCX expenditures and the total amount of benefits paid to claimants of specific federal agencies (ET Handbook 401). Per federal regulations, the ETA 191 should be submitted electronically to the National Office by the 25th of the month following the close of the quarter. ETA 2112, UI Financial Transaction Summary (OMB No. 1205-0154) ? A monthly summary of transactions, which account for all funds received in, passed through, or paid out of the state unemployment fund (ET Handbook 401). Per federal regulations, the ETA 2112 should be submitted electronically to the National Office by the 1st day of the second month following the close of the reporting month. ETA 9130, Financial Status Report, UI Programs ? All ETA grantees are required to submit quarterly financial reports for each grant award which they operate, including standard program and pilot, demonstration, and evaluation projects. Financial data is required to be reported cumulatively from grant inception through the end of each reporting period. A separate ETA 9130 is submitted for each of the following: UI, PEUC, and PUA Administration, DUA, TRA/RTAA, and UA Projects (administration and benefits). ETA 9050, Time Lapse of All First Payments except Workshare ? The ETA 9050 report contains monthly information on first payment time lapse. This report concerns the time it takes states to pay benefits to claimants for the first compensable week of unemployment. That data addressed first payment time lapse for total unemployment only. The report is submitted electronically to the ETA National Office on the 20th of the month following the month to which the data relates. ETA 9052, Nonmonetary Determination Time Lapse Detection - The ETA 9052 report contains monthly information on the time it take states to issue nonmonetary determinations from the date the issues are first detected by the agency. Single-claimant and multi-claimant nonmonetary determinations are included in the report. Nonmonetary determinations made by organizational units such as Benefits Accuracy Measurement (BAM) and Benefit Payment Control (BPC) are also included in the report. Note: Overpayment notices on uncontested earnings detected by any method (e.g., crossmatch) should not be included. The report is submitted electronically to the ETA National Office on the 20th of the month following the month to which the data relates. ETA 9055, Appeals Case Aging - The ETA 9055 report gathers monthly information on the inventory of lower authority and higher authority single claimant appeals cases that have been filed but not decided. Appeals case aging provides information about the number of days from the date an appeal was filed through the end of the month covered by the report. Also included are the average and median ages of the pending single claimant appeals cases. The report is submitted electronically to the ETA National Office on the 20th of the month following the month to which the data relates. Internal Control ? Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with the guidance in "Standards for Internal Control in the Federal Government" issued by the Comptroller General of the United States or the "Internal Control-Integrated Framework," issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department was not able to provide support that it had submitted required financial and performance reports by the due dates nor that reports had been reviewed and approved by an authorized State official prior to submission. Questioned costs: Undetermined. Context: We reviewed a sample of the ETA 191, ETA 2112 and ETA 9130 financial reports as well as a sample of the ETA 9050, ETA 9052 and ETA 9055 performance reports filed during for FY 2021. The following exceptions were noted: ETA 191: 2 of 2 quarterly reports reviewed were submitted after the required due date. The 9/30/2020 report was submitted 18 days late and the 3/31/2021 report was submitted 1 day late. In addition, support could not be provided to document that the reports had been reviewed and approved prior to submission. ETA 2112: 4 of 4 monthly reports reviewed were submitted after the required due date. The September 2020 report was due 11/1/2020 but was filed 3/25/2021, or 144 days late. The November 2020 report was due 1/1/2021 but was filed 4/2/2021, or 91 days late. The January 2021 report was due 3/1/2021 but was filed 6/7/2021, or 98 days late. The April 2021 report was due 6/1/2021 but was filed 7/19/2021, or 48 days late. ETA 9130: Reports for the 9/30/2020 and 3/31/201 quarters were reviewed which included 17 individual grant reports, 7 reports for the 9/30/2020 quarter and 10 for the 3/31/2021 quarter. 5 of the 7 grant reports for the 9/30/2020 quarter were filed after the due date. These reports were due 11/14/2020 but 2 were filed on 12/4/2020, or 20 days late; 2 were filed on 12/7/2020, or 23 days late; 1 was filed on 12/8/2020, or 24 days late. ETA 9050: Support could not be provided that 3 of 3 reports reviewed were submitted by the required due date. In addition, support could not be provided to document that the reports had been reviewed and approved prior to submission. ETA 9052: Support could not be provided that 3 of 3 reports reviewed were submitted by the required due date. In addition, support could not be provided to document that the reports had been reviewed and approved prior to submission. ETA 9055: Support could not be provided that 3 of 3 reports reviewed were submitted by the required due date nor that the reports had been reviewed and approved prior to submission. In addition, documentation could not be provided to support lower appeals data. Cause: The Department does not have sufficient internal controls in place over compliance with Unemployment Insurance reporting requirements to ensure that reports are submitted timely and that they are reviewed and approved prior to submission. Effect: Financial and performance reports were consistently submitted late. A lack of review and approval of financial and performance reports could allow incorrect data to be reported for the program which could misrepresent the State?s financial and programmatic performance in the program. Statistically Valid Sample: Yes Recommendation: We recommend that policies and procedures be implemented to ensure that all financial and performance reports are filed timely and accurately and that reports are reviewed and approved by an authorized State official prior to submission. Views of responsible officials: Management agrees with the finding.

Reference Number: 2021-010 Prior Year Finding: N/A Federal Agency: U.S. Department of Labor State Agency: Department of Labor (Department) Federal Program: Unemployment Insurance, COVID-19 ? Unemployment Insurance Assistance Listing Number: 17.225 Award Number and Year: UI34089310 (10/1/2019 ? 12/31/2022), UI35679DO0 (7/1/2021 ? 12/31/2023) Compliance Requirement: Special Tests and Provisions: UI Benefit Payments Type of Finding Significant Deficiency in Internal Control over Compliance, Other Matters Criteria or specific requirement: Compliance ? The State Workforce Agency (SWA) is required by 20 CFR section 602.11(d) to operate and maintain a quality control system. The Benefits Accuracy Measurement (BAM) program is DOL?s quality control system designed to assess the accuracy of UI benefit payments and denied claims, unless the SWA is excepted from such requirement (20 CFR section 602.22). The program estimates error rates, that is, numbers of claims improperly paid or denied and dollar amounts of benefits improperly paid or denied, by projecting the results from investigations of statistically sound random samples to the universe of all claims paid and denied in a state. Specifically, the SWA?s BAM unit is required to draw a weekly sample of payments and denied claims, complete prompt, and in-depth investigations to determine if the administration of the UC program is consistent with state and federal law (20 CFR section 602.21(d)). As presented in the ET Handbook No. 395, the investigation involves a review of state agency records, as well as contacting the claimant, employers, and third parties (either in-person, by telephone, or by fax) to conduct new and original fact-finding related to all of the information pertinent to the paid or denied claim that was sampled. BAM investigators review cases for adherence to federal and state law as well as official policy. The following time limits are established for completion of all cases for the year. (The "year" includes all batches of weeks ending in the calendar year.): ? a minimum of 70 percent of cases must be completed within 60 days of the week ending date of the batch; ? 95 percent of cases must be completed within 90 days of the week ending date of the batch; ? a minimum of 98 percent of cases for the year must be completed within 120 days of the ending date of the calendar year. Internal Control ? Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with the guidance in "Standards for Internal Control in the Federal Government" issued by the Comptroller General of the United States or the "Internal Control-Integrated Framework," issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department did not complete BAM case investigations within the time limits established in ET Handbook No. 395. Questioned costs: Undetermined. Context: Forty cases were selected for testing, and we noted that the Department did not meet the required time limits for closing cases within 60, 90 or 120 days. Specifically, we noted the following: ? 68% of cases tested (27 cases) were closed within 60 days which is less than the required 70% ? 78% of cases tested (31 cases) were closed within 90 days which is less than the required 95% ? 80% of cases tested (32 cases) were closed within 120 days which is less than the required 98% Cause: Due to the COVID-19 pandemic, the Department disassembled its BAM investigation unit in February 2020 and reassigned staff to other activities. The BAM unit was reassembled in October 2020. Effect: Noncompliance with BAM case investigation time limits could delay the detection and correction of inaccurate benefit payments and denied claims. Statistically Valid Sample: Yes Recommendation: We recommend that the Department review and enhance procedures and controls to ensure that BAM case investigations are completed timely. Views of responsible officials: Management agrees with the finding.

Reference Number: 2021-011 Prior Year Finding: 2020-010 Federal Agency: U.S. Department of Labor State Agency: Department of Labor (Department) Federal Program: Unemployment Insurance, COVID-19 ? Unemployment Insurance Assistance Listing Number: 17.225 Award Number and Year: UI34525Y90 (1/1/2020 ? 9/30/2022), UI35976JU0 (1/1/2021 ? 9/30/2022) Compliance Requirement: Special Tests and Provisions: UI Reemployment Programs: RESEA Type of Finding: Significant Deficiency in Internal Control over Compliance, Other Matters Criteria or specific requirement: Compliance ? The UI program serves as one of the principal ?gateways? to the workforce system. It is often the first workforce program accessed by individuals who need workforce services. The WPRS and RESEA programs serve as UI?s primary programs that facilitate the reemployment needs of UI claimants. WPRS, which is mandated by Section 303(j) of the Social Security Act, is designed to identify UI claimants who are most likely to exhaust their benefits and need reemployment assistance to return to work, and refer them to appropriate reemployment services, such as: job search and job placement assistance; counseling; testing; provision of occupational and labor market information; and assessments. WPRS provides reemployment services to selected claimants through an early intervention process. The number of individuals served under WPRS is determined by the state (and/or local areas) based on its capacity to serve these individuals. UIPL No. 41-94 provides guidance on WPRS requirements. RESEA is authorized by Section 306 of the Social Security Act and builds on the success of both WPRS and RESEA?s predecessor, the former UI Reemployment and Eligibility Assessment (REA) program. RESEA uses an evidence-based integrated approach that combines an eligibility assessment for continuing UI eligibility and the provision of reemployment services. RESEA is a voluntary program and under certain circumstances may be designed to also satisfy WPRS requirements. Operating guidance for the RESEA program is updated annually. UIPL 7-19 provides RESEA operating Guidance for FY 2019. Internal Control ? Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with the guidance in "Standards for Internal Control in the Federal Government" issued by the Comptroller General of the United States or the "Internal Control-Integrated Framework," issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department did not retain Eligibility Review Questionnaire forms required by the program to verify compliance with federal regulations. Controls were not working sufficiently to document that a staff member at the Department with knowledge of the program reviewed eligibility requirements prior to admission of participants to the RESEA program. Questioned costs: Undetermined. Context: We noted that 3 of 60 samples selected for testing were missing Eligibility Review Questionnaire forms and subsequently a lack of proper eligibility review and approval. Cause: The Department?s procedures and internal controls are not sufficient to ensure compliance with RESEA requirements. Effect: Without clear documentation on file of a participant?s eligibility review, it is possible that ineligible participants could receive benefits from the program. Statistically Valid Sample: Yes Recommendation: We recommend that policies and procedures be implemented to ensure that internal controls over RESEA include documentation of participants? eligibility review by a UI supervisor. Views of responsible officials: Management agrees with the finding.

Reference Number: 2021-012 Prior Year Finding: 2020-006 Federal Agency: U.S. Department of Labor State Agency: Department of Labor (Department) Federal Program: Unemployment Insurance, COVID-19 ? Unemployment Insurance Assistance Listing Number: 17.225 Award Number and Year: UI-34746-20-55-A-50 (4/1/2020 ? 6/30/2022) Compliance Requirement: Eligibility Type of Finding: Material Weakness in Internal Control over Reporting, Material Noncompliance Criteria or specific requirement: Compliance ? State Workforce Agencies (SWA) responsibilities include: (1) establishing specific, detailed policies and operating procedures which comply with the requirements of federal laws and regulations; (2) determining the state UI tax structure; (3) collecting state UI contributions from employers (commonly called ?unemployment taxes?); (4) determining claimant eligibility and disqualification provisions; (5) making payment of UI benefits to claimants; (6) managing the program?s revenue and benefit administrative functions; (7) administering the programs in accordance with established policies and procedures; and (8) enacting state UC law that conforms with federal UC law. UIPL No. 16-20 ? The Consolidated Appropriations Act, 2021 (Pub. L. 116-260), enacted on December 27, 2020, included the Continued Assistance for Unemployed Workers Act of 2020 (Continued Assistance Act) in Division N, Title II, Subtitle A. The Continued Assistance Act extended the PUA program and enacted several program integrity measures, including a requirement that all individuals receiving a PUA payment on or after December 27, 2020, submit documentation substantiating employment, self-employment, or the planned commencement of employment or self-employment. Internal Control ? Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with the guidance in "Standards for Internal Control in the Federal Government" issued by the Comptroller General of the United States or the "Internal Control-Integrated Framework," issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Regular Unemployment Insurance program is administered by the Vermont Department of Labor (Department) and gives financial aid to unemployed individuals. In 2020, the federal government created new temporary unemployment insurance programs, including the Pandemic Unemployment Assistance (PUA) program, the Pandemic Emergency Unemployment Insurance (PEUC), and the Federal Pandemic Unemployment Compensation (FPUC) program, to further help individuals who lost their jobs due to COVID-19. The COVID-19 pandemic significantly increased the unemployment rate nationally and in Vermont. Before the pandemic, the national unemployment rate was about 4% in January 2020 and about 3% in Vermont. By April 2020, the national unemployment rate and the Vermont rate both increased to about 15%. The estimated unsupported claims and payments from these programs are significant to the State of Vermont. Questioned costs: Undetermined and under investigation by both federal and state authorities. Context: We reviewed a sample for each of the following populations of unemployment claims: ? Regular unemployment July 1, 2020 through June 30, 2021 (Population 1) ? FPUC July 1, 2020 through June 30, 2021 (Population 2) ? PUA July 1, 2020 through December 26, 2020 (Population 3) ? PUA December 27, 2020 through June 30, 2021 (Population 4) Population 4 had the additional documentation requirements for eligibility noted in UIPL No. 16-20 in the compliance section above. Population 4 represents $128M and 14% of all claims paid in FY21. We identified the following exceptions in the Population 4 sample: ? Thirty-eight (38) out of thirty-eight (38) PUA claims samples tested had no evidence of review nor timely review of wage support; ? Nineteen (19) out of thirty-eight (38) PUA claims samples tested had missing or inaccurate documentation that did not support the claims payment amount. Cause: The Department was unable to respond in a timely and effective manner to address the significant increase in claims and federal funds received in Fiscal Year 2021. The Department relied on an inadequate computer system during the pandemic to manage the program, resulting in various system errors and processing delays. Effect: The Department paid a significant amount of unsupported claims through the unemployment insurance program as a result of the COVID-19 pandemic. Claims were paid without the required wage support documentation and without review by the Department as required by the U.S. Department of Labor. Recommendation: We recommend the Department perform a thorough risk assessment over the unemployment insurance program and design controls and processes to address identified risks. Seeking continuous improvement to the risk assessment and internal processes is key to strengthening governance, risk management, internal controls, program management and overall operations within the program. Views of responsible officials: The Department acknowledges and accepts this finding. The Pandemic Unemployment Assistance (PUA) program did not exist prior to the COVID-19 global health pandemic. Unlike the unemployment insurance program, which has been in existence since 1935, the PUA program did not have the inherent checks and balances built into the system to ensure proper program administration. Instead, state workforce agencies were expected to build the PUA program from the ground up with little guidance from the USDOL all the while managing through a pandemic that caused unprecedented upheaval in the employment status of millions of citizens. It is accurate that the Vermont Department of Labor was not able to implement the necessary checks and balances into the PUA program to ensure proper program eligibility. As has been pointed out in the audit finding, it was not until nine months after the start of the PUA program that Congress passed legislation that required documentation to be provided to substantiate program eligibility. At that time, due to the significant and unprecedented strains on the Department of Labor?s resources, the newly established documentation requirements were not able to be implemented prior to the end of the PUA program. The Department acknowledges that the lack of the ability to review claimant financial eligibility may have resulted in improper payments. It is important to point out that UIPL 16-20, Change 4 was issued on January 8, 2021, providing no time for UI programs to implement the required changes while still continuing to provide vital economic assistance to tens of thousands of individuals. The only other recourse available to the Department at that time would have been to stop program payments from issuing until the new eligibility requirements were reviewed. This would have left claimants without benefits for months while the Department used our limited financial and staff resources to implement the necessary changes. This is the result of the continuously changing eligibility requirements built from hastily implemented legislation and program design. The Department has already begun the process of developing the necessary features into the Department?s PUA system and has begun the auditing of claims to ensure retroactive program eligibility. Where appropriate, claims will be placed into an overpayment status and collection efforts will ensue.

