Austintown Local School District

1. SUPTRS BG – CASH MANAGEMENT Finding Number: 2025-001 State Agency Number: DBH-01 Assistance Listing Number and Title: 93.959 – Block Grants for Prevention and Treatment of Substance Abuse (SUPTRS BG) Federal Award Identification Numbers / Years: B08TI087059 / 2024 (SUPTRS BG) Federal Agency: Department of Health and Human Services Compliance Requirement: Cash Management Repeat Finding from Prior Audit? Yes Prior Audit Finding Number: 2024-019 NONCOMPLIANCE AND MATERIAL WEAKNESS 31 C.F.R. § 205.33(a) sets guidelines relating to timely disbursement of federal funds which states, in part: A State must minimize the time between the drawdown of Federal funds from the Federal government and their disbursement for Federal program purposes. A Federal Program Agency must limit a funds transfer to a State to the minimum amounts needed by the State and must time the disbursement to be in accord with the actual, immediate cash requirements of the State in carrying out a Federal assistance program or project. The timing and amount of funds transfers must be as close as is administratively feasible to a State's actual cash outlay for direct program costs and the proportionate share of any allowable indirect costs… It is management’s responsibility to implement control policies and procedures to reasonably ensure draws of federal funds are for immediate cash needs, processed accurately, and disbursed timely in accordance with applicable laws and regulations. During state fiscal year 2025, the Department drew down approximately $80.8 million in federal funding for the SUPTRS BG program. Once voucher payments are approved in the Ohio Administrative Knowledge System (OAKS) and the Payment Management System (PMS), the Department draws the SUPTRS BG funds electronically from PMS to cover the amount of the vouchers, as the account is to maintain a zero cash balance. Before drawing down funds, the Senior Financial Analyst prepares a Cash Request noting the amount to be drawn and OAKS coding. The Cash Request is then forwarded to a different Senior Financial Analyst who draws the funds down in PMS and sends the support documentation back to the original analyst for creation of the revenue receipt in OAKS. The revenue receipt is then submitted to the Community Funding Operations Manager and Ohio Treasurer of State’s Office for approval. Once approved, the Department makes a payment in the form of an electronic funds transfer or check. The Department has a cash management policy in place which establishes a 20-day requirement for disbursing federal funds once deposited or as close as is administratively feasible for timely payment. However, the Department’s 20-day requirement is not a reasonable timeframe based on administrative processes and timeliness. As such, for this compliance test, eight business days were designated as close as administratively feasible. Although the Department had policies and controls in place over the deposit and disbursement of federal funds, these controls did not prevent noncompliance with the 31 C.F.R. § 205.33(a). As a result, of 16 disbursements tested from 16 SUPTRS BG draws, the Department did not disburse one payment (6.3%) within eight business days of the receipt of federal funds. The Department disbursed the funds six days after the required disbursement date. Not having effective controls over the timely disbursement of federal funds could lead to the Department not limiting draws to immediate cash needs and not expending funds timely. This could result in noncompliance with 31 C.F.R. § 205.33(a) and could subject the Department to sanctions, other penalties, or a repayment of part of the grant award amounts. In addition, noncompliance could subject the Department to paying interest charges on these draws. Based on discussions with management and review of supporting documents, this was caused by voucher processing and approval delays. We recommend the Department evaluate its existing cash management control procedures and update them as necessary to reasonably ensure all federal draw requests are disbursed timely and are drawn only for immediate cash needs, based on the funding technique established in accordance with 31 C.F.R. § 205.33(a). We also recommend the Department establish procedures to periodically monitor its compliance with the cash management requirements and initiate necessary actions to resolve any noncompliance that results. Lastly, we recommend the Department revise its cash management policy to ensure federal draws are disbursed in compliance with applicable laws and regulations. Auditor of State Conclusion: The response to this finding included within the State of Ohio Corrective Action Plan indicated the Department disagreed with the timeframe designated “as close as is administratively feasible” to disburse federal funds once drawn down and required an Auditor of State Conclusion. 31 C.F.R. § 205.33(a) requires the Department to minimize the time between the federal drawdown and disbursement of federal funds. The State of Ohio's accounting system requires funding to be available prior to initiating a disbursement and once available takes two business days to produce a payment. Given this information, the Auditor of State has designated eight business days as “as close as is administratively feasible” when testing federal compliance for cash management for federal programs not included in the Cash Management Improvement Act Agreement. Therefore, this finding remains as stated above.

SUPTRS BG – TRANSPARENCY ACT REPORTING Finding Number: 2025-002 State Agency Number: DBH-02 Assistance Listing Number and Title: 93.959 – Substance Use Prevention, Treatment, and Recovery Block Grant (SUPTRS BG) Federal Award Identification Number / Year: B08TI087059 / 2024 (SUPTRS BG) Federal Agency: Department of Health and Human Services Compliance Requirement: Reporting Repeat Finding from Prior Audit? No NONCOMPLIANCE AND MATERIAL WEAKNESS The Federal Funding Accountability and Transparency Act (Pub. L. No. 109-282, as amended by Section 6202 of Public Law 110-252, hereafter referred to as the “Transparency Act” that are codified in 2 C.F.R. Part 170) requires prime recipients of federal awards who make first-tier subawards to report the subaward on the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS portal or SAM.gov) website maintained by the federal Office of Management and Budget. Under the requirements of 2 C.F.R. Part 170, recipients (i.e., direct recipients) of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more on the FSRS portal or SAM.gov website. Prime recipients must report by the end of the month following the month in which the obligation is made. It is management’s responsibility to design and implement internal controls to reasonably ensure compliance with laws and regulations and to ensure management’s objectives are achieved. The State of Ohio is considered the prime recipient for federal funds applicable to Transparency Act reporting and the state agencies receiving these federal funds are expected to report the subawards obligated in accordance with the Transparency Act. During the audit period, the Department obligated approximately $30.4 million for 135 SUPTRS BG first-tier subawards which exceeded $30,000 and were required to be reported on the FSRS portal or SAM.gov website in accordance with the Transparency Act for the SUPTRS BG program. Monthly, the Department’s Fiscal Office generates the Transparency Act report from the Grants Funding Management System (GFMS) and reviews it for completeness and accuracy, then approves it in the GFMS system. The Transparency Act report is then manually entered or uploaded into the FSRS portal or SAM.gov website. Although the Department had various controls in place over the Transparency Act reporting, the following errors were noted: Transactions Tested Subaward not reported Report not timely Subaward amount incorrect Subaward missing key elements 14 0 1 0 0 Dollar Amount of Tested Transactions Subaward not reported Report not timely Subaward amount incorrect Subaward missing key elements $3,059,922 $0 $518,252 $0 $0 By not complying with federal Transparency Act reporting requirements, the Department risks federal funding being reduced, taken away, or other sanctions imposed by the federal grantor agency. If the subawards are not reported timely within the FSRS portal or SAM.gov website, the risk exists that those using the Transparency Act reports could be relying on inaccurate information. Based on discussions with management, these errors were caused by management oversight and not maintaining submission records. We recommend the Department evaluate its Transparency Act reporting procedures and update them as necessary to promote compliance with the Federal regulations, which include timeliness of information submitted. In addition, the Department should maintain sufficient records of the subaward submission, including the submission date to ensure management’s objectives are achieved. Management should periodically review these control procedures to ensure they are operating as intended.

LOW-INCOME HOME ENERGY ASSISTANCE PROGRAM – PERIOD OF PERFORMANCE Finding Number: 2025-003 State Agency Number: DEV-01 Assistance Listing Number and Title: 93.568 Low-Income Home Energy Assistance Program (LIHEAP) Federal Award Identification Numbers / Years: 2201OHLIEA / 2022 2301OHLIEA / 2023 Federal Agency: Department of Health and Human Services Compliance Requirement: Period of Performance Repeat Finding from Prior Audit? Yes Prior Audit Finding Number: 2024-002 QUESTIONED COSTS 45 C.F.R. § 96.30 (a) states, in part: . . . Except where otherwise required by Federal law or regulation, a State shall obligate and expend block grant funds in accordance with the laws and procedures applicable to the obligation and expenditure of its own funds... The Financial Management and Reporting section of the US Department of Health and Human Services' LIHEAP Supplemental Terms and Conditions states, in part: 8. Obligation Deadline: The two-year funding (project) period for this award is concurrent with the obligation period: from the first day of the FFY for which these funds were awarded through the last day of the following FFY. (i.e., October 1, FFY 1 through September 30, FFY 2.) . . . Any federal funds not obligated by the end of the two-year obligation period will be recouped by the Department. 9. Liquidation Deadline: According to 45 CFR §96.30(a), all properly obligated federal funds issued under this award must be liquidated in accordance with the recipient’s own fiscal control and funds control procedures. If the recipient requires more than 1 year from the project period end date to liquidate allowable costs, it shall notify the Grants Management Officer identified on its latest Notice of Award. The notification shall include the reason for the delay and the anticipated timeframe for liquidation. Any federal funds from this award not liquidated by the date required under the recipient’s own fiscal control procedures, which may not exceed five years following the fiscal year of award, will be recouped by this Department. During the audit period, the Department disbursed approximately $167.2 million in LIHEAP funds to eligible entities on behalf of eligible low-income households to help reduce costs associated with home energy bills, weatherization, and minor energy-related home repairs. The Department had various controls in place over the LIHEAP expenditure process; however, these controls did not prevent or detect the Department’s non-compliance with the program’s period of performance requirements. As a result, the Department did not obligate 12 administrative expenditures, totaling $26,107, by the close of the period of performance dates of September 30, 2023 and 2024. Funds were obligated outside the period of performance’s end date, ranging from 45 to 593 days past the required end date, averaging 425 days. Additionally, the Department did not liquidate $8,470 in LIHEAP funds within one year from the project period end date and did not properly notify the U.S. Department of Health and Human Services. Of the $8,470 improperly liquated expenditures, $780 was properly obligated and an allowable program expenditure; therefore, $7,690 will be questioned costs and is included in the obligation amount previously noted. As such, we will question these costs totaling $26,107. Failure to obligate funds and properly disclose necessary expenditures to the federal grantor agency in the required time frames could result in repayment, reduction of future federal funding, or sanctions imposed by the federal grantor agency. Based on discussion with management, the late obligation of these expenditures and failure to properly notify the federal grantor agency was a result of management oversight. We recommend the Department evaluate its current policies and procedures relating to the processing of LIHEAP expenditure transactions and update them, as necessary, to reasonably ensure compliance with period of performance requirements. The Department should consider performing interim and periodic reviews of LIHEAP subaward and expenditure activity in advance of the obligation end dates to ensure the federal awards are obligated within the required time frames. The Department should also evaluate liquidation timelines for notifications to the appropriate Federal contact, as needed. Management should periodically monitor these procedures to ensure they are operating effectively and as intended.

CORONAVIRUS STATE AND LOCAL FISCAL RECOVERY FUNDS – SUBRECIPIENT MONITORING Finding Number: 2025-004 State Agency Number: DEV-02 Assistance Listing Number and Title: 21.027 COVID-19 – Coronavirus State and Local Fiscal Recovery Funds (SLFRF) Federal Award Identification Numbers / Years: SLFRP2610 / 2021 SLFRP0130 / 2021 Federal Agency: Department of Treasury Compliance Requirement: Subrecipient Monitoring Repeat Finding from Prior Audit? Yes Prior Audit Finding Number: 2024-005 NONCOMPLIANCE AND MATERIAL WEAKNESS 2 C.F.R. § 1000.10 gives regulatory effect to the Department of Treasury for 2. C.F.R. § 200.332, which establishes requirements over subawards for pass-through entities and states: All pass-through entities must: . . . (e) Monitor the activities of a subrecipient as necessary to ensure that the subrecipient complies with Federal statutes, regulations, and the terms and conditions of the subaward. The pass-through entity is responsible for monitoring the overall performance of a subrecipient to ensure that the goals and objectives of the subaward are achieved. In monitoring a subrecipient, a pass-through entity must: (1) Review financial and performance reports. (2) Ensure that the subrecipient takes corrective action on all significant developments that negatively affect the subaward. Significant developments include Single Audit findings related to the subaward, other audit findings, site visits, and written notifications from a subrecipient of adverse conditions which will impact their ability to meet the milestones or the objectives of a subaward. When significant developments negatively impact the subaward, a subrecipient must provide the pass-through entity with information on their plan for corrective action and any assistance needed to resolve the situation. . . . It is management’s responsibility to design and implement internal control procedures over subrecipient monitoring to ensure federal funds are being spent for allowable purposes and in accordance with program requirements. It is also management’s responsibility to monitor these control procedures to ensure they are operating effectively and as intended. During state fiscal year 2025, the Department expended approximately $389.5 million in subawards to SLFRF subrecipients. The Department created several subprograms for various development and community-related activities as part of the SLFRF program. The subrecipients of these subprograms were required to submit a quarterly program report which includes data on projects funded, expenditures, contracts, and subawards equal to or greater than $50,000, to the Department through the Salesforce System. The Department’s Community Services Division oversees the Water Sewer Quality program and did not obtain the required quarterly program reports 13 out of 23 (56.5%) subrecipients selected for testing. Further, the Community Services Division did not have a process in place to follow-up with its subrecipients to obtain the missing program reports for a majority of the audit period [until April 2025]. Without adequate procedures in place to collect program reports from subrecipients to monitor compliance with federal statutes, laws, and regulations, there is an increased risk subrecipients may misuse federal funds for unauthorized purposes. This could lead to fines, penalties, or repayment of program funds being imposed by the federal grantor agency. Based on discussions with management, the lapse in monitoring was caused by employee turnover, slowing the monitoring of subrecipient’s report submissions. We recommend the Department develop and re-evaluate its internal control procedures to ensure all subprograms and subrecipients are adequately monitored for program compliance. We also recommend the Department evaluate existing control procedures to reasonably ensure the quarterly program reports submitted through the Salesforce System are timely, accurate, and complete. These procedures should be adequately documented and maintained to ensure the internal controls are in place and operating as management intended. Management should periodically monitor these procedures to ensure they are working as intended.

CORONAVIRUS STATE AND LOCAL FISCAL RECOVERY FUNDS – REPORTING Finding Number: 2025-005 State Agency Number: DEV-03 Assistance Listing Number and Title: 21.027 COVID-19 – Coronavirus State and Local Fiscal Recovery Funds (SLFRF) Federal Award Identification Numbers / Years: SLFRP2610 / 2021 SLFRP0130 / 2021 Federal Agency: Department of Treasury Compliance Requirement: Reporting Repeat Finding from Prior Audit? Yes Prior Audit Finding Number: 2024-006 NONCOMPLIANCE AND MATERIAL WEAKNESS 31 C.F.R. § 35.4(c) related to reporting for pandemic relief funds states, in part, Reporting and requests for other information. During the period of performance, recipients shall provide to the Secretary periodic reports providing detailed accounting of the uses of funds, modifications to a State or Territory’s tax revenue sources, and such other information as the Secretary may require for administration of this section. In addition to regular reporting requirements, the Secretary may request other additional information as may be necessary or appropriate, including as may be necessary to prevent evasions of the requirements of this subpart. . . . It is management’s responsibility to design and implement control policies and procedures to reasonably ensure the federal reports they submit are accurate, complete, and in compliance with program requirements. Management is also responsible for ensuring internal controls over reporting are operating effectively and as intended. During state fiscal year 2025, the Department expended approximately $510.2 million in SLFRF program expenditures. To facilitate this spending, the Department created several subprograms for various development and community-related activities which are administered by various divisions/officed within the Department. During the audit period, the Department was responsible for compiling SLFRF program activity for these subprograms and submitting it to the Ohio Office of Budget and Management (OBM) which compiled and submitted the quarterly Performance and Expenditure Reports to the Department of Treasury on behalf of the State of Ohio for all SLFRF activities. The Department’s Community Services Division was responsible for compiling and submitting the Water Sewer Quality subprogram’s quarterly Performance and Expenditure Reports. The Department’s Governor’s Office of Appalachia contracted with a vendor to compile the reports for the ARPA Appalachian Community Grants subprogram and the Department’s Finance Division submitted it to OBM. All other SLFRF subprogram reports were compiled and submitted by the Department’s Finance Division. Prior to submission, each report goes through a multilevel review and certification process at the Department to ensure program descriptions, narratives, and amounts are accurate and align with federal expenditure categories. However, four of 11 (36.4%) quarterly Project and Expenditure Reports selected for testing were not mathematically accurate and did not agree to support used in the reports submitted to OBM. Failure to accurately report financial and programmatic information submitted to the federal grantor agency could result in federal funds being reduced, taken away, or other sanctions imposed by the federal grantor agency. Based on discussions with management, the reporting issues identified were caused by employee turnover experienced during the audit period. We recommend the Department evaluate and strengthen internal controls over its reporting process to reasonably ensure the information presented in the quarterly Performance and Expenditure Reports is current, accurate, and complete and agrees to support prior to submission to OBM. Management should periodically monitor these procedures to ensure they are working as intended. Lastly, we recommend the Department cross train employees so in the event of turnover or extended leave, the reporting process can continue without disruption or delays.

4. LOW-INCOME HOME ENERGY ASSISTANCE PROGRAM – REPORTING Finding Number: 2025-006 State Agency Number: DEV-04 Assistance Listing Number and Title: 93.568 Low-Income Home Energy Assistance Program (LIHEAP) Federal Award Identification Numbers / Years: 2401OHLIEI / 2024 2401OHLIEA / 2024 Federal Agency: Department of Health and Human Services Compliance Requirement: Reporting Repeat Finding from Prior Audit? No NONCOMPLIANCE AND MATERIAL WEAKNESS 45 C.F.R. § 96.30 (b) states, in part: . . . After the close of each statutory period for the obligation of block grant funds and after the close of each statutory period for the expenditure of block grant funds, each grantee shall report to the Department: (i) Total funds obligated and total funds expended by the grantee during the applicable statutory periods; and (ii) The date of the last obligation and the date of the last expenditure. State recipients are required to submit the LIHEAP Performance Data Form, an annual report in response to Section 2610(b) of the LIHEAP statute (42 U.S.C. § 8629(b)). The LIHEAP Performance Data Form consists of the following modules: • Module 1 (Grant Recipient Survey) collects LIHEAP data on sources and uses of funds, average benefits, and maximum income cutoffs for four-person households for each type of LIHEAP assistance provided . . . • Module 2 (Performance Measures) collects LIHEAP data on energy burden targeting, the restoration of home energy service, and the prevention of loss of home energy . . . • Module 3 (Optional Performance Measures) allows state LIHEAP grant recipients . . . to voluntarily report additional LIHEAP data on energy burden targeting, the restoration of home energy service, and the prevention of loss of home energy service . . . It is management’s responsibility to implement control policies and procedures to reasonably ensure federal reports submitted are accurate, complete, and in compliance with program requirements. It is imperative management maintain the underlying data and related program documentation used to prepare and support these reports. The Department's Finance Division is responsible for preparing and submitting the SF-425, Federal Financial Reports for the LIHEAP program. Although the Finance Division has controls in place over the compilation and approval of the SF-425 Financial Reports, two of three (67.7%) SF-425 reports erroneously included three additional months of financial transactions past the reporting period end date. The inclusion of the additional data resulted in mathematical inaccuracies throughout both reports. Additionally, the Department’s Office of Community Assistance is responsible for preparing and submitting the LIHEAP Performance Data Form to HHS. Although the Office of Community Assistance has controls in place over the preparation and approval of the LIHEAP Performance Data Form, the form was not mathematically accurate and did not trace to supporting documentation. The Office of Community Assistance understated the All Funds Carried Over from Previous Federal Fiscal Years amount by $5,994,888. The amount was reported as $4,380,858, but should have been reported as $10,375,746. Reporting inaccurate and/or incomplete information could subject the Department to federal sanctions, limiting the amount of funding for program activities. This also increases the risk that those using these reports could be relying on inaccurate information. Based on discussion with management, the inaccurate reporting was caused by management oversight when compiling these reports. We recommend the Department re-evaluate and strengthen existing internal control procedures or implement additional procedures, as necessary, to provide management reasonable assurance that the financial information and/or performance data being reported to the federal government is accurate and traces to supporting documentation. Management should periodically review these procedures to ensure they are operating as intended.