Reference Number: 2021-013 Prior Year Finding: N/A Federal Agency: U.S. Department of Defense U.S. Department of the Treasury State Agency: Department of Finance and Management (Finance) Federal Program: National Guard Military Operations and Maintenance (O&M) Projects COVID-19 ? Coronavirus Relief Fund Assistance Listing Numbers: 12.401, 21.019 Award Number and Year: FY2020: W912LN-20-2-1001, W912LN-20-2-1002, W912LN-20-2-1003, W912LN-20-2-1004, W912LN-20-2-1005, W912LN-20-2-1007, W912LN-20-2-1010, W912LN-20-2-1011, W912LN-20-2-1014, W912LN-20-2-1021, W912LN-20-2-1022, W912LN-20-2-1023, W912LN-20-2-1024, W912LN-20-2-1040 FY2021: W912LN-21-2-1001, W912LN-21-2-1002, W912LN-21-2-1003, W912LN-21-2-1004, W912LN-21-2-1005, W912LN-21-2-1007, W912LN-21-2-1010, W912LN-21-2-1011, W912LN-21-2-1014, W912LN-21-2-1021, W912LN-21-2-1022, W912LN-21-2-1023, W912LN-21-2-1024, W912LN-21-2-1040 SLT0049 (2020), SLT0083 (2020) Compliance Requirement: Reporting: Schedule of Expenditures of Federal Awards Type of Finding: Significant Deficiency in Internal Control Over Compliance Criteria or specific requirement: Compliance: Per 2 CFR 200 Section 510(b), the auditee must prepare a schedule of expenditures of Federal awards for the period covered by the auditee?s financial statements which must include the total Federal awards expended as determined in accordance with Section 200.502. The schedule must list individual Federal programs by Federal agency and provide total Federal awards expended for each individual Federal program and the Assistance Listings Number or other identifying number when the Assistance Listings information is not available. Per Section 502(g), Federal non-cash assistance, such as free rent, food commodities, donated property, or donated surplus property, must be valued at fair market value at the time of receipt or the assessed value provided by the Federal agency. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: Errors were detected in the Schedule of Expenditures of Federal Awards (SEFA) submitted to auditors. Errors consisted of an overstatement of expenditures for assistance listing 12.401-National Guard Military Operations and Maintenance (O&M) Projects and an overstatement of subrecipient expenditures for assistance listing 21.019-Coronavirus Relief Fund. Context: When reconciling detail expenditures to the SEFA during audit test work, the following SEFA reporting errors were noted: 1. Documentation supporting expenditures for assistance listing 12.401 did not tie to the SEFA. Reported expenditures were overstated by 42%, or approximately $10 million for this program. It was later determined that $10 million should have been reported under assistance listing 12.400-Military Construction, National Guard which was a new program in FY 2021 and had been omitted from the SEFA. 2. Subrecipient expenditures for assistance listing 21.019 were overstated by 50%, or approximately $175 million. Numerous errors were detected when reconciling supporting documentation to the amount passed through to subrecipients and it was determined that a significant number of payments to beneficiaries had been misclassified as payments to subrecipients when the SEFA was prepared. Questioned costs: Undetermined. Cause: Individual State agencies/departments prepare their own sections of the SEFA and submit them to Finance which compiles the State?s consolidated report. Procedures and internal controls were not sufficient to ensure that expenditures reported by Finance on the SEFA were supported by detail expenditure transactions recorded in the State?s accounting system and reported under the correct assistance listing number. Further, procedures and controls in the Coronavirus Relief Program were insufficient to correctly identify and report payments to beneficiaries. Effect: Federal expenditures were incorrectly reported on the SEFA submitted to auditors, effecting the initial determination of Type A and Type B programs. When the reporting error was corrected, assistance listing 12.400 was determined to be a new Type B program. Subrecipient pass-through reporting errors for assistance listing 21.019 effected testing of subrecipient monitoring for the program. Statistically Valid Sample: N/A Recommendation: We recommend that Finance improve its SEFA compilation process to ensure that program expenditures and the amounts passed through to subrecipients reported on the State?s SEFA are complete and accurate. Procedures and controls should include a process to identify programs that are new to the State and ensure they are included on the SEFA. We further recommend that Finance work with the State?s agencies and departments to review and update their SEFA compilation procedures to ensure expenditure information they submit to Finance is accurate, that it includes all programs expended, and ties to detail expenditure transactions in the State?s accounting system. They should also review and enhance procedures and controls to ensure that subrecipient payments are accurately reported and do not include payments to beneficiaries. Views of responsible officials: Management agrees with the finding.

Reference Number: 2021-014 Prior Year Finding: N/A Federal Agency: U.S. Department of the Treasury State Agency: Agency of Administration (Agency) Federal Program: COVID-19 ? Coronavirus Relief Fund Assistance Listing Number: 21.019 Award Number and Year: SLT0049 (2020), SLT0083 (2020) Compliance Requirement: Activities Allowed or Unallowed, Period of Performance Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: The Coronavirus Relief Fund was designed to provide ready funding to address unforeseen financial needs and risks created by the COVID-19 public health emergency. Governments may use Fund payments for eligible expenses subject to the restrictions set forth in section 601(d) of the Social Security Act. Payments must be used to cover costs that are: 1) Necessary expenditures incurred due to the public health emergency with respect to COVID?19; 2) Not accounted for in the governments? most recently approved budget as of March 27, 2020; and 3) Incurred during the period that begins on March 1, 2020 and ends on December 31, 2021. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: We noted that an invoice charged to the program included expenditures that were incurred prior to March 1, 2020. Context: The Agency has oversight responsibility for Coronavirus Relief Fund expenditures and reporting for the State of Vermont (the State). Multiple agencies and departments within the State incur costs charged to the program which are compiled by the Agency. One of sixty expenditure transactions selected for testing was for cleaning/sanitation supplies purchased by the Department of Labor (the Department) in January 2020 which was prior to the allowable period of the program. Cause: The Department?s procedures and controls were not sufficient to ensure that only costs incurred between March 1, 2020 and December 31, 2021 were submitted to the Agency and charged to the program. The Agency?s internal controls were not sufficient to detect that the Department had charged costs to the program that were incurred prior to the program?s allowable period. Effect: Unallowable costs were charged to the program. Questioned costs: $871.72 Statistically Valid Sample: Yes Recommendation: We recommend the Agency review and enhance procedures and controls to ensure that only allowable costs are charged the program. We further recommend that the Agency work with the State?s agencies and departments to review and enhance their procedures and controls to ensure that costs they submit to the Agency are allowable and are incurred within the program?s allowable period. Views of responsible officials: Management agrees with the finding.

Reference Number: 2021-015 Prior Year Finding: N/A Federal Agency: U.S. Department of the Treasury State Agency: Agency of Administration (Agency) Federal Program: COVID-19 ? Coronavirus Relief Fund Assistance Listing Number: 21.019 Award Number and Year: SLT0049 (2020), SLT0083 (2020) Compliance Requirement: Subrecipient Monitoring Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: Per 2 CFR section 200.1, a subaward is an award provided by a pass-through entity to a subrecipient for the subrecipient to carry out part of a Federal award received by the pass-through entity. It does not include payments to a contractor or payments to an individual that is a beneficiary of a Federal program. A subaward may be provided through any form of legal agreement, including an agreement that the pass-through entity considers a contract. Per 2 CFR section 200.331, a non-Federal entity may concurrently receive Federal awards as a recipient, a subrecipient, and a contractor, depending on the substance of its agreements with Federal awarding agencies and pass-through entities. Therefore, a pass-through entity must make case-by-case determinations whether each agreement it makes for the disbursement of Federal program funds casts the party receiving the funds in the role of a subrecipient or a contractor. 2 CFR section 200.332 - Requirements for Pass-Through Entities, states in part, that all pass-through entities must: (f) Verify that every subrecipient is audited as required by Subpart F - Audit Requirements of this part when it is expected that the subrecipient's Federal awards expended during the respective fiscal year equaled or exceeded the threshold set forth in ? 200.501 Audit requirements. 2 CFR section 200.521 ? Management Decision, states that a pass-through entity must be responsible for issuing a management decision for audit findings that relate to Federal awards it makes to subrecipients. Further, a management decision must be issued within six months of acceptance of the audit report by the Federal Audit Clearinghouse. The auditee must initiate and proceed with corrective action as rapidly as possible and corrective action should begin no later than upon receipt of the audit report. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Agency misclassified payments it made to beneficiaries as subawards. The misclassifications were detected by auditors during test work. In addition, the Agency did not obtain or review single audit reports for all subrecipients and was unable to verify that they were audited in compliance with Subpart F. Context: Sixty subawards were selected for testing and the following exceptions were noted: ? 5 of 60 subawards provided economic support to businesses that experienced economic harm during the pandemic which were determined to be beneficiary payments and not subawards. The Agency issued subaward agreements to the beneficiaries although program requirements should not have been applicable. ? The Agency was unable to provide support that 2 of 60 subrecipients were audited in compliance with Subpart F. Audit reports were not obtained nor reviewed and management decisions were not issued. Cause: The Agency did not establish effective internal controls and procedures to accurately classify payments to beneficiaries and it issued subawards in error. The Agency also did not establish effective internal controls and procedures over subrecipient monitoring to ensure that it monitored subawards in accordance with 2 CFR section 200.332. Effect: Subawards were issued in error and programmatic requirements were improperly passed on to beneficiaries. Failure to ensure subrecipients have obtained audits as required by Subpart F increases the risk that subrecipients may inappropriately spend and/or inaccurately track and report federal funds over multiple year periods, and these discrepancies may not be properly monitored, detected, or corrected on a timely basis. Questioned costs: Undetermined Statistically Valid Sample: Yes Recommendation: We recommend the Agency review and enhance internal controls and procedures to ensure that subrecipient determinations are properly performed and that evaluations of independent audits are completed and documented timely. Views of responsible officials: Management agrees with the finding.