LOW-INCOME HOME ENERGY ASSISTANCE PROGRAM – TRANSPARENCY ACT REPORTING Finding Number: 2025-007 State Agency Number: DEV-05 Assistance Listing Number and Title: 93.568 Low-Income Home Energy Assistance Program (LIHEAP) Federal Award Identification Numbers / Years: 2301OHLIEE / 2023 2401OHLIEE / 2024 2401OHLIEA / 2024 2501OHLIEA / 2025 Federal Agency: Department of Health and Human Services Compliance Requirement: Reporting Repeat Finding from Prior Audit? Yes Prior Audit Finding Number: 2024-003 NONCOMPLIANCE AND MATERIAL WEAKNESS The Federal Funding Accountability and Transparency Act (Pub. L. No. 109-282, as amended by Section 6202 of Public Law 110-252, hereafter referred as the “Transparency Act” that are codified in 2 C.F.R. Part 170) requires prime recipients of federal awards who make first-tier subawards to report the subaward on the Federal Funding Accountability and Transparency Subaward Reporting System (FSRS portal or SAM.gov) website maintained by the federal Office of Management and Budget. Under the requirements of 2 C.F.R. Part 170, recipients (i.e., direct recipients) of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more on the FSRS portal or SAM.gov website. Prime recipients must report by the end of the month following the month in which the obligation is made. It is management’s responsibility to design and implement internal controls to reasonably ensure compliance with laws and regulations and to ensure management’s objectives are achieved. The State of Ohio is considered the prime recipient for federal funds applicable to Transparency Act reporting and the state agencies receiving these federal funds are expected to report the subawards obligated in accordance with the Transparency Act. During the audit period, the Department obligated approximately $120.5 million for 293 LIHEAP first-tier subawards that exceeded $30,000 and were required to be reported on the FSRS portal or SAM.gov website in accordance with the Transparency Act. The Department’s Finance Division manages the Transparency Act reporting for all applicable programs. Monthly, the Finance Division obtains information about the subgrants required to be reported or updated on the FSRS portal or SAM.gov website from an automated monthly encumbrance report. Once prepared, the identified subawards are entered into the FSRS portal or SAM.gov website, the month following the obligation date of the subaward. Each month the Finance Division reconciles the subawards reported to the Department’s internal reports to ensure accuracy, completeness, and timeliness of subawards reported. Although the Department had various controls in place over the Transparency Act reporting, the following errors were noted: Transactions Tested Subaward not reported Report not timely Subaward amount incorrect Subaward missing key elements 45 15 45 0 16 Dollar Amount of Tested Transactions Subaward not reported Report not timely Subaward amount incorrect Subaward missing key elements $16,858,197 $4,152,190 $16,858,197 $0 $4,383,851 By not complying with Federal Transparency Act reporting requirements, the Department risks federal funding being reduced, taken away, or other sanctions imposed by the federal grantor agency. If the subawards are not reported accurately and timely within FSRS portal or SAM.gov website, the risk exists that those using the Transparency Reports could be relying on inaccurate information. Based on discussions with management, this was caused by difficulties experienced when transitioning the transparency act reporting to SAM.gov and staffing shortages within the Department. We recommend the Department continues to evaluate its internal controls over the SAM.gov reporting process [as of March 8, 2025] by collecting and reporting complete, accurate, and timely information regarding the subawards subject to the Transparency Act. We also recommend the Department cross-train employees over the LIHEAP Transparency Act reporting process to ensure the SAM.gov reporting can be performed by various personnel during vacations or with employee turnover. Management should periodically review these procedures to ensure they promote compliance with federal regulations and are operating as intended.

1. SUMMER EBT – INELIGIBLE STUDENTS Finding Number: 2025-008 State Agency Number: DEW-01 Assistance Listing Number and Title: 10.646 – Summer Electronic Benefits Transfer Program for Children (Summer EBT) Federal Award Identification Numbers / Years: 242OH102N1175 / 2024 252OH102N1175 / 2025 Federal Agency: Department of Agriculture Compliance Requirement: Eligibility Repeat Finding from Prior Audit? No QUESTIONED COSTS, NONCOMPLIANCE, AND MATERIAL WEAKNESS 7 C.F.R. 292.5, General purpose and scope, states in part: (a) Summer EBT eligibility is based on the eligibility standards for the NSLP/SBP [National School Lunch Program/School Breakfast Program], which includes children who are income eligible for free or reduced-price school meals based on income . . . and in accordance with the household size and income standards for free and reduced price school meals, and children who are categorically eligible. . . . (b) The Income Eligibility Guidelines are published annually and change on July 1. The guidelines in effect on the date of application must be used to determine eligibility. 7 C.F.R. 292.6, Eligibility states, in part: Children eligible for Summer EBT include those who, at any time during the period of eligibility, are: (a) School-aged and categorically eligible. (b) Enrolled in an NSLP/SBP-participating school, except for special provision schools, and: (1) Categorically eligible; (2) Meet requirements to receive free or reduced price meals . . . (3) Otherwise are determined eligible to receive a free or reduced price meal; or (4) Determined eligible through a Summer EBT application, consistent with § 292.13. (c) Enrolled in a special provision school, and: (1) Categorically eligible; (2) Otherwise meet the requirements to receive free or reduced price meals at § 292.5(a), as determined through an NSLP/SBP application; or (3) Determined eligible through a Summer EBT application, consistent with § 292.13 The Summer EBT 2025 iPOM [Interim Plan for Operations Management] and POM Template states, in part: 6. Eligibility . . . 6.3. For the purposes of streamline certifying children without matching to NSLP enrollment lists, provide the State’s legal ages of compulsory school enrollment . . . Minimum age: 6 Maximum age: 18 Applications/systems must be properly designed to achieve the business and IT goals of the organization. External factors affecting eligibility must be appropriately considered and properly evaluated to ensure eligibility for benefits is properly determined, and appropriate updates to eligibility are made when applicable. Data integrity in transit provides assurance that data remains complete, accurate, consistent, and unaltered while moving between systems. Data Integrity in transit controls such as cryptographic hashes, control totals, and checksums provide assurance that data sent from one system arrives at the destination completely, unchanged, and uncorrupted. During the audit period, the Ohio Department of Job and Family Services (JFS), as the prime recipient of the Summer EBT program, disbursed approximately $265.7 million in program benefits on behalf of eligible students. The Summer EBT program provides benefits to children who lose access to free and reduced-price meals through NSLP and SBP during the summer when school is not in session. The application process for Summer EBT benefits includes the completion and filing of an application form, verification of student enrollment, and verification of household income upon request. In addition to using information supplied by the household, the Summer EBT program may use data from other state agencies to verify the household’s identity, income, and other eligibility criteria. The State of Ohio uses a multi-agency approach for identifying eligible students of the Summer EBT program by obtaining and consolidating eligibility data for the Supplemental Nutrition Assistance Program (SNAP), Temporary Assistance for Needy Families (TANF), and Medicaid programs to assist in determining a child’s eligibility for benefits based on participation in these other federal programs and an application is not required. SNAP and TANF eligibility data from the State’s eligibility determination system, Ohio Benefits, is provided to the Ohio Department of Education and Workforce’s (the Department or DEW) Management Council (MC) in one data file prepared by a JFS vendor and additional files are provided throughout the audit period containing newly eligible students. NSLP/SBP free and reduced-price list data is sent to the MC by the school districts, in which the School IT Consortiums and Education Management Information System assist these schools in compiling and maintaining the data. Then the Ohio Department of Medicaid (MCD) compiles the Medicaid eligibility data, consisting of income and parental data, and demographic data from the Medicaid Information Technology System, Ohio Benefits, and the Member Months data mart and provides the Summer EBT dataset to the MC. The MC is responsible for combining these data files for every student, sorting the information by student name and program and identifying the student’s eligibility for the 2025 Summer EBT program by the following order: (1) SNAP, (2) TANF, (3) NSLP/SBP, (4) Medicaid, and (5) new application. However, for the 2024 Summer EBT program, the NSLP/SBP and Medicaid programs were reversed. If a student is listed multiple times (e.g., first name, last name, gender, and date of birth all agree), duplicates listed in the lower-level source of data will be removed (i.e., if eligible for (1) SNAP, any eligibility record for TANF, NSLP/SBP, or Medicaid, etc. will be removed. Although JFS, DEW, and MCD had controls in place to review program eligibility, the following items were noted: • Data Integrity in transit controls were not in place to help ensure the accuracy, completeness, and integrity of eligibility data provided to the MC by JFS or MCD via the secure file transfer protocol. • DEW’s MC had controls in place to review and verify the student data submitted by the local school districts to ensure the total student count and the number of eligible students submitted were accurate and complete, however, as indicated by the issues noted below, these controls were not operating effectively. o A school district inadvertently certified every enrolled student as eligible to receive Summer EBT benefits during state fiscal year 2025. After notifying DEW of this issue, the Department identified two additional school districts had also certified every student as eligible for the program. In total 5,349 students from these three school districts, totaling $641,880, were issued a Summer EBT card. JFS was able to successfully recoup $367,423 in ineligible funding and the remaining $274,457 had already been spent and therefore unrecoverable. JFS took action to mitigate the impact of the over issuance of funding and made arrangements with Food and Nutrition Services to repay the amounts incorrectly issued. o For seven of 44 (15.9%) students selected for eligibility testing, the students were deemed eligible for Summer EBT benefits based on data provided by MCD; however, these students did not meet the school-age requirements of six to 18 years of age to qualify for benefits. All seven students were five years old and did not qualify for the NSLP/SBP free or reduced price lunch as of the end of the 2024 Summer EBT program. Upon further inquiry, it was determined this issue was isolated to payments made in September 2024 and for students deemed eligible based on the MCD data in which students younger than six years old were included in the data set. As such, there were 54,226 students who received 2024 Summer EBT benefits in September 2024 that did not meet the school-age requirement of six years of age resulting in questioned costs totaling $6,511,920. o For one of 44 (2.3%) students selected for eligibility testing, the student was not eligible for SNAP, TANF, NSLP/SBP, or Medicaid and should not have received any Summer EBT benefits. Upon further investigation, it was determined the student did not utilize the Summer EBT card and the funding expired. Students have 122 days to utilize the Summer EBT benefits and JFS removes the remaining funds from the card after 122 days. As such, we will not be questioning costs since the Summer EBT benefits were not used. By not providing data integrity in transit controls, there is an increased risk of unauthorized changes to data, loss or corruption of data, and the overall integrity of the data while moving between systems. Overpayments to or on behalf of ineligible students may subject the State to penalties or sanctions which may jeopardize future funding and limit its ability to fulfill program requirements to provide benefits to those in need. Based on discussions with the various state agencies, these data integrity issues were caused by an oversight. The Department received data from the school districts which included current enrollment, students who withdrew or registered but never attended which impacted the count of students and increased the risk of not identifying errors before deeming students eligible for the Summer EBT program. The eligibility issues were caused by the school district not being aware of or understanding the end date for the summer operational period and the Medicaid data set not being restricted to individuals meeting the school-age requirements of six to 18 years old for the applicable Summer EBT program. We recommend the Departments responsible for transferring eligibility data to develop and implement data integrity in transit controls to ensure the validation and completeness of data and to identify any unauthorized changes, loss, or corruption of data. These data integrity in transit controls could be completed through an automated validation script or system functions to verify completeness of the data. We recommend the Department and MC reinforce the eligibility requirements of the Summer EBT program to the partner agencies to ensure only school-age students are included in the data provided to the MC. We also recommend the Departments re-evaluate internal controls over the Summer EBT program’s eligibility determinations to ensure only eligible students are receiving benefits. These procedures should include the MC verifying the accuracy and completeness of student data submitted by the local school districts prior to disbursing the Summer EBT benefits. Also, DEW/the MC should regularly communicate the eligibility requirements to the school districts and expand the data fields to include the date each student was determined eligible for NSLP/SBP to help ensure only eligible students are approved to receive Summer EBT benefits.

2. CHILD NUTRITION CLUSTER – TRANSPARENCY ACT REPORTING Finding Number: 2025-009 State Agency Number: DEW-02 Assistance Listing Numbers and Titles: 10.553 School Breakfast Program 10.555 National School Lunch Program 10.556 Special Milk Program for Children 10.559 Summer Food Service Program for Children 10.582 Fresh Fruit and Vegetable Program Federal Award Identification Numbers / Years: 242OH062N1099 / 2024 242OH062N1199 / 2024 252OH062N1099 / 2025 252OH062N1199 / 2025 Federal Agency: Department of Agriculture Compliance Requirement: Reporting Repeat Finding from Prior Audit? Yes Prior Audit Finding Number: 2024-010 NONCOMPLIANCE AND MATERIAL WEAKNESS The Federal Funding Accountability and Transparency Act (Pub. L. No. 109-282, as amended by Section 6202 of Public Law 110-252, hereafter referred as the “Transparency Act” that are codified in 2 C.F.R. Part 170) requires prime recipients of federal awards who make first-tier subawards to report the subaward on the Federal Funding Accountability and Transparency Subaward Reporting System (FSRS portal or SAM.gov) website maintained by the federal Office of Management and Budget. Under the requirements of 2 C.F.R. Part 170, recipients (i.e., direct recipients) of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more on the FSRS portal or SAM.gov website. Prime recipients must report by the end of the month following the month in which the obligation is made. It is management’s responsibility to design and implement internal controls to reasonably ensure compliance with laws and regulations and to ensure management’s objectives are achieved. The State of Ohio is considered the prime recipient for federal funds applicable to Transparency Act reporting and the state agencies receiving these federal funds are expected to report the subawards obligated in accordance with the Transparency Act. During the audit period, the Ohio Department of Education and Workforce (the Department) disbursed approximately $692.6 million to 1,156 subrecipients for the Child Nutrition Cluster whose reimbursements were required to be reported on the FSRS portal or SAM.gov website in accordance with the Transparency Act. The Child Nutrition Cluster is an entitlement grant as opposed to a subaward, as a result, funds are not obligated in the same manner as subawards. The Department developed a new process for collecting the grant information to be reported; however, the new process was not implemented during the audit period. Consequently, the Department had no control procedures in place to ensure the Child Nutrition Cluster’s payments were accurately entered into the FSRS or SAM.gov website for the School Breakfast Program and National School Lunch Program. As a result, the following errors were noted: School Breakfast Program Transactions tested Subaward not reported Report not timely Subaward amount incorrect Subaward missing key elements 1,057 1,057 0 0 0 Dollar amount of tested transactions Subaward not reported Report not timely Subaward amount incorrect Subaward missing key elements $180,668,373 $180,668,373 $0 $0 $0 National School Lunch Program Transactions tested Subaward not reported Report not timely Subaward amount incorrect Subaward missing key elements 1,156 1,156 0 0 0 Dollar amount of tested transactions Subaward not reported Report not timely Subaward amount incorrect Subaward missing key elements $511,909,695 $511,909,695 $0 $0 $0 A lack of effective internal controls over the preparation and review of reports increases the risk of these reports being inaccurate and incomplete when submitted to the federal grantor agency. By not complying with federal Transparency Act reporting requirements, the Department risks federal funding being reduced, taken away, or other sanctions imposed by the federal grantor agency. If the payments are not reported within FSRS portal or SAM.gov website, the risk exists that those using the Transparency Reports could be relying on inaccurate information. Based on discussions with management, this was caused by the necessity to review the information available and determine what data should be reported as part of the Transparency Act Reporting requirements. Also, there were delays in getting access to the FSRS portal and SAM.gov and missing several unique entity identifiers for many of the subrecipients. We recommend the Department design and implement internal controls over its Transparency Act reporting to ensure the accuracy and completeness of expenditures entered on the SAM.gov website [as of March 8, 2025] for every program within the Child Nutrition Cluster. These procedures should include a supervisory review of the report information collected before it is submitted within the SAM.gov website. Management should periodically review these control procedures to ensure they are operating as intended.

1. CWSRF & DWSRF – LOAN PAYMENT MONITORING Finding Number: 2025-010 State Agency Number: EPA-01 Assistance Listing Numbers and Titles: 66.458 Clean Water State Revolving Fund (CWSRF) 66.468 Drinking Water State Revolving Fund (DWSRF) Federal Award Identification Numbers / Years: DWSRF 98595421 / 2021 DWSRF 00E03243 / 2022 DWSRF 00E03332 / 2022 DWSRF 01E03243 / 2023 DWSRF 01E03332 / 2023 DWSRF 02E03246 / 2024 DWSRF 98595424 / 2024 CWSRF 00E03331 / 2022 CWSRF 01E03331 / 2023 CWSRF 02E03345 / 2024 CWSRF 00E03345 / 2024 Federal Agency: Environmental Protection Agency Compliance Requirements: Activities Allowed or Unallowed, Allowable Costs / Cost Principles, Cash Management, Matching, Level of Effort, Earmarking and Period of Performance Repeat Finding from Prior Audit? Yes Prior Audit Finding Number: 2024-011 MATERIAL WEAKNESS It is management’s responsibility to design and implement an internal control structure capable of providing reasonable assurance that objectives are being achieved. As the prime recipient of federal funds awarded through the CWSRF and DWSRF programs, the Agency must implement internal controls that reasonably ensure amounts paid to borrowers (usually local government agencies), through the Ohio Water Development Authority (OWDA), are processed accurately, completely, and in compliance with the applicable federal laws and regulations. During the audit period, the Agency expended approximately $156.9 million in federal funds for the CWSRF program and approximately $125.1 million in federal funds for the DWSRF program to borrowers, providing low interest financing for costs associated with the planning, design, and construction of eligible clean and drinking water projects and activities to protect human health. Ohio Rev. Code (ORC) § 6111.036 requires the Agency and OWDA to share responsibility for the management of the program. An interagency agreement between the Agency and OWDA establishes the responsibilities to be performed by each agency, including assigning OWDA the authority to make payments to program recipients in accordance with the approved loan agreement and the disbursement protocol. Prior to providing funding for a project, the Agency enters into a loan agreement with the borrower and prepares a disbursement protocol agreement, which establishes the eligible costs and source of funds for the project. After receiving invoices for construction projects, the borrower completes the electronic Fund Payment Request form (FPR) via OWDA’s website. OWDA reviews the FPR for reasonableness and compliance with the loan agreement, approves the FPR, disburses the funds to the borrower, and forwards the documentation to the Agency. Agency coordinators review the documentation to ensure the disbursement was allowable under the grant requirements and saves a copy of the FPR and supporting documentation in the Assistance Information Management System (AIMS). Although the Agency maintains a written procedure stating this review should be performed within 45 days of the disbursement made by OWDA and should be performed for 70% of the disbursement vouchers it appears the written procedure was inconsistently applied and the following items were noted: • For three of four (75%) quarters selected for testing, the Agency did not maintain evidence that management was monitoring procedures to ensure 70% of disbursement voucher reviews were completed. • For 11 of 60 (18.3%) CWSRF disbursements selected for testing, the disbursements were not reviewed within 45 days in AIMS; the disbursements were reviewed three to 192 days after payment, averaging 35 days late. • For ten of 60 (16.7%) DWSRF disbursement selected for testing, the disbursements were not reviewed within 45 days in AIMS; the disbursements were reviewed 12 to 146 days after payment, averaging 64 days late. Additionally, the Agency completes quarterly reconciliations over CWSRF and DWSRF program revenues and expenditure activity, by examining internal records maintained for disbursements, transfers, and grant balances, OWDA records, and bank statements. The completed reconciliation spreadsheet is reviewed and approved by the Agency’s Chief Financial Officer. Although the Agency completed the quarterly reconciliations during the audit period, four of eight (50%) reconciliations tested for both programs were not completed and reviewed timely, ranging from three days to 135 days after the end of the quarter, for an average of 70 days. Without performing timely reviews of invoices and FPRs submitted for reimbursement by the borrower or performing other monitoring activities, the Agency cannot be reasonably assured OWDA’s review process ensured payments made to borrowers were accurate and for allowable activities. If the Agency does not perform timely reviews, there is an increased risk that noncompliance will not be identified in a timely manner. As a result, there is a risk federal funding will be reduced or withdrawn, or other sanctions will be imposed by the federal grantor agency. Additionally, without performing timely reconciliations between the Agency’s internal records and bank statements and subsequently investigating and resolving any significant differences noted, there is an increased risk that decisions are based off miscoded or inaccurate account balances. Through discussions with management, the Agency did not implement any monitoring tools until after the prior year comment was communicated. The Agency also updated its policies and procedures, but these policies did not reflect the process followed by Agency personnel. We recommend management evaluate existing policies regarding disbursement reviews and reconciliations and update them as necessary, to ensure the monitoring procedures performed match up to what is documented in their policy manual. Management should evaluate the transactions processed to identify areas of risk and other relevant criteria when designing the procedures regarding the Agency’s review of invoices received from OWDA. We also recommend management implement periodic monitoring procedures to ensure the disbursement review and reconciliation procedures are performed timely, consistently, and accurately. Auditor of State Conclusion: The response to this finding included within the State of Ohio Corrective Action Plan indicated the Agency disagreed as internal policies were followed as intended and appropriate controls were in place as of May 2025 which required an Auditor of State Conclusion. The Agency’s internal policy states, in part: “DEFA-OFA [Division of Environmental and Financial Assistance (DEFA) – Office of Financial Administration (OFA)] staff monitors these disbursements by performing a review of 70% of the disbursement vouchers for compliance with program requirements.” Furthermore, the internal policy states, in part: “Timely review is to be performed within 45 days of receipt [60 days of receipt beginning June 2025]…”. The Agency did not maintain documentation for three of four quarters, evidencing over 70% of all disbursement vouchers received in 2025 were reviewed within 45 days. Therefore, this finding remains as stated above.