Reference Number: 2021-016 Prior Year Finding: N/A Federal Agency: U.S. Department of the Treasury State Agency: Agency of Administration (Agency) Federal Program: COVID-19 ? Emergency Rental Assistance Assistance Listing Number: 21.023 Award Number and Year: ERA1 (12/27/2020 ? 9/30/2022) Compliance Requirement: Subrecipient Monitoring Type of Finding: Material Weakness in Internal Control over Compliance, Material Noncompliance Criteria or specific requirement: Compliance: Subrecipient Monitoring - Per 2 CFR section 200.332 - Requirements for Pass-Through Entities states, in part, that all pass-through entities must: (a) Ensure that every subaward is clearly identified to the subrecipient as a subaward and includes the following information at the time of the subaward and if any of these data elements change, include the changes in subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward. Required information includes: i. Subrecipient name (which must match the name associated with its unique entity identifier); ii. Subrecipient's unique entity identifier; iii. Federal Award Identification Number (FAIN); iv. Federal Award Date (see the definition of Federal award date in ? 200.1 of this part) of award to the recipient by the Federal agency; v. Subaward Period of Performance Start and End Date; vi. Subaward Budget Period Start and End Date; vii. Amount of Federal Funds Obligated by this action by the pass-through entity to the subrecipient; viii. Total Amount of Federal Funds Obligated to the subrecipient by the pass-through entity including the current financial obligation; ix. Total Amount of the Federal Award committed to the subrecipient by the pass-through entity; x. Federal award project description, as required to be responsive to the Federal Funding Accountability and Transparency Act (FFATA); xi. Name of Federal awarding agency, pass-through entity, and contact information for awarding official of the Pass-through entity; xii. Assistance Listings number and Title; the pass-through entity must identify the dollar amount made available under each Federal award and the Assistance Listings Number at time of disbursement; xiii. Identification of whether the award is R&D; and xiv. Indirect cost rate for the Federal award (including if the de minimis rate is charged) per section 200.414. (f) Verify that every subrecipient is audited as required by Subpart F - Audit Requirements of this part when it is expected that the subrecipient's Federal awards expended during the respective fiscal year equaled or exceeded the threshold set forth in ? 200.501 Audit requirements. Suspension and Debarment ? Per 2 CFR section 180 - OMB Guidelines to Agencies on Governmentwide Debarment and Suspension (Nonprocurement), non-federal entities are prohibited from contracting with or making subawards under covered transactions to parties that are suspended or debarred. ?Covered transactions? include contracts for goods and services awarded under a non-procurement transaction (e.g., grant or cooperative agreement) that are expected to equal or exceed $25,000 or meet certain other criteria as specified in 2 CFR section 180.220. All non-procurement transactions entered into by a pass-through entity (i.e., subawards to subrecipients), irrespective of award amount, are considered covered transactions, unless they are exempt as provided in 2 CFR section 180.215. When a non-federal entity enters into a covered transaction with an entity at a lower tier, the non-federal entity must verify that the entity, as defined in 2 CFR section 180.995 and agency adopting regulations, is not suspended or debarred or otherwise excluded from participating in the transaction. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Agency did not furnish all required information to its subrecipients at the time of issuance of subawards nor was it able to provide support that it ensured its subrecipients were audited as required by 2 CFR Part 200 Subpart F ? Audit Requirements (Subpart F). Further, the Agency was not able to provide support that it verified its subrecipients were not suspended or debarred or otherwise excluded from participating in the program. Context: The Agency issued three subawards to two subrecipients during FY 2021 and all were selected for testing. The following exceptions were noted: ? 2 of 3 subawards were missing the following required information: subrecipient?s unique identifier, FAIN, federal award date, subaward budget period, name of federal awarding agency, assistance listing number and program name, and indirect cost rate. ? For 2 of 3 subawards, the Agency was unable to provide support that the subrecipient had not been suspended or debarred or otherwise excluded from participating in the transaction. ? For 1 of 2 subrecipients, the Agency was unable to provide support that they were audited in compliance with Subpart F. Cause: The Agency did not establish effective internal controls and procedures over subrecipient monitoring to ensure that it issued and monitored subawards in accordance with 2 CFR section 200.332 and the suspension and debarment requirements of 2 CFR section 180. Effect: Excluding the required federal grant award information at the time of the subaward may cause subrecipients and their auditors to be uninformed about specific program and other regulations that apply to the funds they receive. There is also the potential for subrecipients to have incomplete Schedules of Expenditures of Federal Awards (SEFA) in their Single Audit reports, and federal funds may not be properly audited at the subrecipient level in accordance with the Uniform Guidance. Failure to ensure subrecipients have not been suspended or debarred could allow a subaward to be issued to an ineligible subrecipient. Failure to ensure subrecipients have obtained audits as required by Subpart F increases the risk that subrecipients may inappropriately spend and/or inaccurately track and report federal funds over multiple year periods, and these discrepancies may not be properly monitored, detected, or corrected on a timely basis. Questioned costs: Undetermined Statistically Valid Sample: Yes Recommendation: We recommend the Agency review and enhance internal controls and procedures to ensure that all required information is included in its subawards, that it verifies subrecipients have not been suspended or debarred, and that evaluation of independent audits is performed and documented. Views of responsible officials: Management agrees with the finding.

Reference Number: 2021-017 Prior Year Finding: N/A Federal Agency: U.S. Department of Education State Agency: Agency of Education (Agency) Federal Program: Title I Assistance Listing Number: 84.010 Award Number and Year: S010A200045 (7/1/2020 ? 9/30/2021) S010A200045-20A (7/1/2020 ? 9/30/2021) Compliance Requirement: Reporting ? Federal Funding Accountability and Transparency Act (FFATA) Type of Finding: Material Weakness in Internal Control Over Compliance, Material Non-compliance Criteria or specific requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. The following key data elements must be reported: Subawardee Name and Data Universal Numbering System (DUNS) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $30,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. ?? 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: Subaward modifications were overstated when reported to FSRS, resulting in obligations that exceeded the total amount of the federal awards. One subaward was not reported timely. Context: Eight subawards were selected for testing, to which 16 modifications were issued that modified the subaward amount. For 15 of the 16 modifications, the amended award amounts totaled $1,781,905, but the amount reported to FSRS totaled $18,161,079, resulting in overreporting of $16,379,174. Rather than reporting only the amount of the modifications, the Agency reported the new cumulative award totals for each. This resulted in an over-obligation of the total federal award. One of eight subawards selected for testing was obligated on 9/17/2019 but was not reported in FSRS until 10/31/2020. See Schedule of Findings and Questioned Costs for chart/table. Cause: The Agency incorrectly interpreted FSRS reporting guidance when entering modifications of its subawards and internal controls were not sufficient to prevent the late reporting of a subaward. Effect: Subawards were not reported accurately to FSRS in accordance with FFATA requirements. Questioned costs: None noted. Statistically Valid Sample: Yes Recommendation: We recommend the Agency review FSRS reporting guidance and modify its procedures regarding the reporting of modifications in accordance with this guidance. We further recommend the Agency review and enhance internal controls and procedures to ensure that all required subawards are reported timely to FSRS no later than the end of the month following the month of issuance. Views of responsible officials: Management agrees with the finding.

Reference Number: 2021-018 Prior Year Finding: N/A Federal Agency: U.S. Department of Education State Agency: Agency of Education (Agency) Federal Program: COVID-19 ? Elementary and Secondary School Emergency Relief Fund Assistance Listing Number: 84.425D Award Number and Year: S425D200011 (4/29/2020 ? 9/30/2021) S425D210011 (1/5/2021 ? 9/30/2022) Compliance Requirement: Reporting ? Federal Funding Accountability and Transparency Act (FFATA) Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. The following key data elements must be reported: Subawardee Name and Data Universal Numbering System (DUNS) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $30,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. ?? 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: Subaward modifications were overstated when reported to FSRS, resulting in obligations that exceeded the total amount of the federal awards. Two subaward modifications were not reported. Context: Eight subrecipients were selected for testing consisting of 14 issued subawards. To which 4 amendments were issued that modified the subaward amount. A total of 18 transactions were tested consisting of the 14 original awards and 4 amendments. For 2 of the 4 modifications, the amended award amounts totaled $752,202, but the amount reported to FSRS totaled $3,750,748, resulting in overreporting of $2,998,546. Rather than reporting only the amount of the modifications, the Agency reported the new cumulative award totals for each. This resulted in an over-obligation of the total federal award. Two of eight subrecipients selected for testing issued amendments to the original subaward that were not reported in FSRS. See Schedule of Findings and Questioned Costs for chart/table. Cause: The Agency incorrectly interpreted FSRS reporting guidance when entering modifications of its subawards. Internal controls were not sufficient to ensure that all subaward modifications were reported in FSRS. Effect: Subawards were not reported accurately to FSRS in accordance with FFATA requirements. Questioned costs: None noted. Statistically Valid Sample: Yes Recommendation: We recommend the Agency review FSRS reporting guidance and modify its procedures regarding the reporting of modifications in accordance with this guidance. We further recommend the Agency review and enhance internal controls and procedures to ensure that all required subawards are reported timely to FSRS no later than the end of the month following the month of issuance. Views of responsible officials: Management agrees with the finding.

Reference Number: 2021-019 Prior Year Finding: N/A Federal Agency: U.S. Department of Health and Human Services State Agency: Agency of Human Services (Agency) Federal Program: COVID-19 - Epidemiology and Laboratory Capacity for Infectious Diseases (ELC) Assistance Listing Number: 93.323 Award Number and Year: 19NU50CK000520 (8/1/2020 ? 7/30/2021) Compliance Requirement: Reporting Type of Finding: Material Weakness in Internal Control Over Compliance, Material Non-compliance Criteria or specific requirement: Compliance: Non-federal entities are required to submit performance reports on a quarterly basis, no later than 30 days after the end of each quarter, in accordance with the terms and conditions of the Federal award. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Agency could not provide support to document that performance measure reports had been filed timely and accurately. Context: Reports for two quarters were selected for testing in which four performance reports were reviewed. We noted the following exceptions: ? For 3 of 4 reports, supporting documentation provided did not agree with the information reported. ? For 1 of 4 reports, data lines were left blank, and the report was not properly submitted. ? For 4 of 4 reports, supporting documentation could not be provided to validate the reports had been filed timely. Cause: Reports are filed electronically, and the Agency did not maintain copies of all supporting documentation used to prepare them nor of timely submission. Procedures and controls were insufficient to ensure that supporting documentation was maintained and available for audit and that reports were filed accurately and timely. Effect: Performance measure data reported for the program was incomplete and unsupported with adequate documentation. Questioned costs: Undetermined due to a lack of supporting documentation. Statistically Valid Sample: Yes Recommendation: We recommend the Agency review and enhance internal controls and procedures to ensure that all required performance reports are filed accurately and timely and that supporting documentation is maintained and is available for audit. Views of responsible officials: Management agrees with the finding.

Reference Number: 2021-020 Prior Year Finding: N/A Federal Agency: U.S. Department of Health and Human Services State Agency: Agency of Human Services (Agency) Federal Program: CCDF Cluster, COVID-19 ? CCDF Cluster Assistance Listing Number: 93.575, 93.596 Award Number and Year: 2101VTCCC5 (12/27/2020 ? 9/30/2023) Compliance Requirement: Reporting ? Federal Funding Accountability and Transparency Act (FFATA) Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. The following key data elements must be reported: Subawardee Name and Data Universal Numbering System (DUNS) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $30,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. ?? 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: Subaward information was not reported to FSRS timely. The Agency reported subawards to FSRS nine months after award issuance. The reporting deadline was no later than the last day of the month following the month in which the award was issued. Context: Sixteen subrecipients were selected for testing, to which 39 subawards were issued during FY2021. Of the 39 subawards, 26 were issued on April 1, 2021, and should have been reported to FSRS no later than May 31, 2021, but they were not reported until January 2022. See Schedule of Findings and Questioned Costs for chart/table. Cause: The Agency?s Internal Audit Group (IAG) reports subaward information in FSRS using subaward information provided by the Department of Children and Families (DCF). DCF did not provide the IAG with subaward information timely and internal controls did not detect that the subawards had not been reported to FSRS as required. Effect: Subawards were not reported to FSRS in accordance with FFATA requirements. Questioned costs: None noted. Statistically Valid Sample: Yes Recommendation: We recommend the Agency review and enhance internal controls and procedures to ensure that all required subawards are reported accurately and timely to FSRS no later than the end of the month following the month of issuance, in accordance with FFATA requirements. Views of responsible officials: Management agrees with the finding.

Reference Number: 2021-021 Prior Year Finding: N/A Federal Agency: U.S. Department of Health and Human Services State Agency: Agency of Human Services (Agency) Federal Program: CCDF Cluster, COVID-19 ? CCDF Cluster Assistance Listing Number: 93.575, 93.596 Award Number and Year: 2101VTCCC5 (12/27/2020 ? 9/30/2023) Compliance Requirement: Subrecipient Monitoring Type of Finding: Significant Deficiency in Internal Control over Compliance, Other Matters Criteria or specific requirement: Compliance: Per 2 CFR section 200.332(a), all pass-through entities must ensure that every subaward is clearly identified to the subrecipient as a subaward and includes the following information at the time of the subaward and if any of these data elements change, include the changes in subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward. Required information includes: i. Subrecipient name (which must match the name associated with its unique entity identifier); ii. Subrecipient's unique entity identifier; iii. Federal Award Identification Number (FAIN); iv. Federal Award Date (see the definition of Federal award date in ? 200.1 of this part) of award to the recipient by the Federal agency; v. Subaward Period of Performance Start and End Date; vi. Subaward Budget Period Start and End Date; vii. Amount of Federal Funds Obligated by this action by the pass-through entity to the subrecipient; viii. Total Amount of Federal Funds Obligated to the subrecipient by the pass-through entity including the current financial obligation; ix. Total Amount of the Federal Award committed to the subrecipient by the pass-through entity; x. Federal award project description, as required to be responsive to the Federal Funding Accountability and Transparency Act (FFATA); xi. Name of Federal awarding agency, pass-through entity, and contact information for awarding official of the Pass-through entity; xii. Assistance Listings number and Title; the pass-through entity must identify the dollar amount made available under each Federal award and the Assistance Listings Number at time of disbursement; xiii. Identification of whether the award is R&D; and xiv. Indirect cost rate for the Federal award (including if the de minimis rate is charged) per section 200.414. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: Required federal award information was missing from Coronavirus Response and Relief Supplemental Appropriations Act (CRRSA) subawards. Context: Ten subrecipients were selected for testing to which 33 subawards were issued during FY 2021. For 25 of the 33 subawards, the Federal Award Date was missing from the subaward agreements. We noted that the 25 exceptions were all funded with CRRSA funds. Cause: The Agency did not adequately follow its subrecipient procedures and internal controls prior to issuance of the subawards were not sufficient to detect that the required information was omitted. Effect: Subrecipients were not provided with all required federal award information pertaining to their subawards. Questioned costs: None noted. Statistically Valid Sample: Yes Recommendation: We recommend the Agency review and enhance procedures and controls to ensure that all required federal award information is included on subawards prior to their issuance. Views of responsible officials: Management agrees with the finding.

Reference Number: 2021-022 Prior Year Finding: 2020-012 Federal Agency: U.S. Department of Health and Human Services State Agency: Agency of Human Services (Agency) Federal Program: State Children?s Insurance Program (CHIP), Medicaid Cluster Assistance Listing Number: 93.767, 93.775, 93.777, 93.778 Award Number and Year: 190VT5021 (10/1/2018 ? 9/30/2020) 2005VT5021 (10/1/2019 ? 9/30/2021) 2105VT5021 (10/1/2020 ? 9/30/2022) 2005VT5MAP (10/1/2019 ? 9/30/2020) 2105VT5MAP (10/1/2020 ? 9/30/2021) Compliance Requirement: Special Tests and Provisions - Provider Eligibility Type of Finding: Material Weakness in Internal Control Over Compliance, Material Non-compliance Criteria or specific requirement: Compliance: In order to receive Medicaid payments, providers must: (1) be licensed in accordance with Federal, State, and local laws and regulations to participate in the Medicaid program (42 CFR sections 431.107 and 447.10; and Section 1902(a)(9) of the Social Security Act (42 USC 396a(a)(9)); (2) screened and enrolled in accordance with 42 CFR Part 455, Subpart E (sections 455.400 through 455.470); and make certain disclosures to the State (42 CFR part 455, subpart B, sections 455.100 through 455.106). Medicaid managed care network providers are subject to the same disclosure, screening, enrollment, and termination requirements that apply to Medicaid fee-for-service providers in accordance with 42 CFR Part 438, Subpart H. Control: Per 2 CFR section 200.303(a), the non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: We noted that the Agency did not maintain documentation to support provider eligibility to participate in the Medicaid and CHIP programs. The provider eligibility requirement is administered by a 3rd-party that is required to determine and document the provider?s eligibility with the Agency?s requirements. License renewal information was not updated on a timely basis in the provider management module. Context: Total provider sample size was sixty for Medicaid and sixty for CHIP. Specifically, we noted the following: 1. Nine Medicaid and twelve CHIP provider files did not have current license information in the provider management module and the monthly screening process was not followed to validate the licenses. 2. The application for one Medicaid provider was not available for review. 3. For one Medicaid and two CHIP providers, the State did not maintain proper documentation that revalidation occurred within the required 5-year time frame. 4. Documentation was incomplete to support that two CHIP providers were compliant with Vermont State law that providers must be in good tax standing to receive Medicaid funding. Cause: The Agency did not adequately follow procedures regarding CHIP and Medicaid provider eligibility in accordance with federal program requirements and controls did not detect or prevent the errors. Effect: The Agency was unable to support provider eligibility or consistent application of their internal control process. Failure to maintain complete provider files and ensuring that provider licenses are kept current could allow program payments to be made to an ineligible and/or unlicensed provider. Questioned costs: Undetermined. Statistically Valid Sample: Yes Recommendation: We recommend the Agency review its procedures and controls to ensure that documentation is maintained in accordance with the federal grantor?s requirements. Views of responsible officials: Management agrees with the finding.

Reference Number: 2021-023 Prior Year Finding: 2020-013 Federal Agency: U.S. Department of Health and Human Services State Agency: Agency of Human Services (Agency) Federal Program: State Children?s Insurance Program (CHIP), Medicaid Cluster Assistance Listing Number: 93.767, 93.775, 93.777, 93.778 Award Number and Year: 190VT5021 (10/1/2018 ? 9/30/2020) 2005VT5021 (10/1/2019 ? 9/30/2021) 2105VT5021 (10/1/2020 ? 9/30/2022) 2005VT5MAP (10/1/2019 ? 9/30/2020) 2105VT5MAP (10/1/2020 ? 9/30/2021) Compliance Requirement: Activities Allowed or Unallowed, Allowable Costs/Cost Principles, Eligibility Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: Allowable Costs and Allowable Activities for CHIP and Medicaid are for beneficiaries who have been determined to be eligible (or are presumptively eligible) at the time of service, whether covered under fee-for-service or managed care. Eligibility for CHIP is based on the application of modified adjusted gross income and household definition, in addition to other permissible eligibility standards, for example standards relating to geographic area, age (up to, but not including age 19), and insurance status. States are directed at 42 CFR 457.340(d) to determine eligibility promptly and without undue delay. The determination of eligibility may not exceed 45 days. Eligibility for Medicaid includes both financial and non-financial requirements and each eligibility group has its own specific standards. Financial eligibility for most individuals is based on modified adjusted gross income or MAGI, which is described at 42 CFR 435.603. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: We noted the following beneficiary eligibility exceptions: ? Documentation to support beneficiary eligibility was incomplete in both CHIP and Medicaid. ? CHIP eligibility determination was not completed within the required 45-day period. ? Benefits were not terminated timely for a Medicaid beneficiary that was determined to be ineligible. Context: ? One of sixty CHIP participants was lacking proper documentation to support eligibility determination and prompt determination. ? Eligibility determination for one of sixty CHIP participants exceeded 45 days. ? One of sixty Medicaid beneficiaries was lacking proper documentation to support eligibility determination. ? One of sixty Medicaid beneficiaries was determined to be ineligible, but benefits were not terminated timely. The beneficiary was determined to be ineligible in May 2020 and benefits continued to be paid until January 2022. Cause: The Agency did not adequately follow procedures regarding CHIP and Medicaid eligibility in accordance with federal program requirements and controls did not detect or prevent the errors. Effect The Agency was unable to support beneficiary eligibility and the Agency paid benefits for an ineligible participant. Questioned costs: $15,760 ? Federal share of benefits paid on behalf of an ineligible participant from May 2020 to January 2022. Questioned costs for all other eligibility exceptions is undetermined. Statistically Valid Sample: Yes Recommendation: We recommend that the Agency review and enhance procedures and controls for Medicaid and CHIP beneficiary eligibility determination to ensure that eligibility is determined promptly within federal requirements and that documentation to support eligibility is maintained in accordance with the retention policy and is readily available for review. We further recommend that ineligible participants are terminated on a timely basis. Views of responsible officials: Management agrees with the finding.

Reference Number: 2021-024 Prior Year Finding: N/A Federal Agency: U.S. Department of Health and Human Services State Agency: Agency of Human Services (Agency) Federal Program: State Children?s Insurance Program (CHIP), Medicaid Cluster Assistance Listing Number: 93.767, 93.775, 93.777, 93.778 Award Number and Year: 190VT5021 (10/1/2018 ? 9/30/2020) 2005VT5021 (10/1/2019 ? 9/30/2021) 2105VT5021 (10/1/2020 ? 9/30/2022) 2005VT5MAP (10/1/2019 ? 9/30/2020) 2105VT5MAP (10/1/2020 ? 9/30/2021) Compliance Requirement: Special Tests and Provisions ? Medical Loss Ratio (MLR) Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: For all contracts, the state must ensure that each Managed Care Organization (MCO), Prepaid Inpatient Health Plan (PIHP), and Prepaid Ambulatory Health Plan (PAHP) submits a report with the data elements specified in 42 CFR sections 438.8(k) and 438.8(n). The report should contain the required 13 data elements in the regulation, reflect the correct reporting years, and contain an attestation of accuracy regarding the calculation of the medical loss ratio. Managed care plans are required to submit the annual report in the time and manner established by the state, which must be within 12 months after the end of the MLR reporting year. The state should have a policy and procedure to indicate when the report(s) are due from plans and should not accept multiple submissions from plans unless the capitation payments are revised retroactively. Control: Per 2 CFR section 200.303(a), the non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The 2019 Medical Loss Ratio report for the State?s MCO was not submitted within twelve months after the end of the reporting year. Context: The Agency of Human Services, Department of Vermont Health Access (DVHA) acts as its own MCO. DVHA was required to submit the MCO?s Medical Loss Ratio report for the year ending 12/31/2019 no later than 12/31/2020 but the report was not submitted until 8/26/2021. Cause: The Agency did not adequately follow procedures regarding timely submission of the Medical Loss Ratio report for its MCO. Effect: The Agency is out of compliance with MLR reporting requirements. Questioned costs: Undetermined. Statistically Valid Sample: Yes Recommendation: We recommend the Agency review and enhance its procedures and controls regarding Medical Loss Ratio reporting to ensure that reports for its MCO are submitted timely. Views of responsible officials: Management agrees with the finding.

Reference Number: 2021-025 Prior Year Finding: 2020-014 Federal Agency: U.S. Department of Health and Human Services State Agency: Agency of Human Services (Agency) Federal Program: Medicaid Cluster Assistance Listing Number: 93.775, 93.777, 93.778 Award Number and Year: 2005VT5MAP (10/1/2019 ? 9/30/2020) 2105VT5MAP (10/1/2020 ? 9/30/2021) Compliance Requirement: Special Tests and Provisions - Provider Health and Safety Standards Type of Finding: Material Weakness in Internal Control Over Compliance, Material Non-compliance Criteria or specific requirement: Compliance: Providers must meet the prescribed health and safety standards for hospital, nursing facilities, and ICF/IID (42 CFR part 442). The standards may be modified in the State Plan. The Medicaid Provider Enrollment Compendium (MPEC) requires that State Medicaid Agencies perform screening of providers based upon their risk level. Screening includes verifications of licenses and compliance with all federal and state regulations of the program. Control: Per 2 CFR section 200.303(a), the non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: We noted that the Agency did not maintain documentation to support providers? compliance with the prescribed health and safety standards. The Agency requires that providers complete a health and safety agreement in which they attest to compliance with the Agency?s health and safety requirements. The provider eligibility and health and safety requirements are administered by a 3rd-party that is required to determine and document providers? eligibility with the Agency?s requirements. Health and safety documentation was not consistently maintained in provider files and compliance could not be verified. Context: Of the sixty samples selected for testing, health and safety standards could not be verified for the following: 1. Nine provider files did not have current license information maintained in the provider management module and the monthly screening process was not followed to validate the licenses. 2. One application was not available for review. 3. One provider file was out of date. The provider was due for revalidation in January 2019, but no evidence was provided to support that revalidation had occurred. Cause: The Agency?s 3rd-Party provider did not consistently maintain current documentation in the provider management module and controls did not detect or prevent the errors. Effect: Failure to verify and document compliance with health and safety standards could allow ineligible providers to perform services under the Medicaid program. Questioned costs: Undetermined. Statistically Valid Sample: Yes Recommendation: We recommend the Agency review its procedures and controls to ensure that documentation is maintained in accordance with the federal grantor?s requirements and that all providers are compliant with required health and safety standards. Views of responsible officials: Management agrees with the finding.

Reference Number: 2021-026 Prior Year Finding: N/A Federal Agency: U.S. Department of Health and Human Services State Agency: Agency of Human Services (Agency) Federal Program: Medicaid Cluster Assistance Listing Number: 93.775, 93.777, 93.778 Award Number and Year: 2005VT5MAP (10/1/2019 ? 9/30/2020) 2105VT5MAP (10/1/2020 ? 9/30/2021) Compliance Requirement: Reporting ? Federal Funding Accountability and Transparency Act (FFATA) Type of Finding: Material Weakness in Internal Control Over Compliance, Material Non-compliance Criteria or specific requirement: Compliance: Per the Federal Funding Accountability and Transparency Act (FFATA), prime (direct) recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Reports must be filed in FSRS by the end of the month following the month in which the prime recipient awards any sub-grant greater than or equal to $30,000. If the initial award is below $30,000 but subsequent grant modifications result in a total award equal to or over $30,000, the award will be subject to the reporting requirements as of the date the award exceeds $30,000. If the initial award equals or exceeds $30,000 but funding is subsequently de-obligated such that the total award amount falls below $30,000, the award continues to be subject to FFATA reporting requirements. The following key data elements must be reported: Subawardee Name and Data Universal Numbering System (DUNS) number; Amount of Subaward (inclusive of modifications); Subaward Obligation/Action Date; Date of Report Submission; Subaward Number; Project Description; and Names and Compensation of Highly Compensated Officers. (Names and Compensation of Highly Compensated Officers must only be reported when the entity in the preceding fiscal year received 80 percent or more of its annual gross revenues in Federal awards; and $30,000,000 or more in annual gross revenues from Federal awards; and the public does not have access to this information about the compensation of the senior executives of the entity through periodic reports filed under section 13(a) or 15(d) of the Securities Exchange Act of 1934 (15 U.S.C. ?? 78m(a), 78o(d)) or section 6104 of the Internal Revenue Code of 1986.) Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: Subawards were not reported to FSRS in accordance with FFATA requirements. The following errors were noted: ? The Agency did not report all required subaward information. ? The Agency reported incorrect subaward amounts and did not report modifications to previously reported subawards. Context: Twelve subrecipients were selected for testing, to which 31 subawards were issued during FY2021. The Agency?s Internal Audit Group (IAG) reports subaward information in FSRS for its various departments using subaward information provided by the departments. The following reporting errors were noted: Department of Mental Health (DMH): One reported amount did not agree with the subaward agreement and one subaward modification was not reported. The total amount not reported to FSRS is $2,089,249. Department of Aging and Independent Living (DAIL): Six subaward modifications were not reported. The total amount of modifications not reported to FSRS is $927,799. Department of Vermont Health Access (DVHA): Nine reported amounts did not agree with the subaward agreement and fifteen modifications to four subawards were not reported. The total amount not reported to FSRS is $77,350. See Schedule of Findings and Questioned Costs for chart/table. Cause: DMH, DAIL and DVHA did not provide the IAG with accurate and complete subaward information which caused errors and omissions in subaward reporting to FSRS. In addition, the Agency?s FSRS reporting procedure did not comply with FFATA requirements, resulting in modifications below $30,000 being excluded from FSRS reporting. Effect: Subawards were not reported to FSRS in accordance with FFATA requirements. Questioned costs: None noted. Statistically Valid Sample: Yes Recommendation: We recommend the Agency review and enhance internal controls and procedures to ensure that all required subawards and subaward modifications are reported accurately to FSRS in accordance with FFATA requirements. Views of responsible officials: Management agrees with the finding.