UNEMPLOYMENT INSURANCE – IMPROPER PAYMENTS Finding Number: 2025-011 State Agency Number: JFS-01 Assistance Listing Number and Title: 17.225 – Unemployment Insurance Federal Award Identification Numbers / Years: UI-37243-22-55-A-39 / 2022 UI-39342-23-55-A-39 / 2023 24-A-55-UI000039 / 2024 25-A-55-UI000070 / 2025 Federal Agency: Department of Labor Compliance Requirements: Activities Allowed or Unallowed, Allowable Costs/Costs Principles, Eligibility Repeat Finding from Prior Audit? No QUESTIONED COSTS 2 C.F.R. § 2900.4 gives regulatory effect to the Department of Labor (DOL) for 2 C.F.R. § 200.1 which states, in part: Improper payment means a payment that should not have been made or that was made in an incorrect amount under statutory, contractual, administrative, or other legally applicable requirements. The term improper payment includes: any payment to an ineligible recipient; any payment for an ineligible good or service; any duplicate payment; any payment for a good or service not received, except for those payments where authorized by law; any payment that is not authorized by law; and any payment that does not account for credit for applicable discounts. . . . Ohio Rev. Code (ORC) § 4141.28 states, in part: . . . (B) APPLICATION FOR DETERMINATION OF BENEFIT RIGHTS . . . An individual filing an application for determination of benefit rights shall furnish proof of identity at the time of filing in the manner prescribed by the director. . . . ORC § 4141.29 states, in part: . . . (A) No individual is entitled to a waiting period or benefits for any week unless the individual: . . . (4)(a)(i) Is able to work and available for suitable work and, except as provided in division (A)(4)(a)(ii) or (iii) of this section, is actively seeking suitable work either in a locality in which the individual has earned wages subject to this chapter during the individual's base period, or if the individual leaves that locality, then in a locality where suitable work normally is performed. . . . ORC § 4141.30 states, in part: . . . (B) With the exceptions in division (B)(4) of this section, benefits are payable to each eligible and qualified individual on account of each week of involuntary total unemployment after the specified waiting period at the weekly benefit amount determined by: (1) Computing the individual's average weekly wage as defined in division (O)(2) of section 4141.01 of the Revised Code; (2) Determining the individual's dependency class under division (E) of this section; (3) Computing the individual's weekly benefit amount to be fifty percent of the individual's average weekly wage except, that the individual's weekly benefit amount shall not exceed the maximum amount shown for the individual's dependency class... . . . The federal government established rules, regulations, and requirements related to eligibility, benefit amounts and timing, monitoring responsibilities, etc. regarding Unemployment benefits. It is management’s responsibility to implement controls, processes, and procedures to provide reasonable assurance over the reliability of financial reporting, effectiveness and efficiency of operations, and compliance with these rules, regulations, and requirements. During state fiscal year 2025, the Department disbursed approximately $950.9 million in unemployment benefits through the Ohio Job Insurance (OJI) benefit system. Eligibility for unemployment benefits was determined within OJI based upon requirements outlined in state and/or federal laws. Weekly, claimants confirmed their unemployment status and completed the required work search activities. If the claimant’s benefit payment was flagged, an adjudicator performed an additional review and requested fact-finding information for either monetary or nonmonetary issues. The claimant continued to receive weekly benefit payments until the adjudicator investigated the issue and confirmed the claimant’s status. If an issue was suspected of fraud, the issue was routed to the Department’s Benefit Payment Control section to be investigated, adjudicated and, if applicable, an overpayment flag was created in OJI. The Department’s policy, which is based on U.S. Department of Labor guidance, is to adjudicate possible fraud cases within 21 days or 90 days, depending on the circumstances of the case. Although the Department had various controls in place over regular unemployment benefit payments, the OJI system requires the Adjudicators to manually enter a significant amount of data into the system. To pay an unemployment benefit claim, the Adjudicators may have to clear multiple issues identified in the system before the claim can be paid. Furthermore, there are no alerts indicating when a pending issue prevents a claim from being paid which can result in significant delays in the payments to the claimants. Additionally, these controls did not prevent or detect the following noncompliance errors, resulting in known questioned costs totaling $3,274. The likely questioned costs would be in excess of $25,000 and therefore required to be reported under 2 C.F.R. § 200.516: • For two of 25 (8%) regular unemployment benefit claims identified in an OJI system data match as potential unemployment claims processed more than 30 days after the claimant’s benefit year end, the claimant was not eligible to receive benefits for the weeks claimed, was overpaid, or was underpaid, as follows: • One claimant did not provide the necessary documents to prove their identity. The Claims Examiner cleared the identity verification issue in OJI; however, there is no documentation showing the claimant verified their identity. As a result, the claimant was overpaid benefits of $2,988 during the audit period. • Due to an OJI system issue at the time the claim was filed, the claimant’s dependency class designated did not agree with the information provided on the application. This resulted in an underpayment of $143. • For one of 25 (4%) regular unemployment benefit claims identified in an OJI system data match as potentially exceeding the maximum allowable amount, the claimant stated in the application a qualifying dependent. However, the Department denied the dependent without mailing an Eligibility notice to allow the claimant to prove the identity of the dependent. This resulted in the claimant potentially being underpaid $124 for the week reviewed. • For one of 60 (1.77%) regular unemployment benefit claims selected for testing, the claimant was not eligible to receive benefits for the week claimed per ORC 4141.29(A)(4)(a)(i). The claimant did not provide the necessary documents evidencing clearance to work, therefore, the claimant was ineligible for unemployment benefits. This resulted in an overpayment of $286 to the claimant. Without effective internal controls for the eligibility determination and benefit payment processes, including manual data entry or the lack of alerts indicating when a pending issue prevents a claim from being paid, there is an increased risk benefit payments will be inaccurate, unallowable, or eligibility determinations not being made in a timely manner. Overpayments to ineligible claimants may subject the Department to penalties or sanctions which may jeopardize future funding and limit its ability to fulfill program requirements to provide benefits to those in need. Based on discussions with management, these errors were due to oversight and system design flaws within OJI. We recommend Department management: • Evaluate and strengthen current internal control procedures over the Unemployment Insurance program to ensure claimants are eligible, receive the correct weekly benefits and system design flaws such as limiting manual data entry and developing alerts for pending issues that impact claims being paid timely. This should include evaluating the cause of the errors identified above and updating controls as necessary. • Periodically monitor the established controls to determine if they are working effectively and as intended. • Perform periodic reviews of the claimant files to reasonably ensure the information is properly maintained and accurately entered into the related systems. • Evaluate underpayments, overpayments and/or payments to ineligible claimants and offset future benefits or seek reimbursement, where necessary.

SNAP CLUSTER AND TANF – IEVS ALERTS Finding Number: 2025-012 State Agency Number: JFS-02 Assistance Listing Numbers and Titles: 10.551/10.561 – SNAP Cluster 93.558 – Temporary Assistance for Needy Families (TANF) Federal Award Identification Numbers / Years: 232OH102S2514 / 2023 (SNAP Cluster) 232OH102S6018 / 2023 (SNAP Cluster) 242OH102S2514 / 2024 (SNAP Cluster) 242OH102S6018 / 2024 (SNAP Cluster) 252OH102S2514 / 2025 (SNAP Cluster) 252OH102S6018 / 2025 (SNAP Cluster) 2301OHTANF / 2023 (TANF) 2401OHTANF / 2024 (TANF) 2501OHTANF / 2025 (TANF) Federal Agencies: Department of Agriculture Department of Health and Human Services Compliance Requirements: Special Tests and Provisions – Income Eligibility Verification System Repeat Finding from Prior Audit? Yes Prior Audit Finding Numbers: 2024-012 NONCOMPLIANCE AND MATERIAL WEAKNESS 7 C.F.R. § 272.8(c), states the following regarding the Supplemental Nutrition Assistance Program (SNAP) Cluster: (1) State agency action on information items about recipient households shall include: (i) Review of the information and comparison of it to case record information; (ii) For all new or previously unverified information received, contact with the households and/or collateral contacts to resolve discrepancies as specified in §§ 273.2(f)(4)(iv) and 273.2 (f)(9)(iii) and (f)(9)(iv); and (iii) If discrepancies warrant reducing benefits or terminating eligibility, notices of adverse action. (2) State agencies must initiate and pursue the actions on recipient households specified in paragraph (c)(1) of this section so that the actions are completed within 45 days of receipt of the information items. Actions may be completed later than 45 days from the receipt of information if: (A) The only reason that the actions cannot be completed is the nonreceipt of verification requested from collateral contacts; and (B) The actions are completed as specified in § 273.12 of this chapter when verification from a collateral contact is received or in conjunction with the next case action when such verification is not received, whichever is earlier. (3) When the actions specified in paragraph (c)(1) of this section substantiate an over issuance, State agencies must establish and take actions on claims as specified in §273.18 of this chapter. (4) State agencies must use appropriate procedures to monitor the timeliness requirements in paragraph (c)(2) of this section. 45 C.F.R. § 205.56(a)(1)(iv) states the following regarding the Temporary Assistance for Needy Families (TANF) program: For individuals who are recipients when the information is received or for whom a decision could not be made prior to authorization of benefits, the State agency shall within forty-five (45) days of its receipt, initiate a notice of case action or an entry in the case record that no case action is necessary, except that: Completion of action may be delayed beyond forty-five (45) days on no more than twenty (20) percent of the information items targeted for follow-up, if: (A) The reason that the action cannot be completed within forty-five (45) days is the nonreceipt of requested third-party verification; and (B) Action is completed promptly, when third party verification is received or at the next time eligibility is redetermined, whichever is earlier. If action is completed when eligibility is redetermined and third party verification has not been received, the State agency shall make its decision based on information provided by the recipient and any other information in its possession. As the lead agency responsible for administering the SNAP Cluster and TANF federal programs for the State of Ohio, the Department is responsible for providing reasonable assurance that only eligible individuals receive assistance and documentation maintained is accurate, complete, and properly recorded in the Ohio Benefits system to ensure appropriate eligibility determinations. It is the Department’s responsibility to implement sufficient controls, systems, processes, and procedures to reasonably ensure compliance with the rules and regulations associated with these programs and only eligible recipients receive benefits. When automated systems are utilized to perform certain functions related to this compliance requirement, management must ensure the system is properly designed and operating effectively. The Department is also responsible for overall program compliance and must have appropriate oversight and monitoring procedures in place to ensure those they rely on are operating in accordance with all expectations, guidelines, and requirements related to their tasks. As part of monitoring, the Department’s Fraud Control Section conduct Fraud Triad Reviews, which in part include a review of 1) Income Eligibility Verification System (IEVS) processing timeliness, 2) proper verifications, 3) proper disposition coding and 4) random supervisory reviews. The Fraud Control Section also conducts random reviews of cases with an IEVS alert to ensure they were cleared properly and timely, as well as monitor the JFSR 4005, IEVS Monthly Summary Report to track completion of IEVS alerts and to identify counties that need technical assistance. The SNAP Cluster and TANF federal programs are administered using a multi-agency approach: overall compliance and administration of the programs fall under the Department, and programming and administration of the State’s eligibility determination computer system, Ohio Benefits, falls under the Ohio Department of Administrative Services (DAS). The Department also utilizes the 88 Ohio County Departments of Job and Family Services (counties) in the eligibility determination process to work with applicants, receive/enter eligibility documentation into the Ohio Benefits system, and follow up on alerts issued by the system. The Ohio Benefits system was utilized for processing eligibility for the SNAP Cluster and TANF programs with total expenditures to recipients of approximately $3.2 billion and $210 million, respectively, during state fiscal year (SFY) 2025. The Ohio Benefits system contains the eligibility and benefit information/determinations for these programs, including the IEVS functionality which compares reported recipient income to income information maintained by outside data sources (Social Security Administration, Internal Revenue Service (IRS), etc.). Information that does not agree is communicated in the form of an Ohio Benefits system alert. The Ohio Benefits system then determines if the alert is a ‘match’ that requires action. The IEVS match, indicated by ‘Yes’ in the Ohio Benefits system, is forwarded to the appropriate county agency for investigation and resolution. Each match has a defined due date, which is unique based on the priority level and other policy and process related factors. However, we noted the following weaknesses: • Volume of Alerts – During SFY 2025, more than 16.9 million alerts (3.0 million IEVS alerts and 13.9 million non-IEVS alerts) were issued for all public assistance programs that utilize Ohio Benefits, including the SNAP Cluster and TANF programs. Alerts can be generated by Ohio Benefits via interface outputs/updates, batch outputs or other triggers within the system. However, the volume of incoming alerts being sent to the county caseworkers results in an increased workload and ineffective application of the alert process. • Caseworker Reliance/Training – The current process relies heavily on the knowledge and judgement of county caseworkers in the eligibility process, including reviewing IEVS matches. The Department utilizes its monitoring of the JFSR 4005, IEVS Monthly Summary Report to better identify those county agencies which require additional training and technical assistance. The Department also continues to conduct statewide trainings and individual trainings for county agencies to assist them in working IEVS alerts/matches; however, these trainings are typically optional and/or attended by a representative of the county agency who is expected to relay the information to others. Additionally, we noted the following noncompliance with federal regulations where IEVS alerts were not cleared timely. • Clearing Alerts – While the Department has controls and procedures in place to review and monitor IEVS alerts and matches generated and processed by the Ohio Benefits system, there were instances when matches were not being completed by the county agencies in accordance with the required timeframes established in 7 C.F.R. § 272.8, and 45 C.F.R. § 205.56. Furthermore, an Ohio Benefits data file containing IEVS matches showed 202,334 of the 376,492 (53.7%) IEVS alerts sent to the county agencies during the audit period were not cleared within 45 days as required. The matches were cleared between one and 433 days beyond the 45-day requirement, for an average of 131 days late. Failure to implement system enhancements timely, perform monitoring activities, mandate training for county caseworkers, and complete IEVS alerts within the established timeframes increases the risk benefits given to ineligible recipients or for inappropriate amounts will not be identified timely. This condition could adversely affect the Department’s ability to comply with IEVS requirements for these federal programs which could result in federal sanctions or penalties. Based on discussions with management, this was caused by the Department’s county administered approach creating challenges to making training mandatory. Training is continued to be offered and made available to county personnel. Further, management indicated they continue to work with DAS to monitor the system and enhancements to ensure they meet the desired impact of clearing alerts in a timely manner, as well as reach out to county and state personnel to offer technical assistance. However, the high volume of alerts presents difficulties to the caseworkers. We recommend Department management continue to work collectively with DAS to implement/update robust processes, procedures, and system controls to address the weaknesses associated with the IEVS process within the Ohio Benefits system. These changes/updates should include, but not be limited to: • Including a more centralized evaluation of alert/match activity and/or better use of automated tools to vet and prioritize items requiring follow-up at the county level. This would allow Department level personnel to become more experienced and adept at identifying and investigating anomalies and help focus the resources of both Department and county personnel. • Continuing to perform periodic and timely reviews of the JFSR 4005, IEVS Monthly Summary Report at the Department level to monitor the status and completion of IEVS matches, as well as identify areas of training for the counties. Such procedures should also include required monitoring by each County IEVS Coordinator or other supervisory personnel (through the eligibility system). The Department should clearly communicate the expectations for these monitoring procedures to the counties and implement procedures to ensure the counties are properly completing them, possibly as part of the Fraud Triad Reviews. • Requiring mandatory IEVS training for all county agency employees who are entering the assistance group information into Ohio Benefits to help ensure proper and complete information is being collected, entered, and verified prior to an individual’s eligibility determination being made. The Department should continue to provide this training initially to ensure all users are knowledgeable of the process, procedures, and impacts of the work they do. As changes occur to the rules/regulations, system, or process, detailed training should be required of all users on those changes. We also recommend the Department continue to monitor the IEVS alert processing procedures guide for the matches issued by the Ohio Benefits system to ensure matches are properly documented within the system, worked within the proper timeframes, and proper verification documentation is obtained and maintained by the county agencies for resolved matches.