Reference Number: 2021-027 Prior Year Finding: N/A Federal Agency: U.S. Department of Health and Human Services State Agency: Agency of Human Services (Agency) Federal Program: Medicaid Cluster Assistance Listing Number: 93.775, 93.777, 93.778 Award Number and Year: 2005VT5MAP (10/1/2019 ? 9/30/2020) 2105VT5MAP (10/1/2020 ? 9/30/2021) Compliance Requirement: Special Tests and Provisions ? ADP Risk Analysis and System Security Review Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Compliance: State Medicaid Agencies (SMAs) must establish and maintain a program for conducting periodic risk analyses to ensure that appropriate and cost-effective safeguards are incorporated into new and existing systems. SMAs must perform risk analyses whenever significant system changes occur. SMAs shall review the ADP system security installations involved in the administration of HHS programs on a biennial basis. At a minimum, the reviews shall include an evaluation of physical and data security operating procedures, and personnel practices. The SMA shall maintain reports on its biennial ADP system security reviews, together with pertinent supporting documentation, for HHS on-site reviews (45 CFR section 95.621). Control: Per 2 CFR section 200.303(a), the non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Agency was required to conduct a biennial ADP risk analysis and system security review of its ACCESS system in May 2020, but this review has not yet been conducted. Context: The Agency contracted with an independent auditor in 2018 to conduct a security audit of the ACCESS system and the next biennial audit was due in May 2020. Due to COVID restrictions and enhanced Agency workloads in 2020, the May 2020 review did not take place and instead the Agency relied on an IRS review in November 2021 to fulfill its review requirement. In addition, findings were noted in the IRS review and the Agency?s corrective action plan to address these findings is due by October 2022. Cause: Due to COVID restrictions and enhanced Agency workloads, the May 2020 review was delayed. The Agency uses the IRS review which takes place every three years to fulfill its biennial risk analysis and system security audit requirement. Effect: Failure to conduct timely biennial ADP risk analysis and system security reviews could result in undetected system errors and security vulnerabilities. Questioned costs: Undetermined. Statistically Valid Sample: Yes Recommendation: We recommend the Agency review its procedures to ensure that ADP risk analysis and system security reviews are conducted biennially. Views of responsible officials: Management agrees with the finding.

Reference Number: 2021-028 Prior Year Finding: N/A Federal Agency: U.S. Department of Homeland Security, Federal Emergency Management Agency (FEMA) State Agency: Department of Labor (Department) Federal Program: COVID-19 ? Presidential Declared Disaster Assistance to Individuals and Households - Other Needs Assistance Listing Number: 97.050 Award Number and Year: 4532DRVTSPLW (8/1/2020 ? 3/27/2021) Compliance Requirement: Reporting Type of Finding: Material Weakness in Internal Control over Compliance, Material Noncompliance Criteria or specific requirement: Compliance ? Weekly Reporting Requirement: States and territories that received a grant award for supplemental lost wages payments were required to provide FEMA with the Lost Wages Benefits Payment Weekly Report that included the total, weekly dollar amount of actual lost wages benefit payments made to eligible claimants, by program, the number of appeals for the underlying benefits received by claimants, and any pending claims. The state/territory used the Lost Wages Weekly Report Template for the weekly submission. The Lost Wages Weekly Report is provided to FEMA and is required until all claims are paid. Quarterly Reporting Requirement - SF-425 Federal Financial Report: States/territories must submit the SF-425 form to FEMA on a quarterly basis throughout the grant award period of performance, including any partial quarters in which the period of performance is open. States/territories must submit the report even if no grant award activity occurs during a given quarter. Internal Control ? Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with the guidance in "Standards for Internal Control in the Federal Government" issued by the Comptroller General of the United States or the "Internal Control-Integrated Framework," issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Department did not submit the Lost Wages Weekly Report nor the SF-425 Federal Financial Report as required by program reporting requirements. Questioned costs: Undetermined. Context: The Department provided assistance to program participants for benefit weeks ending 8/1/2020 through 9/5/2020 (6 weeks). Weekly reports were due for each benefit week and quarterly reports were due for each quarter until the grant was closed out on 6/27/2021. As of the date of audit test work, the Department has not filed any of the required weekly or quarterly reports. Cause: The Department did not establish procedures or controls to ensure that weekly or quarterly reports were filed as per program requirements. Effect: In the case of any potential or actual noncompliance, including delinquent reports, a demonstrated lack of progress, or an insufficient detail in the reports, FEMA may place special considerations on an award and/or FEMA may place a hold on funds until the matter is corrected or additional information is provided per 2 C.F.R. ?? 200.207 and 200.338. Statistically Valid Sample: Yes Recommendation: We recommend that policies and procedures be implemented to ensure that all required reports are filed timely and accurately and that reports are reviewed and approved by an authorized State official prior to submission. Views of responsible officials: Management agrees with the finding.

Reference Number: 2020-006 Prior Year Finding: N/A Federal Agency: U.S. Department of Labor State Agency: Vermont Department of Labor (VDOL) Federal Program: Unemployment Insurance CFDA Number: 17.225 Award Number and Year: UI-34195-20-55-A-50 (2020) UI-34089-20-55-A-50 (2020) UI-34525-20-60-A-50 (2020) Compliance Requirement: Eligibility Type of Finding Material Weakness in Internal Control over Compliance, Material Noncompliance Criteria or specific requirement: Compliance: State Workforce Agencies (SWA) responsibilities include: (1) establishing specific, detailed policies and operating procedures which comply with the requirements of federal laws and regulations; (2) determining the state UI tax structure; (3) collecting state UI contributions from employers (commonly called ?unemployment taxes?); (4) determining claimant eligibility and disqualification provisions; (5) making payment of UI benefits to claimants; (6) managing the program?s revenue and benefit administrative functions; (7) administering the programs in accordance with established policies and procedures; and (8) enacting state UC law that conforms with federal UC law. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: On March 18, 2020, the President signed into law the Families First Coronavirus Response Act (FFCRA), which provided additional flexibility for state unemployment insurance agencies and additional administrative funding to respond to the COVID-19 pandemic. The Coronavirus Aid, Relief, and Economic Security (CARES) Act was signed into law on March 27, 2020 which expanded the states? ability to provide unemployment insurance for many workers impacted by the COVID-19 pandemic, including for workers who are not ordinarily eligible for unemployment benefits. As a result of the COIVD-19 pandemic, there was a priority on VDOL to distribute unemployment funds with limited eligibility/verification procedures performed during the application process in order to expedite disbursement of funds and support individuals in greatest need. As a result, most state workforce agencies including the VDOL experienced an unprecedented number of fraudulent and imposter claims and improper payments. The U.S. Department of Labor and the VDOL have partnered to investigate the extent and methods used to perpetuate the fraud. Questioned costs: Undetermined and under investigation by both federal and state authorities. Cause: The VDOL experienced an unprecedented claims volume with increased funding and additional program requirements with a priority for efficient distribution from both the U.S. Department of Labor and State officials. Effect: Without stringent eligibility/verification procedures for the additional funding, the unemployment insurance program becomes more vulnerable to fraudulent claims. Statistically valid: Not applicable Recommendation: We recommend management review and implement the relevant policies and procedures as recommended by the U.S. Department of Labor and/or as outlined in the various Unemployment Insurance Practice Letters (UIPLs) to verify program eligibility while providing timely payment to program beneficiaries. Views of responsible officials: Management agrees with the finding.

Reference Number: 2020-007 Prior Year Finding: N/A Federal Agency: U.S. Department of Labor State Agency: Vermont Department of Labor (VDOL) Federal Program: Unemployment Insurance CFDA Number: 17.225 Award Number and Year: UI-34195-20-55-A-50 (2020) UI-34089-20-55-A-50 (2020) UI-34525-20-60-A-50 (2020) Compliance Requirement: Special Tests and Provisions: UI Program Integrity - Overpayments Type of Finding Significant Deficiency in Internal Control over Compliance, Other Matters Criteria or specific requirement: Compliance: Pub. L. No. 112-40, enacted on October 21, 2011, and effective October 21, 2013, amended sections 303(a) and 453A of the Social Security Act and sections 3303, 3304, and 3309 of Federal Unemployment Tax Act (FUTA) to improve program integrity and reduce overpayments. (See Unemployment Insurance Program Letter (UIPL) numbers 02-12, Changes 1 and 2 https://wdr.doleta.gov/directives/corr_doc.cfm?DOCN=6707.) States are (1) required to impose a monetary penalty (not less than 15 percent) on claimants whose fraudulent acts resulted in overpayments, and (2) states are prohibited from providing relief from charges to an employer?s UI account when overpayments are the result of the employer?s failure to respond timely or adequately to a request for information. States may continue to waive recovery of overpayments in certain situations and must continue to offer the individual a fair hearing prior to recovery. Federal regulations require that if the overpayment was based on fraud and the claimant was unsuccessful in appeal, there is to be follow-up to collect the 15 percent penalty. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with the guidance in "Standards for Internal Control in the Federal Government" issued by the Comptroller General of the United States or the "Internal Control-Integrated Framework," issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: We noted that the Department failed to follow its written procedures to manage the overpayment and pursue collection in one of forty claimants tested. Questioned costs: None. Context: The claimant received an overpayment and the procedures to collect were not initiated. An overpayment of $3,982 and the related 15% penalty of $598 were due from the claimant per the appeals decision in April 2020 but it was not properly input into the Accounting system. No amount was collected and $4,737 in overpayments and penalties is still due from the claimant. Cause: The Department does not have sufficient internal controls in place over the overpayment management and collection process. Effect: Internal Controls for overpayments did not prevent the omission of an overpayment and penalty in the Accounting system resulting in a failure to collect. Recommendation: We recommend that policies and procedures be implemented to ensure that internal controls over overpayments include required tracking and collection efforts. Views of responsible officials: Management agrees with the finding.

Reference Number: 2020-008 Prior Year Finding: N/A Federal Agency: U.S. Department of Labor State Agency: Vermont Department of Labor (VDOL) Federal Program: Unemployment Insurance CFDA Number: 17.225 Award Number and Year: UI-34195-20-55-A-50 (2020) UI-34089-20-55-A-50 (2020) UI-34525-20-60-A-50 (2020) Compliance Requirement: Reporting: ETA 2112 - UI Financial Transaction Summary Type of Finding Significant Deficiency in Internal Control over Compliance, Other Matters Criteria or specific requirement: Compliance: ETA 2112, UI Financial Transaction Summary (OMB No. 1205-0154) ? A monthly summary of transactions, which account for all funds received in, passed through, or paid out of the state unemployment fund (ET Handbook 401). Per federal regulations, the ETA 2112 should be submitted electronically to the National Office by the 1st day of the second month following the close of the reporting month. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with the guidance in "Standards for Internal Control in the Federal Government" issued by the Comptroller General of the United States or the "Internal Control-Integrated Framework," issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: We noted a lack of approval on one of three ETA 2112 reports, a late approval on one of three ETA 2112 reports, and a late submission on two of three ETA 2112 reports. Questioned costs: None. Context: The Department did not perform a timely review and submission of the ETA 2112 reports. The review and approval signature were not documented on the February 2020 report. The review and approval signature on the May 2020 report was not completed timely as it was signed 10/15/2020 when it was due 7/1/2020. The Department did not submit the ETA 2112 reports by the deadline. The February 2020 report was due 4/1/2020 and was submitted 7/28/2020. The May 2020 report was due 7/1/2020 and was submitted 10/27/2020. Cause: The Department does not have sufficient internal controls in place over compliance of the ETA 2112 reporting process. Effect: Internal Controls for reporting did not prevent the unapproved and late submission of required compliance reporting. Recommendation: We recommend that policies and procedures be implemented to ensure that internal controls overreporting includes a formal approval documentation procedure and submission by the federal deadline. Views of responsible officials: Management agrees with the finding.

Reference Number: 2020-009 Prior Year Finding: N/A Federal Agency: U.S. Department of Labor State Agency: Vermont Department of Labor (VDOL) Federal Program: Unemployment Insurance CFDA Number: 17.225 Award Number and Year: UI-34195-20-55-A-50 (2020) UI-34089-20-55-A-50 (2020) UI-34525-20-60-A-50 (2020) Compliance Requirement: Reporting: ETA 191 - Financial Status of UCFE/UCX Type of Finding Significant Deficiency in Internal Control over Compliance, Other Matters Criteria or specific requirement: Compliance: ETA 191, Financial Status of UCFE/UCX (OMB No. 1205-0162) ? Quarterly report on Unemployment Compensation for Federal Employees (UCFE) and Unemployment Compensation for Ex-Service Members (UCX) expenditures and the total amount of benefits paid to claimants of specific federal agencies (ET Handbook 401). Per federal regulations, the ETA 191 should be submitted electronically to the National Office by the 25th of the month following the close of the quarter. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with the guidance in "Standards for Internal Control in the Federal Government" issued by the Comptroller General of the United States or the "Internal Control-Integrated Framework," issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: We noted a lack of approval on two of two quarterly ETA 191, Financial Status of UCFE/UCX Reports (ETA 191) and a late submission on one of two ETA 191 reports tested. Questioned costs: None. Context: The Department did not formally review and approve the ETA 191s prior to submission. We also noted a lack of segregation of duties between the preparer and reviewer as at times, the same staff member performs both roles. The Department did not submit the ETA 191 by the deadline. The report was due 7/27/2020 and was submitted 8/6/2020. The Department of Labor reached out to Department to inquiry about the late report on 7/29/2020 and again on 8/3/2020. No extension was requested or granted. Cause: The Department does not have sufficient internal controls in place over compliance of the ETA 191 reporting process. Effect: Internal Controls for reporting did not prevent the unapproved and late submission of required compliance reporting. Recommendation: We recommend that policies and procedures be implemented to ensure that internal controls over reporting include segregation of duties between preparer and approver, a formal approval documentation procedure, and submission by the federal deadline. Views of responsible officials: Management agrees with the finding.

Reference Number: 2020-010 Prior Year Finding: N/A Federal Agency: U.S. Department of Labor State Agency: Vermont Department of Labor (VDOL) Federal Program: Unemployment Insurance CFDA Number: 17.225 Award Number and Year: UI-32872-19-60-A-50 (2019) UI-34525-20-60-A-50 (2020) Compliance Requirement: Special Tests and Provisions: UI Reemployment Programs: RESEA Type of Finding Significant Deficiency in Internal Control over Compliance, Other Matters Criteria or specific requirement: Compliance ? The Unemployment Insurance (UI) program serves as one of the principal ?gateways? to the workforce system. It is often the first workforce program accessed by individuals who need workforce services. The Worker Profiling and Reemployment Services (WPRS) and Reemployment Services and Eligibility Assessments (RESEA) programs serve as UI?s primary programs that facilitate the reemployment needs of UI claimants. WPRS, which is mandated by Section 303(j) of the Social Security Act, is designed to identify UI claimants who are most likely to exhaust their benefits and need reemployment assistance to return to work, and refer them to appropriate reemployment services, such as: job search and job placement assistance; counseling; testing; provision of occupational and labor market information; and assessments. WPRS provides reemployment services to selected claimants through an early intervention process. The number of individuals served under WPRS is determined by the state (and/or local areas) based on its capacity to serve these individuals. UIPL No. 41-94 provides guidance on WPRS requirements. RESEA is authorized by Section 306 of the Social Security Act and builds on the success of both WPRS and RESEA?s predecessor, the former UI Reemployment and Eligibility Assessment (REA) program. RESEA uses an evidence-based integrated approach that combines an eligibility assessment for continuing UI eligibility and the provision of reemployment services. RESEA is a voluntary program and under certain circumstances may be designed to also satisfy WPRS requirements. Operating guidance for the RESEA program is updated annually. UIPL 7-19 provides RESEA operating Guidance for FY 2019. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with the guidance in "Standards for Internal Control in the Federal Government" issued by the Comptroller General of the United States or the "Internal Control-Integrated Framework," issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: We noted that 3 of 40 samples selected for testing were missing Eligibility Review Questionnaire forms and subsequently a lack of proper eligibility approval. We also noted that 2 of 40 samples were missing Notice to Claimant forms and subsequently CLA was unable to determine if proper notice was provided to participants. Questioned costs: None. Context: The Department did not retain the required Eligibility Review Questionnaire forms and Notice to Claimants required by the program to verify compliance with federal regulations and as a control to document that a staff member at UI with knowledge of the programs reviewed eligibility requirements prior to admission to the RESEA program. Cause: The Department does not have sufficient internal controls in place over compliance of the RESEA process. Effect: Internal Controls for reporting did not prevent the admission of participants into RESEA without clear documentation on file of their eligibility review and notice to claimant. Recommendation: We recommend that policies and procedures be implemented to ensure that internal controls over RESEA include both retention of the notice to claimant and documentation of the participants eligibility review by a UI supervisor. Views of responsible officials: Management agrees with the finding.

Reference Number: 2020-011 Prior Year Finding: N/A Federal Agency: U.S. Health and Human Services State Agency: Agency of Human Services (AHS or the Agency) Federal Program: Low-Income Home Energy Assistance Program CFDA Number: 93.568 Award Number and Year: 2001VTLIEA (10/1/2019 ? 9/30/2021) Compliance Requirement: Period of Performance Type of Finding: Significant Deficiency in Internal Control over Compliance, Other Matters Criteria or specific requirement: Compliance: 200.77 Period of performance means the time during which the non-Federal entity may incur new obligations to carry out the work authorized under the Federal award. The Federal awarding agency or pass-through entity must include start and end dates of the period of performance in the Federal award (see ?? 200.210 Information contained in a Federal award paragraph (a)(5) and 200.331 Requirements for pass-through entities, paragraph (a)(1)(iv)). Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with the guidance in "Standards for Internal Control in the Federal Government" issued by the Comptroller General of the United States or the "Internal Control-Integrated Framework," issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: One of the twenty-six non-payroll transactions selected for testing was incurred during March 2019 but was charged by the Agency to the FY2020 award which was prior to the grant award?s period of performance. Context: An outstanding March 2019 invoice was paid by the Agency in October 2019 and charged to the grant with a period of performance beginning October 1, 2019. Cause: The Agency was aware of the outstanding March 2019 vendor invoice prior to the October 2019 disbursement but its internal controls did not prevent it from being charged to the FY2020 award. Effect: The Agency is not compliant with the period of performance requirement and may be subject to disallowed program costs by the grantor. Questioned costs: Undetermined, the program costs were allowable; however, the grantor may disallow the costs based on their requirements. Recommendation: We recommend that the Agency review current procedures to ensure that costs are charged within the grant?s period of performance. The procedures should also ensure that supervisory review of allowable costs charged to the program ensure that the costs are within the grant?s period of performance. Views of responsible officials: Management agrees with the finding.

Reference Number: 2020-012 Prior Year Finding: 2019-011 Federal Agency: U.S. Health and Human Services State Agency: Agency of Human Services (AHS or the Agency) Federal Program: State Children?s Insurance Program (CHIP), Medicaid Cluster CFDA Number: 93.767, 93.775, 96.777, 93.778 Award Number and Year: 1805VT5021 (10/1/2017 ? 9/30/2019) 190VT5021 (10/1/2018 ? 9/30/2020) 1905VT5MAP (10/1/2018 ? 9/30/2019) 2005VT5MAP (10/1/2019 ? 9/30/2020) Compliance Requirement: Special Tests and Provisions: Provider Eligibility Type of Finding: Material Weakness in Internal Control over Compliance, Material Non-compliance Criteria or specific requirement: Compliance: In order to receive Medicaid payments, providers must: (1) be licensed in accordance with Federal, State, and local laws and regulations to participate in the Medicaid program (42 CFR sections 431.107 and 447.10; and Section 1902(a)(9) of the Social Security Act (42 USC 396a(a)(9)); (2) screened and enrolled in accordance with 42 CFR Part 455, Subpart E (sections 455.400 through 455.470); and make certain disclosures to the State (42 CFR part 455, subpart B, sections 455.100 through 455.106). Medicaid managed care network providers are subject to the same disclosure, screening, enrollment, and termination requirements that apply to Medicaid fee-for-service providers in accordance with 42 CFR Part 438, Subpart H. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with the guidance in "Standards for Internal Control in the Federal Government" issued by the Comptroller General of the United States or the "Internal Control-Integrated Framework," issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: We noted that the Agency did not maintain documentation to support provider eligibility to participate in the Medicaid and CHIP programs. The provider eligibility requirement is administered by a 3rd-party which is required to determine and document provider eligibility with the Agency?s requirements. The 3rd-party provider did not consistently maintain the provider eligibility documentation. Specifically, we noted the following: 1. Eighteen Medicaid and twenty-two CHIP provider licenses were identified as expired during FY2020. 2. The application for one Medicaid and one CHIP provider was not available for review. 3. The Agency?s provider checklist was not available for review for two Medicaid providers. Context: Total provider sample size was sixty for Medicaid and sixty for CHIP 1. Eighteen Medicaid and twenty-two CHIP provider licenses selected for tested identified the license as expired during FY2020. 2. One Medicaid and one CHIP provider application was not available for review. 3. Two Medicaid providers? checklists were not available for review. For the expired Medicaid and CHIP provider licenses, we viewed the providers? license status maintained by state?s licensing board. All of the providers selected for testing were properly licensed during FY2020; the Agency?s records were updated with the most available information. Cause: The 3rd-party provider did not consistently maintain documentation to support the provider eligibility status. The corrective action plan for the prior year finding was not implemented. Effect: The Agency was unable to support the beneficiary?s eligibility or consistent application of their internal control process. Questioned costs: Undetermined, due to the lack of documentation. Recommendation: We recommend the Agency review its procedures to ensure that documentation is maintained in accordance with the federal grantor?s requirements. Views of responsible officials: Management agrees with the finding.

Reference Number: 2020-013 Prior Year Finding: N/A Federal Agency: U.S. Health and Human Services State Agency: Agency of Human Services (AHS or the Agency) Federal Program: State Children?s Insurance Program (CHIP), Medicaid Cluster CFDA Number: 93.767, 93.775, 93.777, 93.778 Award Number and Year: 1805VT5021 (10/1/2017 ? 9/30/2019) 190VT5021 (10/1/2018 ? 9/30/2020) 1905VT5MAP (10/1/2018 ? 9/30/2019) 2005VT5MAP (10/1/2019 ? 9/30/2020) Compliance Requirement: Eligibility Type of Finding: Significant Deficiency in Internal Control over Compliance, Other Matters Criteria or specific requirement: Compliance: Eligibility for CHIP is based on the application of modified adjusted gross income and household definition, in additional to other permissible eligibility standards, for example standards relating to geographic area, age (up to, but not including age 19), and disability status. Eligibility for Medicaid includes both financial and non-financial requirements and each eligibility group has its own specific standards. Financial eligibility for most individuals is based on modified adjusted gross income or MAGI, which is described at 42 CFR 435.603. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with the guidance in "Standards for Internal Control in the Federal Government" issued by the Comptroller General of the United States or the "Internal Control-Integrated Framework," issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: Documentation to support beneficiary?s eligibility was not available for testing. During the audit we noted: 1. Three CHIP beneficiary files were missing documentation to support eligibility. The Agency did not provide documentation to support income for one of the three beneficiaries, proof of the beneficiary?s application for benefits for two of the three beneficiaries and Income Eligibility Verification System (IEVS) verification for one of the three beneficiaries. 2. One Medicaid beneficiary file was missing documentation to support eligibility. The Agency did not provide documentation to support IEVS verification for one beneficiary. Context: Three of sixty CHIP beneficiaries selected for testing did not provide documentation to support eligibility. One of sixty Medicaid beneficiaries selected for testing did not provide documentation to support eligibility. Cause: The Agency did not adequately follow its procedures for retaining eligibility documentation in its beneficiary files. Effect: The Agency was unable to support beneficiary eligibility. Questioned costs: Undetermined, based on the available information. Recommendation: We recommend that the Agency review its procedures to ensure that documentation to support beneficiary eligibility is maintained in accordance with the retention policy and is readily available for review. Views of responsible officials: Management agrees with the finding.

Reference Number: 2020-014 Prior Year Finding: 2019-010 Federal Agency: U.S. Health and Human Services State Agency: Agency of Human Services (AHS or the Agency) Federal Program: Medicaid Cluster CFDA Number: 93.775, 93.777, 93.778 Award Number and Year: 1905VT5MAP (10/1/2018 ? 9/30/2019) 2005VT5MAP (10/1/2019 ? 9/30/2020) Compliance Requirement: Special Tests and Provisions - Provider Health and Safety Standards Type of Finding: Significant Deficiency in Internal Control over Compliance, Other Matters Criteria or specific requirement: Compliance: Providers must meet the prescribed health and safety standards for hospital, nursing facilities, and ICF/IID (42 CFR part 442). The standards may be modified in the State Plan. Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with the guidance in "Standards for Internal Control in the Federal Government" issued by the Comptroller General of the United States or the "Internal Control-Integrated Framework," issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Agency did not maintain documentation to support the provider?s compliance with the health and safety standards. For one of sixty providers selected for testing, we were unable to determine the provider?s compliance with the health and safety standards because the health and safety agreement was not available for testing. Context: The Agency requires the providers to complete a health and safety agreement which the provider attests to being compliant with the Agency?s requirements. The provider eligibility, health and safety requirement is administered by a 3rd-party. The 3rd-party is required to determine and document the provider?s eligibility with the Agency?s requirements. The 3rd party provider did not consistently maintain the health and safety documentation. Cause: The 3rd-party provider did not consistently maintain the health and safety provider agreements. Effect: The Agency is unable to support provider compliance with the health and safety standards. Questioned costs: Undetermined due to the lack of documentation Recommendation: We recommend the Agency review its procedures to ensure that documentation is maintained in accordance with the federal grantor?s requirements. Views of responsible officials: Management agrees with the finding.

Reference Number: 2020-015 Prior Year Finding: N/A Federal Agency: U.S. Health and Human Services State Agency: Agency of Human Services (AHS or the Agency) Federal Program: Medicaid Cluster CFDA Number: 93.775, 93.777, 93.778 Award Number and Year: 1905VT5MAP (10/1/2018 ? 9/30/2019) 2005VT5MAP (10/1/2019 ? 9/30/2020) 1905VTINCT (10/1/2018 ? 9/30/2019) 2005VTINCT (10/1/2019 ? 9/30/2020) 1905VTIMPL (10/1/2018 ? 9/30/2019) 2005VTIMPL (10/1/2019 ? 9/30/2020) Compliance Requirement: Reporting ? CMS-64, Quarterly Statement of Expenditures for the Medical Assistance Program Type of Finding: Significant Deficiency in Internal Control over Compliance, Other Matters Criteria or specific requirement: Compliance: A reporting requirement of the CMS-64, Quarterly Statement of Expenditures for the Medical Assistance Program, is to report quarterly overpayment adjustments by fiscal year. Overpayments must be reported separately for FY2020, FY2019, FY2018 and FY2017 and prior. States must accurately report these overpayments and maintain adequate documentation supporting the amounts reported. Control: 200.303 The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Agency incorrectly reported Medicaid overpayment adjustments on the 12/31/2019 CMS-64 report. The Agency reported overpayments for: a. FY 2017 and prior as $841, correct amount was $0, b. FY 2018 as $12,175, correct amount was $841, and c. FY 2018 as $0, correct amount was $12,175. The errors resulted in the overpayment subtotal being incorrect as following: a. FY 2017 and prior, $148, should be ($693), b. FY 2018, $3,771, should be ($7,563), c. FY 2019, $0, should be $12,175. Context: One out of two quarterly reports tested reported the Medicaid overpayments in the wrong column which resulted in attributing the overpayments to the wrong reporting year. Cause: The error was not detected during the supervisory review process. Effect: Reporting financial information for the wrong fiscal year may affect related reporting by the grantor agency or future program funding. Questioned costs: Undetermined, the error, although reported for the wrong fiscal year, was accurate and agreed to supporting documentation. Recommendation: We recommend the Agency review its procedures to ensure that supervisory review is consistently performed in order to detect errors in a timely manner. Views of responsible officials: Management agrees with the finding.