1. MEDICAID CLUSTER/CHIP – INELIGIBLE RECIPIENTS Finding Number: 2025-013 State Agency Number: MCD-01 Assistance Listing Numbers and Titles: 93.767 – Children’s Health Insurance Program (CHIP) 93.767 COVID 19 – CHIP 93.775/93.777/93.778 – Medicaid Cluster 93.775/93.777/93.778 COVID-19 – Medicaid Cluster Federal Award Identification Numbers / Years: 2305OH5023 / 2023 (CHIP) 2405OH5024 / 2024 (CHIP) 2505OH5025 / 2025 (CHIP) 2305OH5MAP / 2023 (Medicaid Cluster) 2405OH5MAP / 2024 (Medicaid Cluster) 2505OH5MAP / 2025 (Medicaid Cluster Federal Agency: Department of Health and Human Services Compliance Requirements: Activities Allowed or Unallowed, Allowable Costs/Cost Principles, Eligibility Repeat Finding from Prior Audit? Yes Prior Audit Finding Number: 2024-014 QUESTIONED COSTS, NONCOMPLIANCE, AND MATERIAL WEAKNESS NOTE: Finding number 2025-014 details deficiencies and weaknesses in internal control related to the Medicaid Cluster and CHIP programs regarding the Department’s eligibility processes. That finding is integral to and should be read in conjunction with this finding. 42 C.F.R. § 435.10, State Plan requirements, pertaining to the Medicaid Cluster states, in part A. State plan must--- (a) Provide that the requirements of this part are met; and (b) Specify the groups to whom Medicaid is provided, as specified in subparts B, C, and D of this part, and the conditions of eligibility for individuals in those groups. 42 C.F.R. § 431.17, Maintenance of records, pertaining to the Medicaid Cluster states, in part: (b) Content of records. A State plan must provide that the Medicaid agency will maintain or supervise the maintenance of the records necessary for the proper and efficient operation of the plan. The records must include all of the following: (1) Individual records on each applicant and beneficiary that contain the following: (i) All information provided on the initial application submitted . . . on behalf of, the applicant or beneficiary, including the signature on the date of application. . . . (iii) The date of, basis for, and all documents or other evidence to support any determination, denial, or other adverse action, including decisions made at application, renewal, and as a result of a change in circumstance, taken with respect to the applicant or beneficiary, including all information provided by, or on behalf of, the applicant or beneficiary, and all information obtained electronically or otherwise by the agency from third-party sources. . . . (v) Any changes in circumstances reported by the individual and any actions taken by the agency in response to such reports. (vi) All renewal forms and documentation returned by, or on behalf of, a beneficiary, to the Medicaid agency in accordance with § 435.916 of this chapter, . . . . including the signature on the form and date received. . . . 42 C.F.R. § 435.916, Regularly scheduled renewals of Medicaid eligibility, states in part: (a) Frequency of renewals. . . (1) The eligibility of Medicaid beneficiaries not described in paragraph (a)(2) of this section must be renewed once every 12 months, and no more frequently than once every 12 months. (2) The eligibility of qualified Medicare beneficiaries described in section 1905(p)(1) of the Act must be renewed at last once every 12 months, and no more frequently than once every 6 months. (b) Renewals of eligibility – (1) Renewal on basis of information available to agency. The agency must make a redetermination of eligibility for all Medicaid beneficiaries without requiring information from the individuals if able to do so based on reliable information contained in the individual’s account or other more current information available to the agency, including but not limited to information through any data bases accessed by the agency . . . 42 C.F.R. § 435.912(c), Timely determination and redetermination of eligibility, states in part: (3) . . . the determination of eligibility for any applicant or individual whose account was transferred from another insurance affordability program may not exceed— (i) 90 calendar days for applicants who apply for Medicaid on the basis of disability; and (ii) 45 calendar days for all other applicants. 42 U.S.C. § 1397bb(b), pertaining to the Children’s Health Insurance Program (CHIP) states, in part: (1) Eligibility Standards (A) The plan shall include a description of the standards used to determine the eligibility of targeted low-income children for child health assistance under the plan. . . 42 C.F.R. § 457.380(d), Eligibility verification pertaining to CHIP states: Income. If the State does not accept self-attestation of income, the State must verify the income of an individual by using the data sources and following standards and procedures for verification of financial eligibility consistent with § 435.945(a), § 435.948, and § 435.952 of this chapter. 42 C.F.R. § 457.344, Changes in circumstances pertaining to CHIP, states in part: (a) Procedures for reporting changes. The agency must: (1) Have procedures designed to ensure that enrollees understand the importance of making timely and accurate reports of changes in circumstances that may affect their eligibility . . . (b) State action on information about changes . . . the State must promptly redetermine eligibility between regularly scheduled renewals of eligibility required under § 457.343, whenever it has reliable information about a change in an enrollee’s circumstances that may impact the enrollee’s eligibility for CHIP, the amount of child or pregnancy-related health assistance for which the enrollee is eligible, or the enrollee’s premiums or cost sharing charges. . . . (1) The State must redetermine eligibility based on available information, if possible. When needed information is not available, the State must request such information from the enrollee in accordance with § 435.952(b) and (c) of this chapter . . . Ohio Rev. Code § 5164.57(A)(1), Recovery of Medicaid Overpayments states, in part: . . . the department of medicaid may recover a medicaid payment or portion of a payment made to a medicaid provider to which the provider is not entitled if the department notifies the provider of the overpayment during the five-year period immediately following the end of the state fiscal year in which the overpayment was made. Ohio Admin. Code § 5160-26-02.1, Managed care: termination of enrollment states, in part: . . . (B) The Ohio department of medicaid (ODM) will terminate a member from enrollment in a managed care organization (MCO) for any of the following reasons: . . . (3) The member dies, in which case MCO enrollment ends on the date of death (D) All of the following apply when enrollment in an MCO or the SPBM [Single Pharmacy Benefit Manager] is terminated for any of the reasons set forth in paragraph (B) or (C) of this rule: . . . (5) ODM shall recover from the MCO or the SPBM any capitation paid for retroactive enrollment termination occurring . . . The Medicaid and CHIP State Plan outlines the specific eligibility conditions and standards within Sections 2.2 – Coverage and Conditions of Eligibility and 2.6 A – Financial Eligibility, Eligibility Conditions and Requirements for Medicaid, and Section 4 – Eligibility Standards and Methodology for CHIP. It is management’s responsibility to implement policies and procedures to provide reasonable assurance they have complied with these requirements. As the lead agency for administering the Medicaid Cluster and CHIP federal grant awards for the State of Ohio, the Department is responsible for providing reasonable assurance only eligible individuals receive assistance and the documentation maintained is accurate, complete, and properly recorded in the Ohio Benefits system to ensure appropriate eligibility determinations. It is also the Department’s responsibility to implement sufficient controls, systems, processes, and procedures to reasonably ensure compliance with the rules and regulations associated with these programs and only eligible recipients receive benefits. The Department is responsible for overall program compliance and must have appropriate oversight and monitoring procedures in place to ensure those they rely on are operating in accordance with all expectations, guidelines, and requirements related to their tasks. During state fiscal year (SFY) 2025, the Department disbursed a combined total of $29.6 billion in public assistance benefits to recipients processed through the Ohio Benefits system related to the following programs: Assistance Listing Number & Title Benefits Paid # of Recipients* 93.767 - CHIP $916,720,909 242,000 93.775/93.777/93.778 – Medicaid Cluster $28,653,789,593 2,646,003 Combined Total $29,570,510,502 2,888,003 * We did not separately identify recipients who could be covered under both programs. These programs are administered using a multi-agency approach, as follows: overall compliance and administration of the Medicaid Cluster and CHIP programs fall under the Department, and programming and administration of the State’s eligibility determination computer system, Ohio Benefits, falls under the Ohio Department of Administrative Services (DAS). The Ohio Benefits system contains the eligibility and benefit information/determinations for these programs. The Department also, through a Memorandum of Understanding with the Ohio Department of Job & Family Services (JFS), utilizes the 88 County Departments of Job & Family Services (CDJFS) in the eligibility determination process to work with applicants, receive/enter eligibility documentation into the Ohio Benefits system, and follow up on alerts issued by the system. Currently, individuals applying to receive public assistance benefits complete an application through various methods. The CDJFS collect and maintain any documentation provided by the individual either in a paper case file or in the OnBase Enterprise Documentation Management System (EDMS) maintained under contract by DAS and utilized by the Department. After collecting documentation, the county caseworker enters the individual’s information into the Ohio Benefits system which determines the initial eligibility benefit amount and assigns the benefit aid category, where applicable. This process is also used to perform eligibility redeterminations on an annual basis or when prompted through a system alert. Once the determination is made, the Ohio Benefits system uploads the eligibility information to the Department’s new Ohio Medicaid Enterprise System’s (OMES) Fiscal Intermediary (FI) to process the provider payments. The following noncompliance was noted related to eligibility for the Medicaid Cluster and CHIP programs, which included questioned costs for Medicaid totaling $2,384 and CHIP totaling $204,076: • One of 81 (1.2%) Medicaid recipients and six of 80 (7.5%) CHIP recipients selected for testing were not eligible to receive benefits on the date services were performed as they were not validly enrolled beneficiaries based on information in Ohio Benefits, the State’s official eligibility determination system. Therefore, these items will result in questioned costs for all claims paid for services provided for these individuals during the time they were ineligible, totaling $1,238 for Medicaid and $204,076 for CHIP. The items noted included issues such as: o The recipient failed to timely report an increase in income. o The wrong household size was utilized when determining eligibility; as a result, the recipient was over the income limit. • Three of 81 (3.7%) Medicaid recipients and seven of 80 (8.8%) CHIP recipients selected for testing were not placed in the correct benefit aid category. One of the three Medicaid recipients and six of the seven CHIP recipients were included in the first bullet and deemed ineligible for both programs. • One of 81 (1.2%) Medicaid recipients and seven of 80 (8.8%) CHIP recipients selected for testing did not have adequate documentation to support the Department's decision on the recipient’s eligibility, or incorrect information was entered into Ohio Benefits. The Medicaid recipient and six of the seven CHIP recipients were included in the first bullet and deemed ineligible for both programs. • One of 81 (1.2%) Medicaid recipients selected for testing was eligible during the date of service initially tested; however, during testing we identified questioned costs for Medicaid after the recipient’s date of death resulting in questioned costs totaling $1,146. • One of 13 (7.7%) CHIP recipients selected for testing with applications during the audit period did not have the initial eligibility determination completed within 45 days. ADDITIONAL QUESTIONED COSTS: The Ohio Benefits system is designed to generate alerts to notify the CDJFS caseworkers of a deceased match. The Department has 10 calendar days to process a re-determination when a change has been reported affecting a recipient’s ongoing eligibility. When the Department has been notified of a potential death of a recipient, the recipient is to be removed from managed care and placed in fee for service until confirmation of the death is received. An analysis of the Medicaid Cluster’s managed care capitation payments and the fee for service medical claims paid during SFY 2025 were compared to the death master file received from the Ohio Department of Health to identify any payments with a capitation month or date of service after the recipient’s date of death. The Department made 13,159 payments, totaling $2.5 million, on behalf of 2,165 deceased individuals receiving Medicaid benefits were included in the population to determine if the payments were allowed. We selected 60 of the 2,165 deceased individuals for further testing to determine if the Department took the appropriate action to identify and/or recover the payments. Twenty-one of 60 (35%) Medicaid recipients tested had an unallowable fee for service payment made on behalf of these deceased individuals which was not recovered by the Department, resulting in questioned costs, totaling $41,599. Furthermore, during testing we determined the Department recouped overpayments or reversed unallowable claims on behalf of 25 recipients, totaling $59,295. The questioned costs noted above only includes the outstanding amounts. The items noted above under Noncompliance and Additional Questioned Costs resulted in questioned costs for both the Medicaid Cluster and CHIP, as summarized in the table below: Summary of Questioned Costs by Category Medicaid Cluster CHIP Ineligible Recipients $2,384 $204,076 Deceased Individuals $41,599 N/A* Total Questioned Costs: $43,983 $204,076 *We completed testing over CHIP Deceased Individuals; however, we did not identify any claims paid past the recipient’s date. Without proper controls for entering, processing, and maintaining recipient information, including working system alerts in a timely manner, there is an increased risk that benefits paid to or on behalf of recipients will be inaccurate or unallowable. Overpayments or payments to or on behalf of ineligible recipients may subject the Department to penalties or sanctions which may jeopardize future funding and limit its ability to fulfill program requirements to provide benefits to those in need. Based on discussions with management, the issues identified were caused by oversight and systemic issues. We recommend the Department evaluate and seek reimbursement for all claims that were incorrectly paid. We also recommend management continue to work collectively with the related state agencies to implement/update robust processes, procedures, and system programming to address the weaknesses in the overall eligibility process, including those associated with the Ohio Benefits system. We also recommend the Department regularly evaluate selected benefit payments to verify the recipient’s eligibility, verify the recipient information entered into Ohio Benefits by the CDJFS is accurate and the information is being maintained to support the Department’s eligibility decision, and ensure initial eligibility determinations and redeterminations are completed timely. Any problems noted should be promptly corrected to reduce the risk of benefit payments being made on behalf of ineligible individuals and additional training provided to the State and/or county employees affected. Lastly, we recommend the Department evaluate current processes for identifying deceased individuals to ensure Ohio Benefits and OMES FI are updated in a timely manner. Controls should be implemented to ensure CDJFS caseworkers are following up with the Social Security Administration, Ohio Department of Health, or other death indicators in a timely manner. This should include developing a process for confirming an individual’s death if the family member, caretaker, or facility is not responding to the CDJFS caseworkers and ensuring the recipient is disenrolled from the managed care plan and converted to fee for services until date of death is confirmed. We further recommend the Department develop procedures to identify the improper payments to providers on behalf of deceased individuals and seek recovery, reimbursement, or offset future payments, when necessary. Auditor of State Conclusion: The response to this finding included within the State of Ohio Corrective Action Plan indicated the Department disagreed with a portion of the Medicaid Cluster and CHIP eligibility errors which required an Auditor of State Conclusion. For both the Medicaid and CHIP recipients, eligibility was determined based on older income and the county caseworker did not obtain current income information and/or the recipient failed to report an increase in income (e.g., new employment) in a timely manner. Additionally for the CHIP recipient, SWICA alerts were identified prior to determining eligibility and not worked properly resulting in the recipient being ineligible for the designated benefit aid category. Based on this information, the Medicaid and CHIP recipients would have been over the income limit for the benefit aid categories, and the Medicaid recipient would have been deemed ineligible to receive Medicaid benefits. Therefore, this finding will remain as stated above.

2. MEDICAID CLUSTER/CHIP – IEVS ALERTS Finding Number: 2025-014 State Agency Number: MCD-02 Assistance Listing Numbers and Titles: 93.767 – Children’s Health Insurance Program (CHIP) 93.767 COVID 19 – CHIP 93.775/93.777/93.778 – Medicaid Cluster 93.775/93.777/93.778 COVID-19 – Medicaid Cluster Federal Award Identification Numbers / Years: 2305OH5023 / 2023 (CHIP) 2405OH5024 / 2024 (CHIP) 2505OH5025 / 2025 (CHIP) 2305OH5MAP / 2023 (Medicaid Cluster) 2405OH5MAP / 2024 (Medicaid Cluster) 2505OH5MAP / 2025 (Medicaid Cluster) Federal Agency: Department of Health and Human Services Compliance Requirement: Eligibility Repeat Finding from Prior Audit? Yes Prior Audit Finding Number: 2024-015 NONCOMPLIANCE AND MATERIAL WEAKNESS NOTE: Finding number 2025-013 details deficiencies and weaknesses in internal control related to the Medicaid Cluster and CHIP programs regarding the Department’s eligibility processes. That finding is integral to and should be read in conjunction with this finding. 42 C.F.R. § 435.945 states, in part, the following regarding the Medicaid Cluster program: (a) Except where the law requires other procedures . . . the agency may accept attestation of information needed to determine the eligibility of an individual for Medicaid . . . without requiring further information (including documentation) from the individual. (b) The agency must request and use information relevant to verifying an individual's eligibility for Medicaid in accordance with § 435.948 through § 435.956 . . . 42 C.F.R. § 457.380, states, in part, the following regarding the Children’s Health Insurance Program (CHIP): (a) General requirements. Except where law requires other procedures . . . the State may accept attestation of information needed to determine the eligibility of an individual for CHIP. . . without requiring further information (including documentation) from the individual. (b) Status as a citizen, national or a non-citizen. (1) Except for newborns identified in § 435.406(a)(1)(iii)(E) of this chapter, who are exempt from any requirement to verify citizenship, the agency must— . . . (ii) Provide a reasonable opportunity period to verify such status in accordance with § 435.956(a) (5) and (b) of this chapter and provide benefits during such reasonable opportunity period to individuals determined to be otherwise eligible for CHIP. Furthermore, 42 U.S.C. § 1320b–7(a) Requirements of State eligibility systems states, in part: In order to meet the requirements of this section, a State must have in effect an income and eligibility verification system which meets the requirements of subsection (d) and under which— (1) the State shall require, as a condition of eligibility for benefits under any program listed in subsection (b), that each applicant for or recipient of benefits under that program furnish to the State his social security account number (or numbers, if he has more than one such number), and the State shall utilize such account numbers in the administration of that program so as to enable the association of the records pertaining to the applicant or recipient with his account number; (2) wage information from agencies administering State unemployment compensation laws available pursuant to section 3304(a)(16) of the Internal Revenue Code of 1986, wage information reported pursuant to paragraph (3) of this subsection, and wage, income, and other information from the Social Security Administration and the Internal Revenue Service available pursuant to section 6103(l)(7) of such Code, shall be requested and utilized to the extent that such information may be useful in verifying eligibility for, and the amount of, benefits available under any program listed in subsection (b), as determined by the Secretary of Health and Human Services . . . . (4) the State agencies administering the programs . . . adhere to standardized formats and procedures . . . under which — (A) the agencies will exchange with each other information in their possession which may be of use in establishing or verifying eligibility or benefit amounts under any other such program . . . (C) the use of such information shall be targeted to those uses which are most likely to be productive in identifying and preventing ineligibility and incorrect payments. . . . In order to comply with 42 C.F.R. § 435.945 and 42 U.S.C. § 1320b-7, the State of Ohio codified specific rules related to its Income Eligibility Verification System (IEVS) in the Ohio Administrative Code. Ohio Admin. Code 5160:1-1-04 states, in part: (A) This rule describes the requirements in section 1137 of the Social Security Act and in section 42 C.F.R. 435.945, requiring state agencies administering certain federally funded public assistance programs to establish procedures for obtaining, using and verifying information relevant to determinations of eligibility. The Ohio department of medicaid (ODM) shall obtain and share income and benefit information with the following sources: (1) The social security administration (SSA). (2) The internal revenue service (IRS). (3) The state wage information collection agency (SWICA). (4) Agencies administering the unemployment compensation (UC) benefits. . . . (C) Administrative agency responsibilities. Within forty-five days of receipt of the information, the administrative agency shall initiate, pursue, and complete the actions specified . . . (3) Review and compare against the case record all information received from the IEVS data matches to determine whether the information affects the individual's eligibility, in accordance with 42 C.F.R. 435.948. (4) Obtain additional information or documentation from the individual, if needed, to determine eligibility and initiate appropriate action in accordance with 42 C.F.R. 435.952(c). (5) . . . The administrative agency shall verify information. . . . (6) Update case information and redetermine eligibility when the verification received is discrepant from information currently listed in the electronic eligibility system. . . . As the lead agency responsible for administering the Medicaid Cluster and CHIP federal programs for the State of Ohio, the Department is responsible for providing reasonable assurance only eligible individuals receive assistance and documentation maintained is accurate, complete, and properly recorded in the Ohio Benefits system to ensure appropriate eligibility determinations. It is the Department’s responsibility to implement sufficient controls, systems, processes, and procedures to reasonably ensure compliance with the rules and regulations associated with these programs and only eligible recipients receive benefits. When automated systems are utilized to perform certain functions related to this compliance requirement, management must ensure the system is properly designed and operating effectively. The Department is also responsible for overall program compliance and must have appropriate oversight and monitoring procedures in place to ensure those they rely on are operating in accordance with all expectations, guidelines, and requirements related to their tasks. The Medicaid Cluster and CHIP federal programs are administered using a multi-agency approach: overall compliance and administration of the programs fall under the Department, and programming and administration of the State’s eligibility determination computer system, Ohio Benefits, falls under the Ohio Department of Administrative Services (DAS). The Department also, through a Memorandum of Understanding with the Ohio Department of Job & Family Services (JFS), utilizes the 88 Ohio counties in the eligibility determination process to work with applicants, receive/enter eligibility documentation into the Ohio Benefits system, and follow up on alerts issued by the system. The Ohio Benefits system was utilized for processing eligibility for the Medicaid Cluster and CHIP programs’ recipients with total expenditures of approximately $28.7 billion and $916.7 million, respectively during state fiscal year (SFY) 2025. The Ohio Benefits system contains the eligibility and benefit information/determinations for these programs, including the Income Eligibility Verification System (IEVS) functionality which compares reported recipient income to income information maintained by outside data sources (Social Security Administration, Internal Revenue Service (IRS), etc.). Information that does not agree is communicated in the form of an Ohio Benefits system alert. The Ohio Benefits system then determines if the alert is a ‘match’ that requires action. The IEVS match, indicated by ‘Yes’ in the Ohio Benefits system, is forwarded to the appropriate county agency for investigation and resolution. Each match has a defined due date, which is unique based on the priority level and other policy and process related factors. However, we noted the following weaknesses: • Volume of Alerts – During SFY 2025, more than 16.9 million alerts (3.0 million IEVS alerts and 13.9 million non-IEVS alerts) were issued for all public assistance programs that utilize Ohio Benefits, including the Medicaid Cluster and CHIP programs. Alerts can be generated by Ohio Benefits via interface outputs/updates, batch outputs, or other triggers within the system. The volume of incoming alerts/matches being sent to the county caseworkers results in an increased workload and ineffective application of the alert process. • Caseworker Reliance/Training – The current process relies heavily on the knowledge and judgement of county caseworkers in the eligibility process, including reviewing IEVS matches. The Department relies heavily on JFS to coordinate with and provide statewide and individual trainings for county agencies to assist them in working IEVS alerts/matches; however, these trainings are typically optional and/or attended by a representative of the county agency who is expected to relay the information to others. Additionally, we noted the following noncompliance with federal regulations where IEVS alerts were not cleared timely. • Clearing Alerts – While the Department has controls and procedures in place to review and monitor IEVS alerts and matches generated and processed by the Ohio Benefits system, there were instances when matches were not being completed by the county agencies in accordance with the required timeframes. Furthermore, an Ohio Benefits data file containing IEVS matches showed 833,232 of the 1,721,772 (48.4%) IEVS alerts sent to the county agencies during the audit period were not cleared within 45 days as required. The matches were cleared between one and 433 days beyond the 45-day requirement, for an average of 217 days late. Failure to implement system enhancements timely, perform monitoring activities, mandate training for county caseworkers, and complete IEVS alerts within the established timeframe increases the risk benefits given to ineligible recipients or for inappropriate amounts will not be identified timely. This condition could adversely affect the Department’s ability to comply with IEVS requirements for these federal programs which could result in federal sanctions or penalties. Based on discussions with management, the high volume of alerts generated likely caused the timeliness issues. Management indicated they will continue to work with JFS and DAS to enhance the statewide eligibility system to reduce the high volume of alerts. We recommend the Department continue to work collectively with the related state agencies to implement/update robust processes, procedures, and system controls to address the weaknesses associated with the IEVS process within the Ohio Benefits system. These changes/updates should include, but not be limited to: • Including a more centralized evaluation of alert/match activity and/or better use of automated tools to vet and prioritize items requiring follow-up at the county level. This would allow Department level personnel to become more experienced and adept at identifying and investigating anomalies and help focus the resources of both Department and county personnel. • Requiring mandatory IEVS training for all county agency employees who are entering the assistance group information into Ohio Benefits to help ensure proper and complete information is being collected, entered, and verified prior to an individual’s eligibility determination being made. The Department should continue to provide this training initially to ensure all users are knowledgeable of the process, procedures, and impacts of the work they do. As changes occur to the rules/regulations, system, or process, detailed training should be required of all users on those changes. We also recommend the Department continue to monitor the IEVS alert processing procedures guide for the matches issued by the Ohio Benefits system to ensure matches are properly documented within the system, worked within the proper timeframes, and proper verification documentation is obtained and maintained by the county agencies for resolved matches.

3. MEDICAID CLUSTER/CHIP – TRANSPARENCY ACT REPORTING Finding Number: 2025-015 State Agency Number: MCD-03 Assistance Listing Numbers and Titles: 93.767– Children’s Health Insurance Program (CHIP) 93.767 COVID 19 - CHIP 93.775/93.777/93.778 – Medicaid Cluster 93.775/93.777/93.778 COVID-19 – Medicaid Cluster Federal Award Identification Numbers / Years: 2505OH5021 / 2025 (CHIP) 2305OH5MAP / 2023 (Medicaid Cluster) 2405OH5MAP / 2024 (Medicaid Cluster) 2505OH5MAP / 2025 (Medicaid Cluster Federal Agency: Department of Health and Human Services Compliance Requirement: Reporting Repeat Finding from Prior Audit? No NONCOMPLIANCE AND MATERIAL WEAKNESS The Federal Funding Accountability and Transparency Act (Pub. L. No. 109-282, as amended by Section 6202 of Public Law 110-252, hereafter referred to as the “Transparency Act” that are codified in 2 C.F.R. Part 170) requires prime recipients of federal awards who make first-tier subawards to report the subaward on the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS portal or SAM.gov) website maintained by the federal Office of Management and Budget. Under the requirements of 2 C.F.R. Part 170, recipients (i.e., direct recipients) of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more on the FSRS portal or SAM.gov website. Prime recipients must report by the end of the month following the month in which the obligation is made. It is management’s responsibility to design and implement internal controls to reasonably ensure compliance with laws and regulations and to ensure management’s objectives are achieved. The State of Ohio is considered the prime recipient for federal funds applicable to Transparency Act reporting and the state agencies receiving these federal funds are expected to report the subawards obligated in accordance with the Transparency Act. During state fiscal year 2025, the Department obligated approximately $213.3 million for 554 subawards which exceeded $30,000 and were required to be reported on the FSRS portal or SAM.gov website in accordance with the Transparency Act for the Medicaid Cluster and CHIP programs. Assistance Listing Number Assistance Listing Title Number of Subawards Amount Obligated 93.767 CHIP 55 * $4,093,420 93.7775/93.777/93.778 Medicaid Cluster 499 ** $209,213,770 * Includes county advance subawards administered by the Ohio Department of Job and Family Services (JFS). ** Includes 482 county advance subawards administered by JFS. For the county advance subawards, JFS’ Office of Fiscal and Monitoring Services (OFMS) is responsible for compiling and providing the subaward information to the Department for the Medicaid Cluster and CHIP programs for entry on the FSRS portal or SAM.gov website. Once the Department enters the county advance subaward information for these programs, it provides JFS’ OFMS a summary of the subaward information that was entered on the FSRS portal or SAM.gov website. Additionally, for subawards administered by the Department, designated personnel are responsible for compiling and entering the subaward information for the Medicaid Cluster and CHIP programs on the FSRS portal or SAM.gov website. Although the Department had controls in place over the compilation and submission of the subawards, the following errors were noted: CHIP Transactions Tested Subaward not reported Report not timely Subaward amount incorrect Subaward missing key elements 7 0 1 0 0 Dollar Amount of Tested Transactions Subaward not reported Report not timely Subaward amount incorrect Subaward missing key elements $625,072 $0 $51,000 $0 $0 Medicaid Cluster Transactions Tested Subaward not reported Report not timely Subaward amount incorrect Subaward missing key elements 44 1 11 1 1 Dollar Amount of Tested Transactions Subaward not reported Report not timely Subaward amount incorrect Subaward missing key elements $38,407,442 $326,528 $6,370,016 $326,528 $326,528 By not complying with federal Transparency Act reporting requirements, the Department risks federal funding being reduced, taken away, or other sanctions imposed by the federal grantor agency. If the subawards are not reported timely within the FSRS portal or SAM.gov website, the risk exists that those using the Transparency Reports could be relying on inaccurate information. Based on discussion with management, this issue was caused by oversight, manual errors, and subaward data obtained in an untimely manner. We recommend the Department re-evaluate its Transparency Act reporting procedures to ensure information is entered on the SAM.gov website [as of March 8, 2025], including from its partner agencies, regarding subawards subject to the Transparency Act. We recommend the Department ensure these procedures identify the responsibilities between it and the partner agencies, promote compliance with Federal regulations, and the timely collection and submission of information for the Medicaid Cluster and CHIP programs. These procedures should be adequately documented and communicated to staff as well as the partner agencies to help ensure the subawards are properly reported in compliance with the Transparency Act for the respective programs. We also recommend timely communication with subrecipients to ensure subaward information is received and submitted by the deadline. Management should periodically review these control procedures to ensure they are operating as intended.

4. MEDICAID CLUSTER/CHIP – THIRD PARTY LIABILITY Finding Number: 2025-016 State Agency Number: MCD-04 Assistance Listing Numbers and Titles: 93.767 – Children’s Health Insurance Program (CHIP) 93.767 COVID 19 – CHIP 93.775/93.777/93.778 – Medicaid Cluster 93.775/93.777/93.778 COVID-19 – Medicaid Cluster Federal Award Identification Numbers / Years: 2305OH5023 / 2023 (CHIP) 2405OH5024 / 2024 (CHIP) 2505OH5025 / 2025 (CHIP) 2305OH5MAP / 2023 (Medicaid Cluster) 2405OH5MAP / 2024 (Medicaid Cluster) 2505OH5MAP / 2025 (Medicaid Cluster) Federal Agency: Department of Health and Human Services Compliance Requirements: Allowable Costs / Cost Principles – Third Party Liability Repeat Finding from Prior Audit? No NONCOMPLIANCE AND SIGNIFICANT DEFICIENCY 42 C.F.R. § 433.136, Definitions states, in part: Third Party means any individual, entity or program that is or may be liable to pay all or part of the expenditures for medical assistance furnished under a State plan. 42 C.F.R. § 433.138(b)(1), Identifying liable third parties states, in part: If the Medicaid agency determines eligibility for Medicaid, it must, during the initial application and each redetermination process, obtain from the applicant or beneficiary such health insurance information as would be useful in identifying legally liable third party resources so that the agency may process claims under the third party liability payment procedures specified in § 433.139(b) through (f). Health insurance information may include, but not limited to, the name of the policy holder, his or her relationship to the applicant or beneficiary, the social security number of the policy holder, and the name and address of insurance company and policy number. 42 C.F.R. § 433.139(b), Payment of claims states, in part: (1) If the agency has established the probable existence of third party liability at the time the claim is filed, the agency must reject the claim and return it to the provider for a determination of the amount of liability. The establishment of third party liability takes place when the agency receives confirmation from the provider or a third party resource indicating the extent of third party liability. When the amount of liability is determined, the agency must then pay the claim to the extent that payment allowed under the agency’s payment schedule exceeds the amount of the third party’s payment. (3) The agency must pay the full amount allowed under the agency's payment schedule for the claim and seek reimbursement from any liable third party to the limit of legal liability [in certain circumstances] . . . 2 C.F.R. § 200.334, Record retention requirements states, in part: The recipient . . . must retain all Federal award records for three years from the date of submission of their final financial report. . . . Records to be retained include but are not limited to financial records, supporting documentation and statistical records. . . The Department is the lead agency responsible for administering the Medicaid Cluster and CHIP federal grant programs for the State of Ohio. It is the Department’s responsibility to design and implement a system of internal controls to ensure legally liable third parties are identified, maintain verification documentation, and the claim is paid correctly. The Department is responsible for overall program compliance and must have appropriate oversight and monitoring procedures in place to ensure its third party liability process is operating effectively and as intended. During state fiscal year (SFY) 2025, the Department verified 10,600 third party insurance records within the Medicaid Information Technology System (MITS) which generated a document control number (DCN) record and stored the associated verification documentation received as a response to the verification letters sent to the third party providers within the DCN Panel. Additionally, monthly the Department reviewed a sample of verifications to ensure the third party liability insurance information was properly verified and information within MITS was accurate. As of July 7, 2025, MITS was decommissioned and the third party liability process was moved to the Ohio Medicaid Enterprise System (OMES) Fiscal Intermediary (FI) module. However, no historical evidence such as the DCN or supporting third party insurance documentation was available for review within FI. As such, the Department was unable to provide any of the third party verifications and compliance with federal requirements could not be verified during the audit period. By not maintaining historical third party insurance verifications within FI, the Department cannot be reasonably assured the third party insurance information was verified to ensure accurate payment of the fee-for-service claims and compliance with federal regulations during the audit period. Based on discussions with the Department, the issue was caused by the system change from MITS to FI, as a result, access to MITS was revoked and therefore no record of verifications could be provided for audit. We recommend the Department re-evaluate its policies and procedures over third party insurance verifications to ensure the liability insurance verification information is documented and maintained to be compliant with federal requirements and be available upon request. We recommend the Department continues to review the third party liability DCNs (or equivalent parameter within FI) monthly to ensure the information was properly verified, coverage types were properly identified, and all information in FI and other systems is correct. We further recommend the Department take necessary steps to ensure the proper conversion of all relevant data elements and related documentation is completed by ensuring historical data is maintained and available when a major system upgrade and/or replacement is performed.

5. MEDICAID CLUSTER/CHIP – SURVEILLANCE UTILIZATION REVIEWS Finding Number: 2025-017 State Agency Number: MCD-05 Assistance Listing Numbers and Titles: 93.767 – Children’s Health Insurance Program (CHIP) 93.767 COVID 19 – CHIP 93.775/93.777/93.778 – Medicaid Cluster 93.775/93.777/93.778 COVID-19 – Medicaid Cluster Federal Award Identification Numbers / Years: 2305OH5023 / 2023 (CHIP) 2405OH5024 / 2024 (CHIP) 2505OH5025 / 2025 (CHIP) 2305OH5MAP / 2023 (Medicaid Cluster) 2405OH5MAP / 2024 (Medicaid Cluster) 2505OH5MAP / 2025 (Medicaid Cluster Federal Agency: Department of Health and Human Services Compliance Requirement: Special Tests and Provisions – Utilization Control Repeat Finding from Prior Audit? Yes Prior Audit Finding Number: 2024-018 SIGNIFICANT DEFICIENCY The Department is the lead agency responsible for administering the Medicaid Cluster and CHIP federal grant programs for the State of Ohio. It is the Department’s responsibility to design and implement a system of internal controls to safeguard against unnecessary utilization of care and services associated with the Medicaid Cluster and CHIP programs. The Department is responsible for overall program compliance and must have appropriate oversight and monitoring procedures in place to ensure its statewide surveillance and utilization program safeguards against unnecessary or inappropriate use of Medicaid services against excess payments, assesses the quality of those services, and provides for the control of the utilization of all services provided under the state plan. During state fiscal year (SFY) 2025, the Department disbursed approximately $28.7 billion and $916.7 million in Medicaid Cluster and CHIP benefits, respectively, to providers for the managed care program and the fee for service medical claims through the Ohio Medicaid Enterprise System (OMES) Fiscal Intermediary (FI) module. The Department’s Surveillance and Utilization Review section utilized a vendor to identify the over-utilization of inpatient and outpatient hospital Medicaid services, including the State’s psychiatric hospitals. The vendor supports the Department by reviewing medical claims to determine if they were for an allowable use according to program requirements. If the vendor identifies an improper claim (i.e., billing errors, lack of pre-admission review, lack of medical necessity, etc.), the take back claim (an adjustment request for the provider overpayment) information is recorded on an inpatient/outpatient report and provided to the Department. However, in September 2023 the Department suspended the processing of these inpatient and outpatient hospital take back claims through OMES FI which resulted in the Department postponing the recoupment of provider overpayments during the audit period. Furthermore, the Department anticipates a backlog of take back claims that will need to be reviewed and processed once the system is fixed. A lack of effective internal controls related to the over utilization of inpatient and outpatient hospital claims, increases the risk of improper and/or unnecessary medical claims going undetected. By not safeguarding against unnecessary or inappropriate use of Medicaid and CHIP services, there is an increased risk of provider payments being noncompliant with federal program requirements. Based on discussions with the Department, this issue was caused by the inability to override certain edits in OMES FI resulting in ineffective processing of take back claims. We recommend the Department develop and implement internal controls over its utilization reviews to reasonably ensure the inpatient and outpatient hospital take back claims are processed through the OMES FI module accurately and in a timely manner. The Department should take the necessary steps to correct the edits attributing to the untimely and ineffective processing of these take back claims. The Department should also develop and implement a process for reviewing the backlog of these take back claims to reasonably ensure improper payments to providers are recouped in a timely manner.

1. ABANDONED MINE LAND RECLAMATION – TRANSPARENCY ACT REPORTING Finding Number: 2025-018 State Agency Number: DNR-01 Assistance Listing Number and Title: 15.252 – Abandoned Mine Land Reclamation Federal Award Identification Numbers / Years: S18AF20022 / 2018 S19AF20016 / 2019 S20AF20010 / 2020 S21AF10044 / 2021 S22AF00025 / 2022 S22AF00035 / 2022 S23AF00006 / 2023 S23AF00045 / 2023 S23AF00103 / 2023 S24AF00033 / 2024 S24AF00045 / 2024 S24AF00086 / 2024 S24AR80002 / 2024 S25AF00119 / 2025 Federal Agency: Department of Interior Compliance Requirement: Reporting Repeat Finding from Prior Audit? Yes Prior Audit Finding Number: 2024-020 NONCOMPLIANCE AND MATERIAL WEAKNESS The Federal Funding Accountability and Transparency Act (Pub. L. No. 109-282, as amended by Section 6202 of Public Law 110-252, hereafter referred to as the “Transparency Act” that are codified in 2 C.F.R. Part 170) requires prime recipients of federal awards who make first-tier subawards to report the subaward on the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS portal or SAM.gov) website maintained by the federal Office of Management and Budget. Under the requirements of 2 C.F.R. Part 170, recipients (i.e., direct recipients) of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more on the FSRS portal or SAM.gov website. Prime recipients must report by the end of the month following the month in which the obligation is made. It is management’s responsibility to design and implement internal controls to reasonably ensure compliance with laws and regulations and to ensure management’s objectives are achieved. The State of Ohio is considered the prime recipient for federal funds applicable to Transparency Act reporting and the state agencies receiving these federal funds are expected to report the subawards obligated in accordance with the Transparency Act. During state fiscal year 2025, the Department obligated approximately $34.6 million for 20 subawards which exceeded $30,000 and were required to be reported on the FSRS portal or SAM.gov website in accordance with the Transparency Act for the Abandoned Mine Land Reclamation program. However, the Department did not have controls in place to ensure the timely submission of these subawards within the FSRS portal or SAM.gov website which resulted in the following errors: Transactions Tested Subaward not reported Report not timely Subaward amount incorrect Subaward missing key elements 4 0 4 0 0 Dollar Amount of Tested Transactions Subaward not reported Report not timely Subaward amount incorrect Subaward missing key elements $7,150,000 $0 $7,150,000 $0 $0 By not complying with federal Transparency Act reporting requirements, the Department risks federal funding being reduced, taken away, or other sanctions imposed by the federal grantor agency. If the subawards are not reported timely within the FSRS portal or SAM.gov website, the risk exists that those using the Transparency Reports could be relying on inaccurate information. Based on discussion with management, this issue was caused by oversight and information not being compiled timely for submission. We recommend the Department evaluate its Transparency Act reporting procedures and update as necessary to ensure compliance with Federal regulations, including the collection and timeliness of information submitted regarding subawards made for the Abandoned Mine Land Reclamation program. These procedures should include a supervisory review of the report information before it is submitted on the SAM.gov website [as of March 8, 2025]. Management should periodically review these control procedures to ensure they are operating as intended.

1. LOW-INCOME HOME ENERGY ASSISTANCE PROGRAM – PERIOD OF PERFORMANCE Finding Number: 2024-002 State Agency Number: DEV-01 Assistance Listing Number and Title: 93.568 Low-Income Home Energy Assistance Program (LIHEAP) Federal Award Identification Number / Year: 2201OHLIEA / 2022 Federal Agency: Department of Health and Human Services Compliance Requirement: Period of Performance Repeat Finding from Prior Audit? No QUESTIONED COSTS 2 C.F.R. § 300.1 gives regulatory effect to the Department of Health and Human Services for 45 C.F.R. § 75.309 which states: (a) A non-Federal entity may charge to the Federal award only allowable costs incurred during the period of performance . . . and any costs incurred before the HHS awarding agency or pass-through entity made the Federal award that were authorized by the Federal awarding agency or pass-through entity. Funds available to pay allowable costs during the period of performance include both Federal funds awarded and carryover balances. (b) A non-Federal entity must liquidate all obligations incurred under the award not later than 90 days after the end of the funding period (or as specified in a program regulation) to coincide with the submission of the final Federal Financial Report (FFR). This deadline may be extended with prior written approval from the HHS awarding agency. During the audit period, the Department disbursed approximately $225.5 million in LIHEAP funds to eligible entities on behalf of eligible low-income households to help reduce costs associated with home energy bills, weatherization, and minor energy-related home repairs. Although the Department had various controls in place over the LIHEAP expenditure process, these controls did not prevent or detect the Department’s non-compliance with the program’s period of performance requirements. As a result, the Department did not obligate the funds of two subawards, totaling $576,505, by the close of the period of performance date of September 30, 2023. Funds were obligated on November 1, 2023 for both subawards, which was 32 days past the period of performance end date. Additionally, one of these two subawards, totaling $475,209, was not liquidated within 90 calendar days after the period of performance end date or December 29, 2023. The subaward was liquidated on May 7, 2024, which is 130 days past the liquidation period. As such, we will question these costs, totaling $576,505. Based on discussion with management, the late obligation and liquidation of these subawards were caused by the Department providing an extension to one entity and management oversight. Failure to obligate and liquidate funds in the required time frames could result in repayment, reduction of future federal funding, or sanctions imposed by the federal grantor agency. We recommend the Department evaluate its current policies and procedures relating to the processing of LIHEAP expenditure transactions and update them, as necessary, to reasonably ensure compliance with period of performance requirements. The Department should consider performing interim and periodic reviews of LIHEAP subaward and expenditure activity in advance of the obligation and liquidation period end dates to ensure the federal awards are obligated and liquidated within the required time frames. Management should periodically monitor these procedures to ensure they are operating effectively and as intended.

LOW-INCOME HOME ENERGY ASSISTANCE PROGRAM – TRANSPARENCY ACT REPORTING Finding Number: 2024-003 State Agency Number: DEV-02 Assistance Listing Number and Title: 93.568 Low-Income Home Energy Assistance Program (LIHEAP) Federal Award Identification Numbers / Years: 2301OHLIEE / 2023 2301OHLIEI / 2023 2301OHLIEA / 2023 2401OHLIEA / 2024 Federal Agency: Department of Health and Human Services Compliance Requirement: Reporting Repeat Finding from Prior Audit? Yes Prior Audit Finding Number: 2023-006 NONCOMPLIANCE AND MATERIAL WEAKNESS The Federal Funding Accountability and Transparency Act (Pub. L. No. 109-282, as amended by Section 6202 of Public Law 110-252, hereafter referred to as the “Transparency Act” that are codified in 2 C.F.R. Part 170) requires prime recipients of federal awards who make first-tier subawards to report the subaward on the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS) website maintained by the federal Office of Management and Budget. Under the requirements of 2 C.F.R. Part 170, recipients (i.e., direct recipients) of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more on the FSRS website. Prime recipients must report by the end of the month following the month in which the obligation is made. It is management’s responsibility to design and implement internal controls to reasonably ensure compliance with laws and regulations and to ensure management’s objectives are achieved. The State of Ohio is considered the prime recipient for federal funds applicable to Transparency Act reporting and the state agencies receiving these federal funds are expected to report the subawards obligated in accordance with the Transparency Act. During the audit period, the Department obligated approximately $161.2 million for 294 LIHEAP first-tier subawards that exceeded $30,000 and were required to be reported on the FSRS website in accordance with the Transparency Act. The Department’s Finance Division manages the Transparency Act reporting for all applicable programs. Monthly, the Finance Division obtains information about the subgrants required to be reported or updated on the FSRS website from an automated monthly encumbrance report. Once prepared, the identified subawards are entered into the FSRS website, the month following the obligation date of the subaward. Each month the Finance Division reconciles the subawards reported in the FSRS website to the Department’s internal reports to ensure accuracy, completeness, and timeliness of subawards reported. Although the Department had various controls in place over the Transparency Act reporting, the following errors were noted: Transactions Tested Subaward not reported Report not timely Subaward amount incorrect Subaward missing key elements 42 0 6 0 42 Dollar Amount of Tested Transactions Subaward not reported Report not timely Subaward amount incorrect Subaward missing key elements $15,047,472 $0 $1,637,500 $0 $15,047,472 By not complying with Federal Transparency Act reporting requirements, the Department risks federal funding being reduced, taken away, or other sanctions imposed by the federal grantor agency. If the subawards are not reported accurately and timely within FSRS, the risk exists that those using the Transparency Reports could be relying on inaccurate information. Based on discussions with management, this was caused by staffing shortages which resulted in changes to roles and responsibilities within the Department. We recommend the Department continues to evaluate its internal controls over the FSRS reporting process by collecting and reporting complete, accurate, and timely information regarding the subawards subject to the Transparency Act. We also recommend the Department cross-train employees over the LIHEAP Transparency Act reporting process to ensure the FSRS reporting can be performed by various personnel during vacations or with employee turnover. Management should periodically review these procedures to ensure they promote compliance with federal regulations and are operating as intended.

LOW-INCOME HOME ENERGY ASSISTANCE PROGRAM – REPORTING Finding Number: 2024-004 State Agency Number: DEV-03 Assistance Listing Number and Title: 93.568 Low-Income Home Energy Assistance Program (LIHEAP) Federal Award Identification Numbers / Years: 2301OHLIEE / 2023 2301OHLIEI / 2023 2301OHLIEA / 2023 Federal Agency: Department of Health and Human Services Compliance Requirement: Reporting Repeat Finding from Prior Audit? No NONCOMPLIANCE AND MATERIAL WEAKNESS 2 C.F.R. § 300.1 gives regulatory effect to the Department of Health and Human Services (HHS) for 45 C.F.R. § 96.81(b) which states: Each grantee must submit a report to the Department by August 1 of each year, containing the information in paragraphs (b)(1) through (b)(4) of this section. The Department shall make no payment to a grantee for a fiscal year unless the grantee has complied with this paragraph with respect to the prior fiscal year. (1) The amount of funds that the grantee requests to hold available for obligation in the next (following) fiscal year, not to exceed 10 percent of the funds payable to the grantee; (2) A statement of the reasons that this amount to remain available will not be used in the fiscal year for which it was allotted; (3) A description of the types of assistance to be provided with the amount held available; and (4) The amount of funds, if any, to be subject to reallotment It is management’s responsibility to implement control policies and procedures to reasonably ensure the federal reports they submit are accurate, complete, and in compliance with program requirements. It is imperative management maintain the underlying data and related program documentation used to prepare and support these reports. The Department’s Office of Community Assistance is responsible for preparing and submitting of the LIHEAP Annual Carryover and Reallotment Report to HHS. The report is submitted utilizing the Online Data Collection System (OLDC) website and is due by August 1 of each year, with the final version due by the end of December. The Office of Community Assistance management reviews the report for completeness and accuracy before submitting it electronically to HHS. However, the LIHEAP Annual Carryover and Reallotment Report submitted to HHS during the audit period was not mathematically accurate and did not trace to the support provided by the Department. The Department overstated the carryover amount for the 2023 program year by $165,075. The carryover amount was reported as $10,540,821 but should have been reported as $10,375,746. Reporting inaccurate or incomplete information could subject the Department to federal sanctions, limiting the amount of funding for program activities. This also increases the risk that those using the reports could be relying on inaccurate information. Based on discussion with management, the inaccurate reporting was caused by the Department mistakenly using old payroll and administrative expense amounts and not adequately agreeing the reports to internal support during the review process. We recommend the Department reinforce and evaluate existing procedures and consider altering them or implementing additional procedures, as necessary, to provide management reasonable assurance the data being reported to the federal government is accurate and traces to the proper supporting documentation. Management should periodically review these procedures to ensure they are operating as intended.

CORONAVIRUS STATE AND LOCAL FISCAL RECOVERY FUNDS – SUBRECIPIENT MONITORING Finding Number: 2024-005 State Agency Number: DEV-04 Assistance Listing Number and Title: 21.027 COVID-19 – Coronavirus State and Local Fiscal Recovery Funds (SLFRF) Federal Award Identification Number / Year: SLFRP2610 / 2021 SLFRP0130 / 2021 Federal Agency: Department of Treasury Compliance Requirement: Subrecipient Monitoring Repeat Finding from Prior Audit? Yes Prior Audit Finding Number: 2023-004 NONCOMPLIANCE AND MATERIAL WEAKNESS 2 C.F.R. § 1000.10 gives regulatory effect to the Department of Treasury for 2. C.F.R. § 200.332, which establishes requirements over subawards for pass-through entities and states: All pass-through entities must: . . . (d) Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. Pass-through entity monitoring of the subrecipient must include: (1) Reviewing financial and performance reports required by the pass-through entity. (2) Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the Federal award provided to the subrecipient from the passthrough entity detected through audits, on-site reviews, and written confirmation from the subrecipient, highlighting the status of actions planned or taken to address Single Audit findings related to the particular subaward. . . . It is management’s responsibility to design and implement internal control procedures over subrecipient monitoring to ensure federal funds are being spent for allowable purposes and in accordance with program requirements. It is also management’s responsibility to monitor these control procedures to ensure they are operating effectively and as intended. During state fiscal year 2024, the Department expended approximately $242.3 million in subawards to SLFRF subrecipients. The Department created several subprograms for various development and community-related activities as part of the SLFRF program. The subrecipients of these subprograms were required to submit a quarterly program report which includes data on projects funded, expenditures, contracts, and subawards equal to or greater than $50,000, to the Department through the Salesforce System. However, during the audit period, the Department’s Governor’s Office of Appalachia, which manages the ARPA Appalachian Community Grants, and the Department’s Community Services Division, which manages the Lead Prevention and Workforce Housing programs, did not have procedures in place to monitor subrecipients. The Community Services Division also oversees the Water Sewer Quality program; however, for 11 out of 17 (64.7%) Water Sewer Quality subrecipients selected for testing, the Department did not obtain the required quarterly program reports from its subrecipients. Further, the Community Services Division did not have a process in place to follow-up with its subrecipients to obtain the missing program reports. Without adequate procedures in place to collect program reports from subrecipients to monitor their compliance with federal statutes, laws, and regulations, there is an increased risk subrecipients may misuse federal funds for unauthorized purposes. This could lead to fines, penalties, or repayment of program funds being imposed by the federal grantor agency. Based on discussions with management, the lack of subrecipient monitoring for the two subprograms was caused by management oversight and the lapse in monitoring procedures was caused by employee turnover, slowing the monitoring of subrecipient’s report submissions. We recommend the Department design and implement internal control procedures to ensure all subprograms and subrecipients are adequately monitored for program compliance. We also recommend the Department evaluate existing control procedures, and add or alter if necessary, to reasonably ensure the quarterly program reports submitted through the Salesforce System are timely, accurate, and complete. These procedures should be adequately documented and maintained to ensure the internal controls are in place and operating as management intended. Management should periodically monitor these procedures to ensure they are working as intended.

CORONAVIRUS STATE AND LOCAL FISCAL RECOVERY FUNDS – REPORTING Finding Number: 2024-006 State Agency Number: DEV-05 Assistance Listing Number and Title: 21.027 COVID-19 – Coronavirus State and Local Fiscal Recovery Funds (SLFRF) Federal Award Identification Number / Year: SLFRP2610 / 2021 SLFRP0130 / 2021 Federal Agency: Department of Treasury Compliance Requirement: Reporting Repeat Finding from Prior Audit? Yes Prior Audit Finding Number: 2023-004 NONCOMPLIANCE AND MATERIAL WEAKNESS 31 C.F.R. § 35.4(c) related to reporting for pandemic relief funds states, in part, Reporting and requests for other information. During the period of performance, recipients shall provide to the Secretary periodic reports providing detailed accounting of the uses of funds, modifications to a State or Territory’s tax revenue sources, and such other information as the Secretary may require for administration of this section. In addition to regular reporting requirements, the Secretary may request other additional information as may be necessary or appropriate, including as may be necessary to prevent evasions of the requirements of this subpart. . . It is management’s responsibility to design and implement control policies and procedures to reasonably ensure the federal reports they submit are accurate, complete, and in compliance with program requirements. Management is also responsible for ensuring internal controls over reporting are operating effectively and as intended. During State Fiscal Year 2024, the Department expended approximately $318.3 million in SLFRF program expenditures. To facilitate this spending, the Department created several subprograms for various development and community-related activities which are administered by various divisions/officed within the Department. During the audit period, the Department was responsible for compiling SLFRF program activity for these subprograms and submitting it to the Ohio Office of Budget and Management (OBM) which compiled and submitted the quarterly Project and Expenditure Reports to the Department of Treasury on behalf of the State of Ohio for all SLFRF activities. However, the Department did not have a process in place to coordinate the SLFRF program activity collection, compilation, and submissions to OBM but relied on the various divisions/offices to do so. The Department’s Community Services Division was responsible for compiling and submitting the Water Sewer Quality subprogram’s quarterly Project and Expenditure Reports. The Department’s Governor’s Office of Appalachia contracted with a vendor to compile the reports for the ARPA Appalachian Community Grants subprogram and the Department’s Finance Division submitted it to OBM. All other SLFRF subprogram reports were compiled and submitted by the Department’s Finance Division. In addition, the quarterly Project and Expenditure Reports were compiled from different sources of financial data. The Community Services Division utilized the Department’s internal accounting system, Salesforce, which interfaces with the State’s accounting system, OAKS. All other SLFRF subprogram reports were compiled utilizing data obtained directly from OAKS. Lastly, the following items were noted: • The Community Services Division did not have any review in place over reports submitted to OBM until the third quarter of the fiscal year. This affected 39 of the 126 (30.9%) quarterly Project and Expenditure Reports submitted during the audit period. • Seven of 13 (53.8%) quarterly Project and Expenditure Reports selected for testing were not mathematically accurate and did not agree to support used in the reports submitted to OBM. A lack of internal controls over federal reporting increases the risk of financial and programmatic information submitted to the federal grantor agency being inaccurate which could result in federal funds being reduced, taken away, or other sanctions imposed by the federal grantor agency. Additionally, by not creating policies to facilitate consistent reporting, the risk of inaccurate reporting also is further increased. Based on discussions with management, the reporting issues identified were caused by employee turnover experienced during the audit period. We recommend the Department design and implement internal controls over its reporting process to reasonably ensure the information presented in the quarterly Project and Expenditure Reports is current, accurate, and complete prior to submission to OBM. We also recommend the Department implement procedures to compile the reports from the same system/source and coordinate the submission to OBM to promote consistency. These procedures should be adequately documented and maintained to ensure the internal controls are in place and operating as management intended. Management should periodically monitor these procedures to ensure they are working as intended. Lastly, we recommend the Department cross train employees so in the event of turnover or extended leave, the reporting process can continue without disruption or delays.

CORONAVIRUS STATE AND LOCAL FISCAL RECOVERY FUNDS – SUSPENSION AND DEBARMENT Finding Number: 2024-007 State Agency Number: DEV-06 Assistance Listing Number and Title: 21.027 COVID-19 – Coronavirus State and Local Fiscal Recovery Funds (SLFRF) Federal Award Identification Number / Year: SLFRP2610 / 2021 SLFRP0130 / 2021 Federal Agency: Department of Treasury Compliance Requirement: Suspension and Debarment Repeat Finding from Prior Audit? No NONCOMPLIANCE AND MATERIAL WEAKNESS 2 C.F.R § 1000.10 gives regulatory effect to the Department of Treasury for 2 C.F.R Parts 200 and 180, which provide government-wide suspension and debarment requirements for covered transactions, which 2 C.F.R. § 180.20 indicates include both procurement and nonprocurement transactions. Procurement transactions are contracts for goods or services expected to equal or exceed $25,000, while nonprocurement transactions include grants and cooperative agreements regardless of the amount. Federal regulations require that before entering into a covered transaction with an entity at a lower tier, the State must verify the entity is not suspended, debarred, or otherwise excluded from entering into the transaction. This verification may be accomplished by checking the System for Award Management (SAM) Exclusions website, obtaining a certification about not being suspended or debarred from the entity, or adding a clause or condition to the covered transactions with that entity. It is management’s responsibility to ensure adequate procedures are in place to provide reasonable assurance they do not enter into any covered transaction involving federal funds with an entity that is suspended, debarred or otherwise excluded from entering into the transaction. During state fiscal year 2024, the Department provided 372 awards totaling $64.6 million to subrecipients for various purposes under the Coronavirus State and Local Fiscal Recovery Funds program, including Lead Prevention and Ohio Arts Economic Relief. The Department also entered into purchasing contracts with 22 different vendors for program-related non-payroll administrative expenses, totaling approximately $16 million. Although the Department had procedures in place to confirm the vendors it entered into contracts with related to these expenditures were not suspended or debarred, the Department was unable to provide evidence of these verifications during the audit period. The auditor subsequently determined that these venders were not suspended or debarred and were eligible to receive federal funds. By not verifying whether vendors are suspended or debarred in advance of entering into a contract and disbursing funds, the Department risks providing federal funds to entities that are not allowed to participate in and receive funds from federal programs. This could result in disallowed costs or the Department being required to repay funds to the federal government. Noncompliance with federal requirements could also subject the Department to fines, sanctions, and/or reduction/termination of future federal funding. Based on discussion with management, the lack of support for suspension and debarment verification was caused by employee turnover. We recommend the Department evaluate existing policies and procedures related to suspension and debarment verification for all potential vendors to provide reasonable assurance it does not enter into contracts with entities that are suspended or debarred. This verification process should be documented in some manner to provide management reasonable assurance it was completed properly based on current and accurate information. We also recommend management periodically reevaluate and update these policies and procedures.

EMERGENCY RENTAL ASSISTANCE PROGRAM – REPORTING Finding Number: 2024-008 State Agency Number: DEV-07 Assistance Listing Number and Title: 21.023 COVID-19 – Emergency Rental Assistance Program (ERA) Federal Award Identification Number / Year: ERAE0063 / 2021 Federal Agency: Department of Treasury Compliance Requirement: Reporting Repeat Finding from Prior Audit? Yes Prior Audit Finding Number: 2023-005 NONCOMPLIANCE AND MATERIAL WEAKNESS 2 C.F.R. § 1000.10 gives regulatory effect to the Department of Treasury for 2 C.F.R. § 200.329(b), which establishes requirements over federal reporting, and states: Reporting program performance. The Federal awarding agency must use OMB-approved common information collections, as applicable, when providing financial and performance reporting information. As appropriate and in accordance with above mentioned information collections, the Federal awarding agency must require the recipient to relate financial data and accomplishments to performance goals and objectives of the Federal award. Also, in accordance with above mentioned common information collections, and when required by the terms and conditions of the Federal award, recipients must provide cost information to demonstrate cost effective practices (e.g., through unit cost data). In some instances (e.g., discretionary research awards), this will be limited to the requirement to submit technical performance reports (to be evaluated in accordance with Federal awarding agency policy). Reporting requirements must be clearly articulated such that, where appropriate, performance during the execution of the Federal award has a standard against which non-Federal entity performance can be measured. It is management's responsibility to implement internal control procedures to reasonably ensure the federal reports they submit are accurate, complete, and in compliance with program requirements. It is imperative that management be able to provide the underlying data and related program documentation required to prepare and support these reports. The Department’s Office of Community Assistance is responsible for the preparation of the quarterly ERA Compliance Report, as required by 2 C.F.R. § 200.329(b) for the ERA program. The Office of Community Assistance compiles these reports by generating a combination of internal financial data and data submitted by the Department’s subrecipients. Financial information is uploaded with the performance data information in the ERA Compliance Report along with various information relating to the demographics of the project. However, the Office of Community Assistance’s review of these quarterly reports was not adequate and/or operating effectively throughout the audit period. As a result, for two of two (100%) quarterly ERA Compliance Reports tested, the Department was unable to provide supporting documentation for the amounts reported or provided insufficient supporting documentation for amounts reported that resulted in inaccuracies and missing information for key data elements. A lack of adequate internal controls over federal reporting increases the risk of inaccurate and incomplete reports being submitted to the federal grantor agency. Reporting inaccurate or incomplete information could also subject the Department to federal sanctions, limiting the amount of funding for program activities. Based on discussions with management, the inaccurate or missing information in the reports was caused by not adequately comparing the reports to internal support during the review process, as well as oversight and lack of data verification and reconciliation procedures. We recommend the Department re-evaluate its existing internal control procedures over the ERA Compliance Reports to reasonably ensure the data being reported for the ERA program is accurate, complete, and agrees to supporting documentation. These procedures should include a review of the data submitted by subrecipients to ensure all required data elements are present and properly reported. We also recommend management implement and or enhance existing procedures to include a final review and reconciliation of the report’s data elements to supporting information/documentation to ensure the report is complete and accurate prior to submission to the federal grantor agency. Management should periodically review these procedures to ensure they are operating as intended.

EMERGENCY RENTAL ASSISTANCE PROGRAM – EARMARKING Finding Number: 2024-009 State Agency Number: DEV-08 Assistance Listing Number and Title: 21.023 COVID-19 – Emergency Rental Assistance Program (ERA) Federal Award Identification Number / Year: ERA0006 / 2021 ERAE0063 / 2021 Federal Agency: Department of Treasury Compliance Requirement: Earmarking Repeat Finding from Prior Audit? No MATERIAL WEAKNESS Section 501 of Division N of the Consolidated Appropriations Act, 2021, Pub. L. No. 116-260 related to ERA 1 program funding allows a grantee to use up to 10 percent of the total award amount for direct and indirect administrative costs. Also, Subsection (d) of Section 3201 of the American Rescue Plan Act of 2021, Pub. L. No. 117-2 related to ERA 2 program funding allows a grantee to use up to 15 percent of the total award amount for direct and indirect administrative costs and 10 percent of the total award amount for housing stability services. It is management’s responsibility to implement policies and procedures to reasonably ensure all applicable federal program requirements are adhered to. These policies should include monitoring by management to ensure the procedures are working as intended. The Department was initially awarded approximately $564.8 million for the ERA 1 program and was subsequently awarded approximately $446.9 million for the ERA 2 program. During the audit period, the Department disbursed approximately $79.7 million in ERA program funds to eligible entities on behalf of eligible households to provide financial assistance and housing stability services, and to cover costs for other affordable rental housing and eviction prevention activities. Although the Department had various controls in place over the ERA expenditure process and did not exceed the earmarking thresholds during the audit period, it did not have controls in place to ensure disbursements did not exceed the allowable earmarking amounts for administrative costs and housing stability services. Without procedures in place to monitor the earmarking thresholds and use of ERA program funds, the Department risks exceeding the allowed limits for administrative costs or housing stability costs which could result in the claw back or repayment of funds. Based on discussion with management, the lack of internal controls was caused by the Department being unaware of these earmarking compliance requirements. We recommend the Department design and implement controls over its earmarking process to ensure all program funds are being properly utilized according to the thresholds outlined in the federal requirements. These procedures should be well documented and maintained to ensure they are being properly followed by Department personnel. Management should periodically monitor these procedures to ensure they are working as intended.

CHILD NUTRITION CLUSTER – TRANSPARENCY ACT REPORTING Finding Number: 2024-010 State Agency Number: DEW-01 Assistance Listing Numbers and Titles: 10.553 School Breakfast Program 10.553 COVID-19 School Breakfast Program 10.555 National School Lunch Program 10.555 COVID-19 National School Lunch Program 10.556 Special Milk Program for Children 10.559 Summer Food Service Program for Children 10.582 Fresh Fruit and Vegetable Program Federal Award Identification Numbers / Years: 222OH062N1099 / 2022 222OH062N1199 / 2022 222OH062N8903 / 2022 232OH062N1099 / 2023 232OH062N1199 / 2023 232OH062N8903 / 2023 242OH062N1099 / 2024 242OH062N1199 / 2024 242OH062N8903 / 2024 Federal Agency: Department of Agriculture Compliance Requirement: Reporting Repeat Finding from Prior Audit? No NONCOMPLIANCE AND MATERIAL WEAKNESS The Federal Funding Accountability and Transparency Act (Pub. L. No. 109-282, as amended by Section 6202 of Public Law 110-252, hereafter referred as the “Transparency Act” that are codified in 2 C.F.R. Part 170) requires prime recipients of federal awards who make first-tier subawards to report the subaward on the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS) website maintained by the federal Office of Management and Budget. Under the requirements of 2 C.F.R. Part 170, recipients (i.e., direct recipients) of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more on the FSRS website. Prime recipients must report by the end of the month following the month in which the obligation is made. It is management’s responsibility to design and implement internal controls to reasonably ensure compliance with laws and regulations and to ensure management’s objectives are achieved. The State of Ohio is considered the prime recipient for federal funds applicable to Transparency Act reporting and the state agencies receiving these federal funds are expected to report the subawards obligated in accordance with the Transparency Act. During state fiscal year 2024, the Ohio Department of Education and Workforce (the Department) disbursed approximately $648 million to 1,039 subrecipients for the Child Nutrition Cluster whose reimbursements exceeded $30,000 and were required to be reported on the FSRS website in accordance with the Transparency Act. The Child Nutrition Cluster is an entitlement grant as opposed to a subaward, as a result, funds are not obligated in the same manner as subawards. Communications between the Department’s Office of Nutrition and the United States Department of Agriculture (USDA) instructed the Department to report the Child Nutrition Cluster’s actual expenditures within FSRS since the subaward information is not available. However, the Department had no control procedures in place to ensure the Child Nutrition Cluster’s expenditures were accurately entered into the FSRS website for the School Breakfast Program and the National School Lunch Program, as follows: School Breakfast Program Transactions tested Subaward not reported Report not timely Subaward amount incorrect Subaward missing key elements 758 758 0 0 0 Dollar amount of tested transactions Subaward not reported Report not timely Subaward amount incorrect Subaward missing key elements $156,568,195 $156,568,195 $0 $0 $0 National School Lunch Program Transactions tested Subaward not reported Report not timely Subaward amount incorrect Subaward missing key elements 1,039 1,039 0 0 0 Dollar amount of tested transactions Subaward not reported Report not timely Subaward amount incorrect Subaward missing key elements $491,566,732 $491,566,732 $0 $0 $0 A lack of effective internal controls over the preparation and review of reports increases the risk the reports submitted to the federal grantor agency are inaccurate and incomplete. By not complying with federal Transparency Act reporting requirements, the Department risks federal funding being reduced, taken away, or other sanctions imposed by the federal grantor agency. If the expenditures are not reported accurately and timely within FSRS, the risk exists that those using the Transparency Reports could be relying on inaccurate information. Based on discussions with management, these issues were caused by unclear instructions within the federal regulations and the lack of guidance from the USDA. We recommend the Department design and implement internal controls over its Transparency Act reporting to ensure the accuracy and completeness of expenditures entered in the FSRS website for all federal programs within the Child Nutrition Cluster. These procedures should include a supervisory review of the expenditure information and ensure compliance with federal regulations before it is entered into the FSRS website. We also recommend the Department communicate with the USDA if there are questions regarding the Child Nutrition Cluster’s Transparency Act reporting to ensure the federal compliance requirements are adhered to and consistently reported each fiscal year. Management should periodically review these control procedures to ensure they are operating as intended.

DWSRF – LOAN PAYMENT MONITORING Finding Number: 2024-011 State Agency Number: EPA-01 Assistance Listing Number and Title: 66.468 Capitalization Grants for Drinking Water State Revolving Funds (DWSRF) Federal Award Identification Numbers / Years: 98595420 / 2020 98595421 / 2021 98595422 / 2022 98595423 / 2023 00E03243 / 2022 01E03243 / 2023 00E03246 / 2022 01E03246 / 2023 00E03332 / 2022 01E03332 / 2023 Federal Agency: Environmental Protection Agency Compliance Requirements: Activities Allowed or Unallowed, Allowable Costs / Cost Principles Repeat Finding from Prior Audit? No MATERIAL WEAKNESS It is management’s responsibility to design and implement an internal control structure capable of providing reasonable assurance that objectives are being achieved. As the prime recipient of federal funds awarded through the DWSRF program, the Agency must implement internal controls that reasonably ensure amounts paid to borrowers (usually local government agencies), through the Ohio Water Development Authority (OWDA), are processed accurately, completely, and in compliance with the applicable federal laws and regulations. During the audit period, the Agency expended approximately $100.3 million in federal funds for the DWSRF program to borrowers, providing low interest financing for costs associated with the planning, design, and construction of their eligible drinking water improvement projects and activities to protect human health. Ohio Rev. Code (ORC) § 6111.036 requires the Agency and OWDA to share responsibility for the management of the program. An interagency agreement between the Agency and OWDA establishes the responsibilities to be performed by each agency, including assigning OWDA the authority to make payments to program recipients in accordance with the approved loan agreement and the disbursement protocol. Prior to providing funding for a project, the Agency enters into a loan agreement with the borrower and prepares a disbursement protocol agreement, which establishes the eligible costs and source of funds for the project. After receiving invoices for construction projects, the borrower completes the electronic Fund Payment Request form (FPR) via OWDA’s website. OWDA reviews the FPR for reasonableness and compliance with the loan agreement, approves the FPR, disburses the funds to the borrower, and forwards the documentation to the Agency. Agency coordinators review the documentation to ensure the disbursement was allowable under the grant requirements and saves a copy of the FPR and supporting documentation in the Assistance Information Management System (AIMS). The Agency maintains a written procedure which states this review should be performed within 45 days of the disbursement by OWDA and should be performed for 70% of disbursement vouchers. However, the Agency did not maintain evidence that management was monitoring these procedures to ensure 70% of disbursement voucher reviews were completed. In addition, 18 of 60 (30%) disbursements selected for testing were not reviewed within 45 days in AIMS. The disbursements were reviewed 49 to 394 days after payment, averaging 104 days late. Additionally, the Agency completes quarterly reconciliations over DWSRF program revenue and expenditure activity by examining internal records maintained for disbursements, transfers, and grant balances, OWDA records, and bank statements. The completed reconciliation spreadsheet is reviewed and approved by the Agency’s Chief Financial Officer. Although the Agency completed quarterly reconciliations during the audit period, they were either not completed timely, or the Agency was unable to provide evidence of when the reconciliation was completed. Three of the four reconciliations (Q1-Q3 fiscal year 2024) were completed/reviewed in November 2024, five months after the end of the audit period. The Agency was unable to provide evidence of when the Q4 fiscal year 2023 reconciliation was completed. Based on discussion with management, the untimely disbursement reviews and reconciliations were caused by staffing shortages, a high number of active drinking water improvement projects, and management’s reliance on OWDA. Without performing timely reviews of invoices and FPRs submitted for reimbursement by the borrower or performing other monitoring activities, the Agency cannot be reasonably assured OWDA’s review process ensured payments made to borrowers were accurate and for allowable activities. If the Agency does not perform timely reviews, there is an increased risk that noncompliance will not be identified in a timely manner. As a result, there is a risk federal funding will be reduced or withdrawn, or other sanctions will be imposed by the federal grantor agency. Additionally, without performing timely reconciliations between the Agency’s internal records and bank statements and subsequently investigating and resolving any significant differences noted, there is an increased risk that account balances may be miscoded or inaccurate. We recommend management evaluate existing policies regarding disbursement reviews and reconciliations and update them as necessary to ensure appropriate monitoring procedures are in place and their objectives are being met. Management should evaluate the transactions processed to identify areas of risk and other relevant criteria when designing the procedures regarding the Agency’s review of invoices received from OWDA. We also recommend management implement periodic monitoring procedures to ensure the disbursement review and reconciliation procedures are performed timely and consistently.

SNAP CLUSTER AND TANF – IEVS ALERTS Finding Number: 2024-012 State Agency Number: JFS-01 Assistance Listing Numbers and Titles: 10.551/10.561 – SNAP Cluster 93.558 – Temporary Assistance for Needy Families (TANF) Federal Award Identification Number / Year: 222OH102S2514 / 2022 (SNAP Cluster) 222OH102S6018 / 2022 (SNAP Cluster) 232OH102S2514 / 2023 (SNAP Cluster) 232OH102S6018 / 2023 (SNAP Cluster) 242OH102S2514 / 2024 (SNAP Cluster) 242OH102S6018 / 2024 (SNAP Cluster) 2201OHTANF / 2022 (TANF) 2301OHTANF / 2023 (TANF) 2401OHTANF / 2024 (TANF) Federal Agencies: Department of Agriculture Department of Health and Human Services Compliance Requirements: Eligibility, Special Tests and Provisions – Income Eligibility Verification System Repeat Finding from Prior Audit? Yes Prior Audit Finding Numbers: 2023-010 NONCOMPLIANCE AND MATERIAL WEAKNESS 7 C.F.R. § 272.8(c), states the following regarding the Supplemental Nutrition Assistance Program (SNAP) Cluster: (1) State agency action on information items about recipient households shall include: (i) Review of the information and comparison of it to case record information; (ii) For all new or previously unverified information received, contact with the households and/or collateral contacts to resolve discrepancies as specified in §§ 273.2(f)(4)(iv) and 273.2 (f)(9)(iii) and (f)(9)(iv); and (iii) If discrepancies warrant reducing benefits or terminating eligibility, notices of adverse action. (2) State agencies must initiate and pursue the actions on recipient households specified in paragraph (c)(1) of this section so that the actions are completed within 45 days of receipt of the information items. Actions may be completed later than 45 days from the receipt of information if: (A) The only reason that the actions cannot be completed is the nonreceipt of verification requested from collateral contacts; and (B) The actions are completed as specified in § 273.12 of this chapter when verification from a collateral contact is received or in conjunction with the next case action when such verification is not received, whichever is earlier. (3) When the actions specified in paragraph (c)(1) of this section substantiate an over issuance, State agencies must establish and take actions on claims as specified in § 273.18 of this chapter. (4) State agencies must use appropriate procedures to monitor the timeliness requirements in paragraph (c)(2) of this section. 45 C.F.R. § 205.56(a)(1)(iv) states the following regarding the Temporary Assistance for Needy Families (TANF) program: For individuals who are recipients when the information is received or for whom a decision could not be made prior to authorization of benefits, the State agency shall within forty-five (45) days of its receipt, initiate a notice of case action or an entry in the case record that no case action is necessary, except that: Completion of action may be delayed beyond forty-five (45) days on no more than twenty (20) percent of the information items targeted for follow-up, if: (A) The reason that the action cannot be completed within forty-five (45) days is the nonreceipt of requested third-party verification; and (B) Action is completed promptly, when third party verification is received or at the next time eligibility is redetermined, whichever is earlier. If action is completed when eligibility is redetermined and third party verification has not been received, the State agency shall make its decision based on information provided by the recipient and any other information in its possession. As the lead agency responsible for administering the SNAP Cluster and TANF federal programs for the State of Ohio, the Department is responsible for providing reasonable assurance only eligible individuals receive assistance and documentation maintained is accurate, complete, and properly recorded in the Ohio Benefits system to ensure appropriate eligibility determinations. It is the Department’s responsibility to implement sufficient controls, systems, processes, and procedures to reasonably ensure compliance with the rules and regulations associated with these programs and only eligible recipients receive benefits. When automated systems are utilized to perform certain functions related to this compliance, management must ensure the system is properly designed and operating effectively. The Department is also responsible for overall program compliance and must have appropriate oversight and monitoring procedures in place to ensure those they rely on are operating in accordance with all expectations, guidelines, and requirements related to their tasks. As part of monitoring, the Department’s Fraud Control Section conducts Fraud Triad Reviews, which in part, includes a review of 1) Income Eligibility Verification System (IEVS) processing timeliness, 2) proper verifications, 3) proper disposition coding and 4) random supervisory reviews. The Fraud Control Section also conducts random reviews of cases with an IEVS alert to ensure they were cleared properly and timely, as well as monitor the JFSR 4005, IEVS Monthly Summary Report to track completion of IEVS alerts and to identify counties that need technical assistance. The SNAP Cluster and TANF federal programs are administered using a multi-agency approach: overall compliance and administration of the programs fall under the Department, and programming and administration of the State’s eligibility determination computer system, Ohio Benefits, falls under the Ohio Department of Administrative Services (DAS). The Department also utilizes the 88 Ohio County Departments of Job and Family Services (counties) in the eligibility determination process to work with applicants, receive/enter eligibility documentation into the Ohio Benefits system, and follow up on alerts issued by the system. The Ohio Benefits system was utilized for processing eligibility for the SNAP Cluster and TANF programs with total expenditures to recipients of approximately $3.2 billion and $216 million, respectively, during state fiscal year (SFY) 2024. The Ohio Benefits system contains the eligibility and benefit information/determinations for these programs, including the IEVS functionality which compares reported recipient income to income information maintained by outside data sources (Social Security Administration, Internal Revenue Service (IRS), etc.). Information that does not agree is communicated in the form of an Ohio Benefits system alert. The Ohio Benefits system then determines if the alert is a ‘match’ that requires action. The IEVS match, indicated by ‘Yes’ in the Ohio Benefits system, is forwarded to the appropriate county agency for investigation and resolution. Each match has a defined due date, which is unique based on the priority level and other policy and process related factors. However, we noted the following weaknesses: • Volume of Alerts – During SFY 2024, more than 21.2 million alerts (2.8 million IEVS alerts and 18.4 million non-IEVS alerts) were issued for all public assistance programs that utilize Ohio Benefits, including the SNAP Cluster and TANF programs. Alerts can be generated by Ohio Benefits via interface outputs/updates, batch outputs or other triggers within the system. However, the volume of incoming alerts being sent to the county caseworkers results in an increased workload and ineffective application of the alert process. • Caseworker Reliance/Training – The current process relies heavily on the knowledge and judgement of county caseworkers in the eligibility process, including reviewing IEVS matches. The Department utilizes its monitoring of the JFSR 4005, IEVS Monthly Summary Report to better identify those county agencies which require additional training and technical assistance. The Department also continues to conduct statewide trainings and individual trainings for county agencies to assist them in working IEVS alerts/matches; however, these trainings are typically optional and/or attended by a representative of the county agency who is expected to relay the information to others. Additionally, we noted the following noncompliance with federal regulations where IEVS alerts were not cleared timely. • Clearing Alerts – While the Department has controls and procedures in place to review and monitor IEVS alerts and matches generated and processed by the Ohio Benefits system, there were instances when matches were not being completed by the county agencies in accordance with the required timeframes established in 7 C.F.R. § 272.8, and 45 C.F.R. § 205.56. Furthermore, an Ohio Benefits data file containing IEVS matches showed 185,585 of the 349,893 (53%) IEVS alerts sent to the county agencies during the audit period were not cleared within 45 days as required. The matches were cleared between one and 447 days beyond the 45-day requirement, for an average of 137 days late. Failure to implement system enhancements timely, perform monitoring activities, mandate training for county caseworkers, and complete IEVS alerts within the established timeframes increases the risk benefits given to ineligible recipients or for inappropriate amounts will not be identified timely. This condition could adversely affect the Department’s ability to comply with IEVS requirements for these federal programs which could result in federal sanctions or penalties. Based on discussions with management, this was caused by the Department’s county administered approach creating challenges to making training mandatory. Training is continued to be offered and made available to county personnel. Further, management indicated they continue to work with DAS to monitor the system and enhancements to ensure they meet the desired impact of clearing alerts in a timely manner, as well as reach out to county and state personnel to offer technical assistance. However, the high volume of alerts presents difficulties to the caseworkers. We recommend Department management continue to work collectively with DAS to implement/update robust processes, procedures, and system controls to address the weaknesses associated with the IEVS process within the Ohio Benefits system. These changes/updates should include, but not be limited to: • Including a more centralized evaluation of alert/match activity and/or better use of automated tools to vet and prioritize items requiring follow-up at the county level. This would allow Department level personnel to become more experienced and adept at identifying and investigating anomalies and help focus the resources of both Department and county personnel. • Continuing to perform periodic and timely reviews of the JFSR 4005, IEVS Monthly Summary Report at the Department level to monitor the status and completion of IEVS matches, as well as identify areas of training for the counties. Such procedures should also include required monitoring by each County IEVS Coordinator or other supervisory personnel (through the eligibility system). The Department should clearly communicate the expectations for these monitoring procedures to the counties and implement procedures to ensure the counties are properly completing them, possibly as part of the Fraud Triad Reviews. • Requiring mandatory IEVS training for all county agency employees who are entering the assistance group information into Ohio Benefits to help ensure proper and complete information is being collected, entered, and verified prior to an individual’s eligibility determination being made. The Department should continue to provide this training initially to ensure all users are knowledgeable of the process, procedures, and impacts of the work they do. As changes occur to the rules/regulations, system, or process, detailed training should be required of all users on those changes. • Continuing to monitor the IEVS alert processing procedures guide for the matches issued by the Ohio Benefits system to ensure matches are properly documented within the system, worked within the proper timeframes, and proper verification documentation is obtained and maintained by the county agencies for resolved matches. • Continuing to identify and coordinate Ohio Benefits program changes to address the system design weaknesses as discovered. This should include working collaboratively with DAS to prioritize program changes which could directly impact the eligibility determinations or benefit amounts to ensure they are corrected in a timely manner to prevent and detect further improper payments. In addition, the Department should continue to evaluate these enhancements to assist DAS in determining if the desired outcome was achieved. We also recommend Department management continue to monitor the status of system enhancements and roll-out of resources to the appropriate personnel to ensure they are implemented timely and as planned.

IT – UI FUTA CERTIFICATION MATCH Finding Number: 2024-013 State Agency Number: JFS-02 Assistance Listing Numbers and Titles: 17.225 – Unemployment Insurance 17.225 COVID-19 – Unemployment Insurance Federal Award Identification Number / Year: UI-35668-21-55-A-39 / 2021 UI-37243-22-55-A-39 / 2022 UI-39342-23-55-A39 / 2023 24-A-55-UI000039 / 2024 Federal Agency: Department of Labor Compliance Requirement: Special Tests and Provisions – Match with IRS 940 FUTA Tax Form Repeat Finding from Prior Audit? No NONCOMPLIANCE AND SIGNIFICANT DEFICIENCY 26 C.F.R. § 31.3302(a)-3(a), pertaining to proof of credit states, in part: Credit against the tax for any calendar year for contributions paid into State unemployment funds shall not be allowed unless there is submitted to the district director: (a) A certificate of the proper officer of each State (the laws of which required the contributions to be paid) showing, for the taxpayer: (1) The total amount of contributions required to be paid under the State law with respect to such calendar year (exclusive of penalties and interest) which was actually paid on or before the date the Federal return is required to be filed; and (2) The amounts and dates of such required payments (exclusive of penalties and interest) actually paid after the date the Federal return is required to be filed. (b) A statement by the taxpayer that no part of any payment made by him into a State unemployment fund for such calendar year, which is claimed as a credit against the tax, was deducted or is to be deducted from the remuneration of individuals in his employ. Such statement shall contain or be verified by a written declaration that it is made under the penalties of perjury. (c) Such other or additional proof as the Commissioner or the district director may deem necessary to establish the right to the credit provided for under section 3302(a). States are required to annually certify for each taxpayer the total amount of contributions required to be paid under the State law for the calendar year and the amounts and dates of such payments in order for the taxpayer to be allowed the credit against the Federal Unemployment Tax Act (FUTA) tax (26 C.F.R. § 31.3302(a)-3(a)). In order to accomplish this certification, States annually perform a match of employer tax payments with credit claimed for these payments on the employer’s IRS 940 FUTA tax form. The State of Ohio Unemployment Resource for Claimants and Employers (SOURCE) Unemployment Insurance Tax System is the web-based system used to collect and process Ohio unemployment taxes and store and report wage information for Ohio employers. During state fiscal year 2024, approximately $1.21 billion in unemployment compensation taxes were collected and processed by the SOURCE system. However, two of 60 (3.3%) certifications selected for testing from the IRS FUTA Identification Extract did not match the payments documented in the SOURCE system. Wage reports provide the basis for possible benefit claim awards. Inaccurate reporting increases the risk taxpayers may not be able to properly claim credit against FUTA taxes. Errors or discrepancies in reporting may also require additional reporting for the employer. Based on discussion with management, the two tested certifications from the IRS FUTA Identification Extract that did not match the payments included in the SOURCE system were caused by a bug within the source code of the system that did not allow the unemployment tax payment information to be properly populated in the IRS FUTA Identification Extract. We recommend the Department review existing FUTA certification controls and update the application code to ensure tax payments meet the stated criteria for the FUTA tax credits allowance (e.g., accurate state unemployment tax filings and payments). Additionally, we recommend Department management continually monitor these controls to ensure the compliance requirements of the program, as well as management’s overall objectives, are being met.

MEDICAID CLUSTER/CHIP – INELIGIBLE RECIPIENTS Finding Number: 2024-014 State Agency Number: MCD-02 Assistance Listing Numbers and Titles: 93.767 – Children’s Health Insurance Program (CHIP) 93.767 COVID 19 – CHIP 93.775/93.777/93.778 – Medicaid Cluster 93.775/93.777/93.778 COVID-19 – Medicaid Cluster Federal Award Identification Number / Year: 2205OH5022 / 2022 (CHIP) 2305OH5023 / 2023 (CHIP) 2405OH5024 / 2024 (CHIP) 2205OH5MAP / 2022 (Medicaid) 2305OH5MAP / 2023 (Medicaid) 2405OH5MAP / 2024 (Medicaid) Federal Agency: Department of Health and Human Services Compliance Requirement: Activities Allowed or Unallowed, Allowable Costs/Cost Principles, Eligibility Repeat Finding from Prior Audit? Yes Prior Audit Finding Number: 2023-012 QUESTIONED COSTS, NONCOMPLIANCE, AND MATERIAL WEAKNESS NOTE: Finding numbers 2024-001 and 2024-015 detail deficiencies and weaknesses in internal control related to the Medicaid Cluster and CHIP programs regarding the Department’s eligibility processes. These findings are integral to and should be read in conjunction with this finding. 42 C.F.R. § 435.10, State Plan requirements, pertaining to the Medicaid Cluster states, in part A State plan must--- (a) Provide that the requirements of this part are met; and (b) Specify the groups to whom Medicaid is provided, as specified in subparts B, C, and D of this part, and the conditions of eligibility for individuals in those groups. . . 42 C.F.R. § 435.914, Case documentation, pertaining to the Medicaid Cluster states, in part: (a) The agency must include in each applicant's case record facts to support the agency's decision on his application. . . 42 C.F.R. §t 435.916, Regularly scheduled renewals of Medicaid eligibility, states in part: (a) Frequency of renewals. . . (1) The eligibility of Medicaid beneficiaries not described in paragraph (a)(2) of this section must be renewed once every 12 months, and no more frequently than once every 12 months. (2) The eligibility of qualified Medicare beneficiaries described in section 1905(p)(1) of the Act must be renewed at last once every 12 months, and no more frequently than once every 6 months. (b) Renewals of eligibility – (1) Renewal on basis of information available to agency. The agency must make a redetermination of eligibility for all Medicaid beneficiaries without requiring information from the individuals if able to do so based on reliable information contained in the individual’s account or other more current information available to the agency, including but not limited to information through any data bases accessed by the agency . . . 42 C.F.R. § 435.912(c), Timely determination and redetermination of eligibility, states in part: (3) . . . the determination of eligibility for any applicant or individual whose account was transferred from another insurance affordability program may not exceed— (i) 90 calendar days for applicants who apply for Medicaid on the basis of disability; and (ii) 45 calendar days for all other applicants. 42 U.S.C. § 1397bb(b), pertaining to the Children’s Health Insurance Program (CHIP) states, in part: (1) Eligibility Standards (A) The plan shall include a description of the standards used to determine the eligibility of targeted low-income children for child health assistance under the plan. . . 42 C.F.R. § 457.380(d), Eligibility verification pertaining to CHIP states: Income. If the State does not accept self-attestation of income, the State must verify the income of an individual by using the data sources and following standards and procedures for verification of financial eligibility consistent with § 435.945(a), § 435.948, and § 435.952 of this chapter. 42 C.F.R. § 457.960, Reporting changes in eligibility and redetermining eligibility pertaining to CHIP states: If the State requires reporting of changes in circumstances that may affect the enrollee's eligibility for child health assistance, the State must: (a) Establish procedures to ensure that enrollees make timely and accurate reports of any such change; and (b) Promptly redetermine eligibility when the State has information about these changes. Ohio Rev. Code § 5164.57(A)(1), Recovery of Medicaid Overpayments states, in part: . . . the department of medicaid may recover a medicaid payment or portion of a payment made to a medicaid provider to which the provider is not entitled if the department notifies the provider of the overpayment during the five-year period immediately following the end of the state fiscal year in which the overpayment was made. Ohio Admin. Code § 5160-26-02.1, Managed care: termination of enrollment states, in part: . . . (B) The Ohio department of Medicaid (ODM) will terminate a member from enrollment in a managed care organization [MCO] for any of the following reasons: . . . (3) The member dies, in which case MCO enrollment ends on the date of death (D) All of the following apply when enrollment in an MCO or the SPBM [Single Pharmacy Benefit Manager] is terminated for any of the reasons set forth in paragraph (B) or (C) of this rule: . . . (5) ODM shall recover from the MCO or the SPBM any capitation paid for retroactive enrollment termination occurring . . . The Medicaid and CHIP State Plan outlines the specific eligibility conditions and standards within Sections 2.2 – Coverage and Conditions of Eligibility and 2.6 A – Financial Eligibility, Eligibility Conditions and Requirements for Medicaid, and Section 4 – Eligibility Standards and Methodology for CHIP. It is management’s responsibility to implement policies and procedures to provide reasonable assurance they have complied with these requirements. As the lead agency for administering the Medicaid Cluster and CHIP federal grant awards for the State of Ohio, the Department is responsible for providing reasonable assurance only eligible individuals receive assistance and the documentation maintained is accurate, complete, and properly recorded in the Ohio Benefits system to ensure appropriate eligibility determinations. It is also the Department’s responsibility to implement sufficient controls, systems, processes, and procedures to reasonably ensure compliance with the rules and regulations associated with these programs and only eligible recipients receive benefits. The Department is responsible for overall program compliance and must have appropriate oversight and monitoring procedures in place to ensure those they rely on are operating in accordance with all expectations, guidelines, and requirements related to their tasks. During state fiscal year (SFY) 2024, the Department disbursed a combined total of $26.8 billion in public assistance benefits to recipients processed through the Ohio Benefits system related to the following programs: Assistance Listing Number & Title Benefits Paid # of Recipients* 93.767 - CHIP $758,102,089 241,067 93.775/93.777/93.778 – Medicaid Cluster $26,094,738,226 2,864,484 Combined Total $26,852,840,315 3,105,551 * We did not separately identify recipients who could be covered under both programs. These programs are administered using a multi-agency approach, as follows: overall compliance and administration of the Medicaid Cluster and CHIP programs fall under the Department, and programming and administration of the State’s eligibility determination computer system, Ohio Benefits, falls under the Ohio Department of Administrative Services (DAS). The Ohio Benefits system contains the eligibility and benefit information/determinations for these programs. The Department also, through a Memorandum of Understanding with the Ohio Department of Job & Family Services (JFS), utilizes the 88 County Departments of Job & Family Services (CDJFS) in the eligibility determination process to work with applicants, receive/enter eligibility documentation into the Ohio Benefits system, and follow up on alerts issued by the system. Currently, individuals applying to receive public assistance benefits complete an application through various methods. The CDJFS collect and maintain any documentation provided by the individual either in a paper case file or in the OnBase Enterprise Documentation Management System (EDMS) maintained under contract by DAS and utilized by the Department. After collecting documentation, the county caseworker enters the individual’s information into the Ohio Benefits system which determines the initial eligibility benefit amount and assigns the benefit aid category, where applicable. This process is also used to perform eligibility redeterminations on an annual basis or when prompted through a system alert. Once the determination is made, the Ohio Benefits system uploads the eligibility information to the Department’s new Ohio Medicaid Enterprise System’s (OMES) Fiscal Intermediary (FI) to process the provider payments. The following noncompliance was noted related to eligibility for the Medicaid Cluster and CHIP programs, which included questioned costs for Medicaid totaling $27,856 and CHIP totaling $67,373: • Six of 80 (7.5%) Medicaid recipients and nine of 80 (11.3%) CHIP recipients selected for testing were not eligible to receive benefits on the date services were performed as they were not validly enrolled beneficiaries based on information in Ohio Benefits, the State’s official eligibility determination system. Therefore, these items will result in questioned costs for all claims paid for services provided for these individuals during the time they were ineligible, totaling $27,856 for Medicaid and $67,373 for CHIP. The items noted included issues such as: o The recipient failed to timely report an increase in income and/or new employment. o The caseworker failed to timely update Ohio Benefits with an increase in income. o The wrong household size was utilized when determining eligibility; as a result, the recipient was over the income limit. o The CHIP recipient’s mother was receiving benefits from another state at the time the benefits were paid. • Six of 80 (7.5%) Medicaid recipients and nine of 80 (11.3%) CHIP recipients selected for testing were not placed in the correct benefit aid category. These errors were included in the first bullet and deemed ineligible for both programs. • Six of 80 (7.5%) Medicaid recipients and nine of 80 (11.3%) CHIP recipients selected for testing did not have adequate documentation to support the Department's decision on the recipient’s eligibility, or incorrect information was entered into Ohio Benefits. These errors were included in the first bullet and deemed ineligible for both programs. • One of 12 (8.3%) Medicaid recipients and three of 12 (25%) CHIP recipients selected for testing did not have the initial eligibility determination completed within 45 days. ADDITIONAL QUESTIONED COSTS: The Ohio Benefits system is designed to generate alerts to notify the CDJFS caseworkers of a deceased match. The Department has 10 calendar days to process a re-determination when a change has been reported affecting a recipient’s ongoing eligibility. When the Department has been notified of a potential death of a recipient, the recipient is to be removed from managed care and placed in fee for service until confirmation of the death is received. An analysis of the Medicaid Cluster’s managed care capitation payments and the fee for service medical claims paid during SFY 2024 were compared to the death master file received from the Ohio Department of Health to identify any payments with a capitation month or date of service after the recipient’s date of death. The Department made 7,408 payments, totaling $946,941, on behalf of 1,190 deceased individuals receiving Medicaid benefits. We selected 50 of the 1,190 deceased individuals for further testing to determine if the Department took the appropriate action to identify and/or recover the payments. Thirty-one of 50 (62%) Medicaid recipients tested had an unallowable capitation or fee for service payment made on behalf of these deceased individuals which was not recovered by the Department, resulting in questioned costs, totaling $252,991. We also noted the following regarding these 31 recipients: o The system indicated CDJFS caseworkers sent death inquiries to family members, caretakers, and/or facilities to verify the date of death; however, no responses were received, and no further follow-up action was taken. o The Department processed nursing facility claims for eight recipients in which questioned costs were noted, totaling $60,046. These per diem claims are submitted monthly and include the dates for which the recipient is considered a resident of the nursing facility. The Department will complete a post payment review of these claims to identify and correct any billing issues due to the recipient’s death. o The Department recouped overpayments or reversed unallowable claims for eight recipients, totaling $223,530, and collected partial recoupments for 12 different recipients, totaling $64,013. The questioned costs noted above only includes the outstanding amounts. The items noted above under Noncompliance and Additional Questioned Costs resulted in questioned costs for both the Medicaid Cluster and CHIP, as summarized in the table below: Summary of Questioned Costs by Category Medicaid Cluster CHIP Ineligible Recipients $ 27,856 $67,373 Deceased Individuals $252,991 N/A* Total Questioned Costs: $280,847 $67,373 *We did not complete testing over deceased individuals for CHIP since the related payments were only $200. Without proper controls for entering, processing, and maintaining recipient information, including working system alerts in a timely manner, there is an increased risk that benefits paid to or on behalf of recipients will be inaccurate or unallowable. Overpayments or payments to or on behalf of ineligible recipients may subject the Department to penalties or sanctions which may jeopardize future funding and limit its ability to fulfill program requirements to provide benefits to those in need. Based on discussions with management, the issues identified were caused by oversight and systemic issues. We recommend the Department evaluate and seek reimbursement for all claims that were incorrectly paid. We also recommend management continue to work collectively with the related state agencies to implement/update robust processes, procedures, and system programming to address the weaknesses in the overall eligibility process, including those associated with the Ohio Benefits system. We also recommend the Department regularly evaluate selected benefit payments to verify the recipient’s eligibility, verify the recipient information entered into Ohio Benefits by the CDJFS is accurate and the information is being maintained to support the Department’s eligibility decision, and ensure initial eligibility determinations and redeterminations are completed timely. Any problems noted should be promptly corrected to reduce the risk of benefit payments being made on behalf of ineligible individuals and additional training provided to the State and/or county employees affected. Lastly, we recommend the Department evaluate current processes for identifying deceased individuals to ensure Ohio Benefits and OMES FI are updated in a timely manner. Controls should be implemented to ensure CDJFS caseworkers are following up with the Social Security Administration, Ohio Department of Health, or other death indicators in a timely manner. This should include developing a process for confirming an individual’s death if the family member, caretaker, or facility is not responding to the CDJFS caseworkers and ensuring the recipient is disenrolled from the managed care plan and converted to fee for services until date of death is confirmed. We further recommend the Department develop procedures to identify the improper payments to providers on behalf of deceased individuals and seek recovery, reimbursement, or offset future payments, when necessary.

MEDICAID CLUSTER/CHIP – IEVS ALERTS Finding Number: 2024-015 State Agency Number: MCD-03 Assistance Listing Numbers and Titles: 93.767 – Children’s Health Insurance Program (CHIP) 93.767 COVID-19 – CHIP 93.775/93.777/93.778 – Medicaid Cluster 93.775/93.777/93.778 COVID-19 – Medicaid Cluster Federal Award Identification Number / Year: 2205OH5022 / 2022 (CHIP) 2305OH5023 / 2023 (CHIP) 2405OH5024 / 2024 (CHIP) 2205OH5MAP / 2022 (Medicaid Cluster) 2305OH5MAP / 2023 (Medicaid Cluster) 2405OH5MAP / 2024 (Medicaid Cluster) Federal Agency: Department of Health and Human Services Compliance Requirement: Eligibility Repeat Finding from Prior Audit? Yes Prior Audit Finding Number: 2023-014 NONCOMPLIANCE AND MATERIAL WEAKNESS NOTE: Finding number 2024-014 details deficiencies and weaknesses in internal control related to the Medicaid Cluster and CHIP programs regarding the Department’s eligibility processes. This finding is integral to and should be read in conjunction with this finding. 42 C.F.R. § 435.945 states, in part, the following regarding the Medicaid Cluster program: (a) Except where the law requires other procedures . . . the agency may accept attestation of information needed to determine the eligibility of an individual for Medicaid . . . without requiring further information (including documentation) from the individual. (b) The agency must request and use information relevant to verifying an individual's eligibility for Medicaid in accordance with § 435.948 through § 435.956 . . . 42 C.F.R. § 457.380, states, in part, the following regarding the Children’s Health Insurance Program (CHIP): (a) General requirements. Except where law requires other procedures . . . the State may accept attestation of information needed to determine the eligibility of an individual for CHIP. . . without requiring further information (including documentation) from the individual. (b) Status as a citizen, national or a non-citizen. (1) Except for newborns identified in § 435.406(a)(1)(iii)(E) of this chapter, who are exempt from any requirement to verify citizenship, the agency must— . . . (ii) Provide a reasonable opportunity period to verify such status in accordance with § 435.956(a)(5) and (b) of this chapter and provide benefits during such reasonable opportunity period to individuals determined to be otherwise eligible for CHIP. Furthermore, 42 U.S.C. § 1320b–7(a) Requirements of State eligibility systems states, in part: In order to meet the requirements of this section, a State must have in effect an income and eligibility verification system which meets the requirements of subsection (d) and under which— (1) the State shall require, as a condition of eligibility for benefits under any program listed in subsection (b), that each applicant for or recipient of benefits under that program furnish to the State his social security account number (or numbers, if he has more than one such number), and the State shall utilize such account numbers in the administration of that program so as to enable the association of the records pertaining to the applicant or recipient with his account number; (2) wage information from agencies administering State unemployment compensation laws available pursuant to section 3304(a)(16) of the Internal Revenue Code of 1986, wage information reported pursuant to paragraph (3) of this subsection, and wage, income, and other information from the Social Security Administration and the Internal Revenue Service available pursuant to section 6103(l)(7) of such Code, shall be requested and utilized to the extent that such information may be useful in verifying eligibility for, and the amount of, benefits available under any program listed in subsection (b), as determined by the Secretary of Health and Human Services . . . . (4) the State agencies administering the programs . . . adhere to standardized formats and procedures . . . under which — (A) the agencies will exchange with each other information in their possession which may be of use in establishing or verifying eligibility or benefit amounts under any other such program . . . (C) the use of such information shall be targeted to those uses which are most likely to be productive in identifying and preventing ineligibility and incorrect payments. . . . In order to comply with 42 C.F.R. § 435.945 and 42 U.S.C. § 1320b-7, the State of Ohio codified specific rules related to its Income Eligibility Verification System (IEVS) in the Ohio Administrative Code. Ohio Admin. Code 5160:1-1-04 states, in part: (A) This rule describes the requirements in section 1137 of the Social Security Act and in section 42 C.F.R. 435.945 . . . requiring state agencies administering certain federally funded, state administered public assistance programs, to establish procedures for obtaining, using and verifying information relevant to determinations of eligibility. The Ohio department of medicaid shall obtain and share income and benefit information with the following sources: (1) The social security administration (SSA). (2) The internal revenue service (IRS). (3) The state wage information collection agency (SWICA). (4) Agencies administering the unemployment compensation (UC) benefits. . . . (C) Administrative agency responsibilities. Within forty-five days of receipt of the information, the administrative agency shall initiate, pursue, and complete the actions specified . . . (3) Review and compare against the case record all information received from the IEVS data matches to determine whether the information affects the individual's eligibility, in accordance with 42 C.F.R. 435.948. (4) Obtain additional information or documentation from the individual, if needed, to determine eligibility and initiate appropriate action in accordance with 42 C.F.R. 435.952(c). (5) . . . The administrative agency shall verify information. . . . (6) Update case information and redetermine eligibility when the verification received is discrepant from information currently listed in the electronic eligibility system. . . . As the lead agency responsible for administering the Medicaid Cluster and CHIP federal programs for the State of Ohio, the Department is responsible for providing reasonable assurance only eligible individuals receive assistance and documentation maintained is accurate, complete, and properly recorded in the Ohio Benefits system to ensure appropriate eligibility determinations. It is the Department’s responsibility to implement sufficient controls, systems, processes, and procedures to reasonably ensure compliance with the rules and regulations associated with these programs and only eligible recipients receive benefits. When automated systems are utilized to perform certain functions related to this compliance, management must ensure the system is properly designed and operating effectively. The Department is also responsible for overall program compliance and must have appropriate oversight and monitoring procedures in place to ensure those they rely on are operating in accordance with all expectations, guidelines, and requirements related to their tasks. The Medicaid Cluster and CHIP federal programs are administered using a multi-agency approach: overall compliance and administration of the programs fall under the Department, and programming and administration of the State’s eligibility determination computer system, Ohio Benefits, falls under the Ohio Department of Administrative Services (DAS). The Department also, through a Memorandum of Understanding with the Ohio Department of Job & Family Services (JFS), utilizes the 88 Ohio counties in the eligibility determination process to work with applicants, receive/enter eligibility documentation into the Ohio Benefits system, and follow up on alerts issued by the system. The Ohio Benefits system was utilized for processing eligibility for the Medicaid Cluster and CHIP programs’ recipients with total expenditures of approximately $26.1 billion and $758.1 million, respectively during state fiscal year (SFY) 2024. The Ohio Benefits system contains the eligibility and benefit information/determinations for these programs, including the Income Eligibility Verification System (IEVS) functionality which compares reported recipient income to income information maintained by outside data sources (Social Security Administration, Internal Revenue Service (IRS), etc.). Information that does not agree is communicated in the form of an Ohio Benefits system alert. The Ohio Benefits system then determines if the alert is a ‘match’ that requires action. The IEVS match, indicated by ‘Yes’ in the Ohio Benefits system, is forwarded to the appropriate county agency for investigation and resolution. Each match has a defined due date, which is unique based on the priority level and other policy and process related factors. However, we noted the following weaknesses: • Volume of Alerts – During SFY 2024, more than 21.2 million alerts (2.8 million IEVS alerts and 18.4 million non-IEVS alerts) were issued for all public assistance programs that utilize Ohio Benefits, including the Medicaid Cluster and CHIP programs. Alerts can be generated by Ohio Benefits via interface outputs/updates, batch outputs, or other triggers within the system. The volume of incoming alerts/matches being sent to the county caseworkers results in an increased workload and ineffective application of the alert process. • Caseworker Reliance/Training – The current process relies heavily on the knowledge and judgement of county caseworkers in the eligibility process, including reviewing IEVS matches. The Department relies heavily on JFS to coordinate with and provide statewide and individual trainings for county agencies to assist them in working IEVS alerts/matches; however, these trainings are typically optional and/or attended by a representative of the county agency who is expected to relay the information to others. Additionally, we noted the following noncompliance with federal regulations where IEVS alerts were not cleared timely. • Clearing Alerts – While the Department has controls and procedures in place to review and monitor IEVS alerts and matches generated and processed by the Ohio Benefits system, there were instances when matches were not being completed by the county agencies in accordance with the required timeframes. Furthermore, an Ohio Benefits data file containing IEVS matches showed 897,093 of the 1,783,944 (50.3%) IEVS alerts sent to the county agencies during the audit period were not cleared within 45 days as required. The matches were cleared between one and 448 days beyond the 45-day requirement, for an average of 225 days late. Failure to implement system enhancements timely, perform monitoring activities, mandate training for county caseworkers, and complete IEVS alerts within the established timeframe increases the risk benefits given to ineligible recipients or for inappropriate amounts will not be identified timely. This condition could adversely affect the Department’s ability to comply with IEVS requirements for these federal programs which could result in federal sanctions or penalties. Based on discussions with management, the high volume of alerts generated likely caused the timeliness issues. Management indicated they will continue to work with JFS and DAS to enhance the statewide eligibility system to reduce the high volume of alerts. We recommend the Department continue to work collectively with the related state agencies to implement/update robust processes, procedures, and system controls to address the weaknesses associated with the IEVS process within the Ohio Benefits system. These changes/updates should include, but not be limited to: • Including a more centralized evaluation of alert/match activity and/or better use of automated tools to vet and prioritize items requiring follow-up at the county level. This would allow Department level personnel to become more experienced and adept at identifying and investigating anomalies and help focus the resources of both Department and county personnel. • Requiring mandatory IEVS training for all county agency employees who are entering the assistance group information into Ohio Benefits to help ensure proper and complete information is being collected, entered, and verified prior to an individual’s eligibility determination being made. The Department should continue to provide this training initially to ensure all users are knowledgeable of the process, procedures, and impacts of the work they do. As changes occur to the rules/regulations, system, or process, detailed training should be required of all users on those changes. • Continuing to monitor the IEVS alert processing procedures guide for the matches issued by the Ohio Benefits system to ensure matches are properly documented within the system, worked within the proper timeframes, and proper verification documentation is obtained and maintained by the county agencies for resolved matches. • Continuing to identify and coordinate Ohio Benefits program changes to address the system design weaknesses as discovered. This should include working collaboratively with DAS to prioritize program changes which could directly impact the eligibility determinations or benefit amounts to ensure they are corrected in a timely manner to prevent and detect further improper payments. In addition, the Department should continue to evaluate these enhancements to assist DAS in determining if the desired outcome was achieved. We also recommend the Department continue to monitor the status of system enhancements and roll-out of resources to the appropriate personnel to ensure they are implemented timely and as planned.

IT – MEDICAID CLUSTER/CHIP – PROVIDER REVALIDATIONS Finding Number: 2024-016 State Agency Number: MCD-04 Assistance Listing Numbers and Titles: 93.767 – Children’s Health Insurance Program (CHIP) 93.767 COVID-19 – CHIP 93.775/93.777/93.778 – Medicaid Cluster 93.775/93.777/93.778 COVID-19 – Medicaid Cluster Federal Award Identification Numbers / Years: 2205OH5022 / 2022 (CHIP) 2305OH5023 / 2023 (CHIP) 2405OH5024 / 2024 (CHIP) 2205OH5MAP / 2022 (Medicaid Cluster) 2305OH5MAP / 2023 (Medicaid Cluster) 2405OH5MAP / 2024 (Medicaid Cluster) Federal Agency: Department of Health and Human Services Compliance Requirement: Special Tests and Provisions – Provider Eligibility Repeat Finding from Prior Audit? Yes Prior Year Finding Number: 2023-15 NONCOMPLIANCE AND MATERIAL WEAKNESS 42 C.F.R. § 455.414, Revalidation of enrollment, states: The State Medicaid agency must revalidate the enrollment of all providers regardless of provider type at least every 5 years. It is management’s responsibility to develop and implement internal control procedures to validate provider licenses timely to ensure their eligibility to continue participation in the Medicaid Cluster and CHIP programs. During state fiscal year 2024, the Department disbursed approximately $26.1 billion for the Medicaid Cluster and $758.1 million for Children’s Health Insurance Program (CHIP). The Department administers the Ohio Medicaid Enterprise System (OMES), an automated application, to determine if services provided to eligible recipients were by an eligible provider and allowable prior to payment. The Department’s provider revalidation process requires all providers (except Managed Care) be subject to a 5-year or 3-year time limited agreement if they are required to be recredentialed. With the implementation of the OMES Provider Network Management (PNM) module and centralized credentialing, a provider’s revalidation is initiated by the Department 120 days prior to the Medicaid Agreement end date. A 120-day Revalidation Notice is sent to the provider which contains the Registration ID and instructions on how to enter the PNM portal in order to revalidate their provider agreement. Providers are also issued a 90-day, 60-day, and 30-day notice if the revalidation has not been initiated at any of these points in time. However, for six of 60 (10%) providers selected for testing, the Re-Enrollment Due Date did not agree with the Revalidation Date documented in the PNM module. If the provider revalidation process is not properly followed and adequately documented, the Department increases the risk of disbursing unallowable payments to ineligible Medicaid Cluster and CHIP providers. Failure to comply with federal laws and regulations could result in a reduction of future federal funding or sanctions imposed by the federal grantor agency. Based on discussions with management, the inaccurate dates were caused by at least three software issues with setting revalidation dates. We recommend the Department follow its documented provider revalidation processes and procedures to help ensure the enrollment of all providers are properly revalidated and the re-enrollment due dates agree with the dates in the PNM module. We also recommend the Department work with its vendor to correct any system defects in the provider revalidation process to help ensure providers are properly revalidated.

IT – MEDICAID/CHIP – PROVIDER LICENSE RENEWAL AND EXCEPTION REPORTS Finding Number: 2024-017 State Agency Number: MCD-05 Assistance Listing Numbers and Titles: 93.767 – Children’s Health Insurance Program (CHIP) 93.767 COVID-19 – CHIP 93.775/93.777/93.778 – Medicaid Cluster 93.775/93.777/93.778 COVID-19 – Medicaid Cluster Federal Award Identification Number / Year: 2205OH5022 / 2022 (CHIP) 2305OH5023 / 2023 (CHIP) 2405OH5024 / 2024 (CHIP) 2205OH5MAP / 2022 (Medicaid Cluster) 2305OH5MAP / 2023 (Medicaid Cluster) 2405OH5MAP / 2024 (Medicaid Cluster) Federal Agency: Department of Health and Human Services Compliance Requirement: Special Tests and Provisions – Provider Eligibility Repeat Finding from Prior Audit? Yes Prior Audit Finding Number: 2023-016 NONCOMPLIANCE AND MATERIAL WEAKNESS 42 C.F.R. § 455.412, Verification of provider licenses, states: The State Medicaid agency must do all of the following: (a) Have a method for verifying that any provider purporting to be licensed in accordance with the laws of any State is licensed by such State. (b) Confirm that the provider’s license has not expired and that there are no current limitations on the provider’s license. It is management’s responsibility to develop and implement internal control procedures to reasonably ensure provider licenses are properly verified. Management is also responsible for ensuring the internal control procedures are operating effectively throughout the audit period. During state fiscal year (SFY) 2024, the Department disbursed approximately $26.1 billion for the Medicaid Cluster and $758.1 million for the Children’s Health Insurance Program (CHIP). The Department administers the Ohio Medicaid Enterprise System (OMES), which is an automated application, to determine if the services provided to eligible recipients were by an eligible provider and allowable prior to payment. During the audit period, the Department had a variety of processes in place to help ensure providers were eligible to provide medical services, including provider revalidation (required every five or three years), generating and reviewing of the monthly license renewal report, identification and termination of providers with disciplinary action taken by the State licensing boards, and automated checks against exclusion databases over the entire provider master file. The Department also had an automated process in place to update the provider license records in OMES monthly, with data received from the State licensing boards via the eLicense system. License Exception Reports are generated by OMES when the system is unable to update the license information (out-of-state providers, name mismatches, etc.) or when the matching criteria is unable to make a 100% match via the automated process. The Department maintains procedures for manually reviewing and updating license information for providers who are documented on these exception reports; however, the following exceptions were noted: • Review and manual updating of 'Out of State' provider licenses on the License Renewal Reports was not completed timely (ranging from two to 10 months after the reporting month) for all 12 months of SFY 2024. • Review and