Reference Number: 2020-016 Prior Year Finding: N/A Federal Agency: U.S. Health and Human Services State Agency: Agency of Human Services (AHS or the Agency) Federal Program: Disability Insurance/Social Security Cluster CFDA Number: 96.001, 96.006 Award Number and Year: 1901VTADPT 2001VTADPT Compliance Requirement: Reporting ? SSA-4514 -Time Report of Personnel Services for Disability Determination Services Type of Finding: Significant Deficiency in Internal Control over Compliance, Other Matters Criteria or specific requirement: Compliance: The Form SSA-4514, Time Report of Personnel Services for Disability Determination Services is used to report the number of hours worked by staffing category and employment status (i.e., full-time, part-time, temporary). This report should reflect all hours worked by personnel engaged in the SSA disability program during the reporting period. Holiday and Leave Hours reporting: For each staffing category (i.e., full-time, part-time, and temporary), the hours for holidays observed by the State agency and for sick, annual, or other paid leave (e.g., lump sum leave, military leave, etc.) must be entered. The entries in this column should include the proportionate share of holidays and leave time of the regular staff of the agency who worked part-time on the SSA disability program. Control: 200.303 The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The Agency incorrectly reported the allocation of supervisors and examiners hours between the on-duty and holiday and leave hours. We identified 7.75 hours that were incorrectly reported between the two categories. The error did not affect the total hours for the reporting period. Context: One out of two quarterly reports tested resulted in the reporting error. Cause: The error was not identified during the supervisory review due to oversight. Effect: The error may affect related reporting requirements of the grantor agency. Questioned costs: Undetermined, the error did not affect the total employee hours reported to the grantor. Recommendation: We recommend the Agency review its procedures to ensure that the supervisory review is consistently performed and errors are detected in a timely manner. Views of responsible officials: Management agrees with the finding.

Reference Number: 2019-003 Prior Year Finding: 2018-003 Federal Agency: U.S. Department of Agriculture State Agency: Vermont Agency of Education Federal Program: Child Nutrition Cluster Special Education ? Grants to States (IDEA, Part B) CFDA Number: 10.555, 10.559, 84.027, 84.173 Award Number and Year: 201818N109944 (7/1/2017 - 9/30/2018) 201919N109944 (7/1/2018 - 9/30/2019) H027A180098 (7/1/2018 - 9/30/2019) H027A180098-18A (7/1/2018 - 9/30/2019) Compliance Requirement: Cash Management Type of Finding: Significant deficiency in internal control and noncompliance Criteria or specific requirement U.S. Department of the Treasury (Treasury) regulations at 31 CFR part 205 implement the Cash Management Improvement Act of 1990 (CMIA), as amended (Pub. L. No. 101-43; 31 USC 6501 et seq). Subpart A of those regulations requires State recipients to enter into Treasury-State Agreements that prescribe specific methods of drawing down Federal funds (funding techniques) for Federal programs listed in the Catalog of Federal Domestic Assistance that meet the funding threshold for a major Federal assistance program under the CMIA. Condition As outlined in the Cash Management Improvement Act Agreement between the State of Vermont and the United States Department of Treasury, the Agency of Education (the Agency) is required to drawdown Federal funds for the National School Lunch and IDEA, Part B programs bi-weekly based on actual expenditures incurred during the previous two-week period. During our testing over cash management, we noted the Agency performed a total of 16 cash draws for the year ended June 30, 2019 and did not comply with the draw down pattern established within the CMIA agreement. Cause The Agency does not have sufficient procedures in place to ensure that drawdowns are performed in accordance with the CMIA agreement. Effect The Agency is not in compliance with the funding techniques prescribed by the Treasury. Questioned costs None. Recommendation We recommend Agency management strengthen its current policies and procedures to ensure that drawdowns are performed as prescribed by the Treasury. Views of responsible officials We agree with the finding and related recommendation above. Our detailed corrective action plan is found in Appendix I.

Reference Number: 2019-004 Prior Year Finding: 2018-004 Federal Agency: U.S. Department of Agriculture State Agency: Vermont Agency of Education Federal Program: Child Nutrition Cluster CFDA Number: 10.555, 10.559 Award Number and Year: 201818N109944 (7/1/2017 - 9/30/2018) 201817N109944 (7/1/2017 - 9/30/2018) 201919N109944 (7/1/2018 - 9/30/2019) 201918N109944 (7/1/2018 - 9/30/2019) Compliance Requirement: Special Test - Accountability for USDA Donated Foods Type of Finding: Significant deficiency in internal control and noncompliance Criteria or specific requirement Distributing and subdistributing agencies (as defined at 7 CFR section 250.3) must maintain accurate and complete records with respect to the receipt, distribution, and inventory of USDA-donated foods including end products processed from donated foods. Failure to maintain records required by 7 Resection 250.16 shall be considered prima facie evidence of improper distribution or loss of donated foods, and the agency, processor, or entity may be required to pay USDA the value of the food or replace it in kind (7 CFR sections 250.16(a)(6)and 250.15(c)). Distributing and subdistributing agencies shall take a physical inventory of all storage facilities. Such inventory shall be reconciled annually with the storage facility's inventory records and maintained on file by the agency that contracted with or maintained the storage facility. Corrective action shall be taken immediately on all deficiencies and inventory discrepancies and the results of the corrective action forwarded to the distributing agency (7 CFR section 250.14(e)). Condition The Vermont Agency of Education (the Agency) acts as the State distributing agency for the USDA-donated foods. The commodities received by the Agency are ultimately distributed to participating School Food Authorities (SFA) throughout the State of Vermont. On an annual basis, the Agency enters into a $0 contract with a third party vendor to warehouse the brown box USDA foods once they are delivered to the State. The third party vendor utilizes an inventory system, TRACS, to maintain inventory of the commodities in the warehouse and to track the distribution of donated foods to the SFAs. While the quantity of items is maintained in TRACS, the system does not track the value of the commodity items. The value of commodities and the number of commodity items are tracked through the USDA?s Web Based Supply Chain Management (WBSCM) system. Annually, the Agency notifies each SFA of the value of their commodities received. On a quarterly basis for a sample of 15 SFAs, the Agency began preparing a reconciliation between the number of cases of commodities received by the SFA per TRACS as compared to WBSCM. The Agency would then perform research to identify the root cause of any variances. We noted the control was performed for the quarter ended 09/30/18 and partially completed for the quarter ended 12/31/18. As a result, there was no reconciliation performed for the period 11/1/18 to 06/30/19. Additionally, as of January 2, 2020, we have also noted that the value of inventory credits identified in the June 2019 inventory were not sent to the third party vendor to process to the respective recipient accounts. Cause The Agency did not have adhere to its existing policies and procedures in place to reconcile the WBSCM to the TRACS system on a periodic basis. Effect The Agency may not be accurately reporting the value of commodities received to the SFAs. In addition, variances may exist between TRACS and WBSCM that may not be identified and counted in a timely manner. Questioned costs None. Recommendation We recommend Agency management adhere to its current procedures regarding the quarterly WBSCM to TRACS reconciliations. We also recommend Agency management perform an annual inventory reconciliation of all SFA?s with the storage facility's inventory records. Views of responsible officials We agree with the finding and related recommendation above. Our detailed corrective action plan is found in Appendix I.

Reference Number: 2019-005 Prior Year Finding: N/A Federal Agency: U.S. Department of the Interior State Agency: Vermont Department of Fish and Wildlife Federal Program: Fish and Wildlife Cluster CFDA Number: 15.605, 15.611, 15.626 Award Number and Year: F18AF00844 (7/1/2018 ? 6/30/2019) F18AF00872 (7/1/2018 ? 6/30/2019) F18AF00869 (7/1/2018 ? 6/30/2019) Compliance Requirement: Equipment/Real Property Management Type of Finding: Significant deficiency in internal control and noncompliance Criteria or specific requirement 2 CFR, Part 200 ? Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), Subpart D, ?200.303 requires that non-Federal entities receiving Federal awards establish and maintain effective internal controls over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. The Uniform Guidance also establishes requirements for the acquisition, management, and disposal of capital assets. Capital assets means tangible or intangible assets used in operations having a useful life of more than one year which are capitalized in accordance with GAAP. Capital assets include: (a) Land, buildings (facilities), equipment, and intellectual property (including software) whether acquired by purchase, construction, manufacture, lease-purchase, exchange, or through capital leases; and (b) Additions, improvements, modifications, replacements, rearrangements, reinstallations, renovations or alterations to capital assets that materially increase their value or useful life (not ordinary repairs and maintenance). (2 CFR 200, ?200.12) Equipment means tangible personal property (including information technology systems) having a useful life of more than one year and a per-unit acquisition cost which equals or exceeds the lesser of the capitalization level established by the non-Federal entity for financial statement purposes, or $5,000. (2 CFR 200, ?200.33) A state must use, manage and dispose of equipment acquired under a Federal award by the state in accordance with state laws and procedures. (2 CFR 200, ?200.313(b)) Property records must be maintained that include a description of the property, a serial number or other identification number, the source of funding for the property (including the FAIN), who holds title, the acquisition date, and cost of the property, percentage of Federal participation in the project costs for the Federal award under which the property was acquired, the location, use and condition of the property, and any ultimate disposition data including the date of disposal and sale price of the property. (2 CFR 200, ?200.313(d)(1)) When original or replacement equipment acquired under a Federal award is no longer needed for the original project or program or for other activities currently or previously supported by a Federal awarding agency, except as otherwise provided in Federal statutes, regulations, or Federal awarding agency disposition instructions, the non-Federal entity must request disposition instructions from the Federal awarding agency if required by the terms and conditions of the Federal award. (2 CFR 200, ?200.313(e)) Condition The Department of Fish and Wildlife, who administers the Fish and Wildlife Cluster (FWC) program, is required to follow the State of Vermont Procurement Policies and Procedures as it relates to the management/disposition of equipment/real property. We noted the program did not follow the State?s policies as it relates to the disposition of assets. Per the Asset Management policy: I. Disposing of an Asset (excluding IT items) a. BGS-Surplus Property must review all assets identified as no longer used/needed to determine the appropriate method for disposal. i. Notification must be sent from the Property Manager or Fleet Manager to the Financial Technician via form found at: http://bgs.vermont.gov/business_services/surplus/forms ii. The Financial Technician will forward the form to BGS for determination. b. BGS-Surplus property will give notice of proper disposition for each item. i. Upon notice of disposal, the Financial Technician will complete requirements in the Vision Asset Management Module, to ensure accurate financial reporting. 1. Retirements must be entered with a transaction date equal to the date of the disposal, and accounting date equal to the current date, and with the disposal code that most accurately describes the disposal process. 2. The Financial Technician will document all details including how the asset was physically disposed of on the Comments Panel of the asset Basic Information tab in the Asset Management Module. ii. Depending on determination from BGS-Surplus property, the Property Manager will: 1. Arrange for assets to be physically transferred to the Waterbury warehouse. 2. Arrange for assets to be disposed of via e-waste, metal recycling or trash. a. Metal recycling or trash removal at a state-owned buildings should be coordinated with BGS District Facilities Manager. 3. Coordinate an on-site auction/sale with BGS-Surplus Property. The FWC program was not in compliance with the BGS policies regarding the disposals of assets. Specifically, we noted the following: 1. For three samples, the transaction date did not equal the date of disposal; and 2. For two samples, there were no details on how the asset was physically disposed of on the Comments Panel of the asset Basic Information tab in the Asset Management Module. Cause The Department of Fish and Wildlife did not adhere to the State?s existing policies and procedures as it relates to the disposition of assets. Effect The Department of Fish and Wildlife is not in compliance with the Equipment/Real Property Management compliance requirement. Questioned costs None Recommendation We recommend the Department of Fish and Wildlife adhere to the State?s existing policies and procedures as it relates to the disposition of assets. Views of responsible officials We agree with the finding and related recommendation above. Our detailed corrective action plan is found in Appendix I.

Reference Number: 2019-006 Prior Year Finding: N/A Federal Agency: U.S. Department of Justice State Agency: Center for Crime Victims Services Federal Program: Crime Victims Assistance CFDA Number: 16.575 Award Number and Year: 2017-VA-GX-0042 (10/1/2016-9/30/2020) Compliance Requirement: Subrecipient Monitoring Type of Finding: Significant Deficiency in internal control over compliance and noncompliance Criteria or specific requirement Compliance: Reporting: The Grantee agrees to submit a Subgrant Award Report (SAR) to the Office for Victims of Crime (OVC) for each subgrantee of the VOCA victim assistance funds, within ninety (90) days of awarding funds to subgrantees. States and terrorities are required to submit this information through the automated system. Site visits: Per the Crime Victims Assistance Grant Plan, subrecipient site visits must be performed every 4 years. Internal control: 200.303 The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition Reporting: We noted that one out of seven subrecipient SAR reports tested was not submitted in accordance with the 90-day program requirements and was submitted 6-months after the issuance of the subaward. Site visit: We noted that one out of seven site tested was not performed in accordance with the program requirements. The 4-year site visit for one subreceipeint was not completed in accordance with the program?s requirement. For one subrecipient we identified that the last site visit was performed April 15, 2015; therefore, requiring a site visit to be performed on or before April 15, 2019. As of June 30, 2019, the site visit was not performed. The Agency attempted to perform the site review in September 2019, but was rescheduled until November 2019 due to inclement weather. Questioned costs None Cause Reporting: The subrecipient was not expected to spend the grant until several months after issuance. The Agency decided to wait until the subrecipient began drawing funds to support program costs before submitting the SAR. Site Visit: The Agency attempted to perform the site review in September 2019 but was rescheduled to November 2019 due to inclement weather. In addition, the late scheduling of the site visit was due to the availability of staff. Effect The Agency is not compliant with program requirements. Recommendation We recommend that the Agency review current procedures and enhance (as deemed necessary) to ensure that all requirements are consistently performed in a timely manner. The procedures should provide guidance related to documenting and notifying the grantor when there is a deviation from the program requirements. Views of responsible officials We agree with the finding and related recommendation above. Our detailed corrective action plan is found in Appendix I.

Reference Number: 2019-007 Prior Year Finding: 2018-008 Federal Agency: U.S. Department of Transportation State Agency: Vermont Agency of Transportation Federal Program: Highway Safety Cluster CFDA Number: 20.600, 20.601, 20.610, 20.611, 20.616 Award Number and Year: NH17402 (10/1/2016 ? 9/30/2017) NH17405B (10/1/2016 ? 9/30/2017) NH17405C (10/1/2016 ? 9/30/2017) NH17405D (10/1/2016 ? 9/30/2017) NH18402 (10/1/2017 ? 9/30/2018) NH18405B (10/1/2017 ? 9/30/2018) NH18405C (10/1/2017 ? 9/30/2018) NH18405D (10/1/2017 ? 9/30/2018) NH18405E (10/1/2017 ? 9/30/2018) NH18405F (10/1/2017 ? 9/30/2018) NH18408 (10/1/2017 ? 9/30/2018) NH18410 (10/1/2017 ? 9/30/2018) NH191906 (10/1/2018 ? 9/30/2019) NH19402 (10/1/2018 ? 9/30/2019) NH19405B (10/1/2018 ? 9/30/2019) NH19405C (10/1/2018 ? 9/30/2019) NH19405D (10/1/2018 ? 9/30/2019) NH19405H (10/1/2018 - 9/30/2019) Compliance Requirement: Level of Effort Type of Finding: Material weakness in internal control and material noncompliance Criteria or specific requirement The Maintenance of Effort (MOE) Advisory was originally developed by the Governors Highway Safety Association (GHSA) in November 2014 to provide guidance to the State Highway Safety Offices (SHSOs) for compliance with the MOE requirements contained in the Moving Ahead for Progress in the 21st Century Act (MAP-21), (Public Law 112-141 of 2012) federal highway safety program reauthorization. Significant changes were made to the MOE requirement by the Fixing America?s Surface Transportation Act, the FAST Act (Public Law No. 114-94), reauthorization which took effect in December 2015. On February 12, 2014, NHTSA?s Office of Regional Operations and Program Delivery issued Guidance to assist States in calculating MOE and understanding the related certification, documentation and waiver requirements. This Guidance clarified that the only expenditures for ?local? sources to be included in the MOE are the amount of State grant funds provided to and expended by local subdivisions. The 2-12-14 NHTSA document is the regulatory guidance. The GHSA Advisory is a secondary source of information. Under MAP-21 in order to qualify for Section 405 grants for Occupant Protection (405b), State Traffic Safety Information System Improvement (405c) and Impaired Driving Countermeasure (405d) grants, the States were required to maintain aggregate expenditures from all State and local sources for programs described in the applicable section at or above the average level of such expenditures in fiscal years 2010 and 2011. Annually on March 31, States were required to submit to their NHTSA Region the MAP-21 MOE information outlined in this Advisory. NHTSA has determined that FY2017 is the last year of submitting MOE requirements using the MAP-21 process. NHTSA is satisfied that the MAP-21 MOE requirement is met when the initial calculation for a given year is submitted. Under the FAST Act for the same three Section 405 grant programs, beginning with FY2018 the SHSO designates the lead State agency for each program and certifies in Appendix B of the annual Highway Safety Plan (HSP) that the lead State agency responsible for each of the three programs is maintaining its aggregate expenditures for that program at or above the average level of such expenditures in fiscal years 2014 and 2015 (baseline years). Condition In June 2017, the Governor?s Representative for the State of Vermont identified the Governor?s Highway Safety Program (GHSP) at the Vermont Agency of Transportation the ?lead state agency? and the designated State Highway Safety Office (SHSO) for the following Section 405 programs: ? Occupant Protection (405B) ? State Traffic Safety Information System Improvement (405C) ? Impaired Driving Countermeasures (405D) Per discussion with management, ?the Vermont SHSO historically has used a calculation based on a ?zero? aggregate spending for Federal Fiscal years. The SHSO is funded in part, to a small degree, by State funds. Thus, it is not disingenuous to say that the SHSO is funded primarily by Federal grant funds, and as such, it would not make any ``aggregate expenditures?? of State funds in the identified covered areas??. As a result, it was determined that the GHSP did not expend the required State funding in fiscal year 2019 in operation of the Section 405 programs identified above. However, ?Effective August 13, 2019, NHTSA issued revised NHTSA MOE Guidance which allows the SHSO to submit a change in lead state agency to their Regional Office based on the revisions to that Guidance but no later than October 1, 2019?. As result, as of September 2019, the State has identified the Vermont Agency of Transportation (VTrans) as the new lead state agency to monitor and ensure the required State aggregate expenditures are in compliance with the FAST ACT Maintenance of Effort Requirements. VTrans is currently awaiting approval from NHTSA for the change in lead state agency. Cause As a result of the prior year finding and due to the timing of the revised NHTSA MOE guidance, the Vermont Agency of Transportation did not fully identify and implement the necessary remediation efforts to ensure compliance with the FAST Act MOE requirements until subsequent to year-end. Effect VTrans was not in compliance with the FAST Act MOE compliance requirements. Questioned costs Undetermined. Recommendation Upon receiving NHTSA approval, the VTrans should implement and adhere to its policies and procedures for the monitoring and tracking of State expenditures to ensure the required FAST Act MOE compliance requirements are met and also ensure that the State submit their NHTSA Region MAP-21 MOE information annually on March 31. Views of responsible officials We agree with the finding and related recommendation above. Our detailed corrective action plan is found in Appendix I.

Reference Number: 2019-008 Prior Year Finding: N/A Federal Agency: U.S. Department of Education State Agency: Agency of Human Services Federal Program: Rehabilitation Services- Vocational Rehabilitation Grants to States CFDA Number: 84.126 Award Number and Year: H126A180067 (10/1/2017 ? 9/30/2019) H126A190067 (10/1/2018 ? 9/30/2019) Compliance Requirement: Reporting Type of Finding: Significant deficiency in internal control over compliance Criteria or specific requirement Internal control: 200.303 The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition We noted errors on one of two quarterly SF-425 Federal Financial Reports (SF-425) and on the annual RSA-2 Annual Vocational Rehabilitation Program/Cost Report (RSA-2) that were not detected during the review process. The Agency incorrectly reported the federal share of unliquidated obligations on the 3/31/2019 quarterly SF-425 report. The reported federal share of unliquidated obligations was $1,241,521 instead of $1,261,530, resulting in an under-reporting of $20,003. The Agency incorrectly reported the total SE program expenditures on the annual RSA-2 report. The reported SE program expenditures were $210,014 instead of $273,251, resulting in an under-reporting of $63,237. Questioned costs None. Cause The errors were not detected during the review process. Effect The Agency reported incorrect information to the grantor which may affect the reliability of the submitted information.

Reference Number: 2019-009 Prior Year Finding: N/A Federal Agency: U.S. Department of Health and Human Services State Agency: Agency of Human Services Federal Program: State Children?s Insurance Program CFDA Number: 93.767 Award Number and Year: 1705VT5021 (10/1/2016 ? 9/30/2018) 1705VT0301 (10/1/2016 ? 9/30/2018) 1805VT5021 (10/1/2017 ? 9/30/2019) 190VT5021 (10/1/2018 ? 9/30/2020) Compliance Requirement: Eligibility Type of Finding: Significant deficiency in internal control and noncompliance Criteria or specific requirement Internal control: 200.303 The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Compliance: Eligibility for CHIP is based on the application of modified adjusted gross income and household definition, in addition to other permissible eligibility standards, for example standards relating to geographic area, age (up to, but not including age 19), and disability status. Condition We noted that the one out of forty participants continued to be eligible for benefits after reaching the age of 19. Cause The beneficiary should have been transferred to Medicaid as a new adult. However, the category code did not identify the beneficiary as ineligible for CHIP upon the beneficiary turning 19. Effect The Agency provided benefits to an ineligible beneficiary. Questioned costs None, the error was corrected within one to two months (ineligible time frame) after the beneficiary turned 19. There were no claims paid on behalf of the beneficiary during the ineligible time frame. Recommendation We recommend that the Agency review and enhance procedures (as deemed necessary) to ensure that benefits are discontinued in a timely manner to prevent unallowed program costs and/or activities. Views of responsible officials We agree with the finding and related recommendation above. Our detailed corrective action plan is found in Appendix I.

Reference Number: 2019-010 Prior Year Finding: N/A Federal Agency: U.S. Health and Human Services State Agency: Agency of Human Services Federal Program: Medicaid Cluster CFDA Number: 93.775, 93.777, 93.778 Award Number and Year: 1905VT5MAP (7/1/2018 ? 6/30/2019) Compliance Requirement: Special Tests and Provisions ? Provider Health and Safety Standards Type of Finding: Significant deficiencies in internal control and noncompliance Criteria or specific requirement Internal control: 200.303 The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Compliance: Providers must meet the prescribed health and safety standards for hospital, nursing facilities, and ICF/IID (42 CFR part 442).The standards may be modified in the State Plan. Condition We noted that the Agency did not consistently maintain documentation to support provider compliance with the health and safety standards. The Agency requires that providers complete a health and safety agreement in which the provider attests to being compliant with the Agency?s requirements. The provider health and safety requirement is administered by a 3rd-party. The 3rd party is required to determine and document the provider?s eligibility with the Agency?s requirements. The 3rd party provider did not consistently maintain the health and safety documentation. We were unable to determine the provider?s compliance with the health and safety standards for two of sixty providers tested: 1. The health and safety agreement for one provider was not available for testing. 2. The health and safety agreement for one provider was incomplete. Cause The 3rd party provider did not consistently maintain the health and safety provider agreements. Effect The Agency is unable to support provider compliance with the health and safety standards. Questioned costs Undetermined due to the lack of documentation Recommendation We recommend the Agency review and enhance procedures (as deemed necessary) to ensure that documentation is maintained in accordance with the federal grantor?s requirements. Views of responsible officials We agree with the finding and related recommendation above. Our detailed corrective action plan is found in Appendix I.

Reference Number: 2019-011 Prior Year Finding: N/A Federal Agency: U.S. Health and Human Services State Agency: Agency of Human Services Federal Program: Medicaid Cluster, Children?s Health Insurance Program CFDA Number: 93.775, 93.777, 93.778, 93.767 Award Number and Year: 1905VT5MAP (7/1/2018 ? 6/30/2019) 1705VT5021 (10/1/2016 ? 9/30/2018) 1705VT0301 (10/1/2016 ? 9/30/2018) 1805VT5021 (10/1/2017 ? 9/30/2019) 190VT5021 (10/1/2018 ? 9/30/2020) Compliance Requirement: Special Tests and Provisions ? Provider Eligibility Type of Finding: Significant deficiencies in internal control and noncompliance Criteria or specific requirement Internal control: 200.303 The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Compliance: In order to receive Medicaid payments, providers must: (1) be licensed in accordance with Federal, State, and local laws and regulations to participate in the Medicaid program (42 CFR sections 431.107 and 447.10; and Section 1902(a)(9) of the Social Security Act (42 USC 396a(a)(9)); (2) screened and enrolled in accordance with 42 CFR Part 455, Subpart E (sections 455.400 through 455.470); and make certain disclosures to the State (42 CFR part 455, subpart B, sections 455.100 through 455.106). Medicaid managed care network providers are subject to the same disclosure, screening, enrollment, and termination requirements that apply to Medicaid fee-for-service providers in accordance with 42 CFR Part 438, Subpart H. Condition We noted that the Agency did not maintain documentation to support the provider?s eligibility to participate in the Medicaid and CHIP program. The provider eligibility requirement is administered by a 3rd-party. The 3rd party is required to determine and document the provider?s eligibility with the Agency?s requirements. The 3rd party provider did not consistently maintain the eligibility documentation. We were unable to determine the provider?s compliance with eligibility for three Medicaid and one CHIP provider. Medicaid 1. The eligibility documentation for one provider was not available for testing. 2. The provider license was not valid for the entire fiscal year. The provider license expired 1/31/2019, documentation to support renewal was not available. 3. The eligibility documentation for one provider was incomplete. CHIP 1. The eligibility documentation for one provider was not available for testing. Three out of sixty Medicaid providers and one out of forty CHIP providers were not compliant with the federal compliance requirement. Cause The 3rd party provider did not consistently maintain documentation to support the provider?s eligibility status. Effect The Agency is unable to support that the provider was eligible to participate in the Medicaid and CHIP program. Questioned costs Undetermined due to the lack of documentation Recommendation We recommend the Agency review and enhance procedures (as deemed necessary) to ensure that documentation is maintained in accordance with the federal grantor?s requirements. Views of responsible officials We agree with the finding and related recommendation above. Our detailed corrective action plan is found in Appendix I.

Reference Number: 2019-012 Prior Year Finding: 2018-002 Federal Agency: U.S. Health and Human Services State Agency: Agency of Human Services Federal Program: Medicaid Cluster CFDA Number: 93.775, 93.777, 93.778 Award Number and Year: 1905VT5MAP (7/1/2018 ? 6/30/2019) Compliance Requirement: Special Tests and Provisions ? ADP Risk Analysis and System Security Review Type of Finding: Significant deficiency in internal control and noncompliance Criteria or specific requirement Internal control: 200.303 The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Compliance: State agencies must establish and maintain a program for conducting periodic risk analyses to ensure that appropriate, cost effective safeguards are incorporated into new and existing systems. State agencies must perform risk analyses whenever significant system changes occur. State agencies shall review the ADP system security installations involved in the administration of HHS programs on a biennial basis. At a minimum, the reviews shall include an evaluation of physical and data security operating procedures, and personnel practices. The State agency shall maintain reports on its biennial ADP system security reviews, together with pertinent supporting documentation, for HHS on-site reviews (45 CFR section 95.621). Condition During the audit we noted that AHS did not complete the bi-annual risk analysis and security review of the ADP system by June 30, 2019. Cause The assessment was completed after fiscal year 2019. Effect AHS is not compliant with bi-annual risk analysis and security review of the ADP system. Questioned costs None. The compliance requirement does not affect the allowability of program costs or activities. Recommendation We recommend management design and implement an internal control to conduct and document an ADP system security review as least biennially. Additionally, management should continue to assess information security risks and develop action plans to address the identified control deficiencies and vulnerabilities. Views of responsible officials We agree with the finding and related recommendation above. Our detailed corrective action plan is found in Appendix I.

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION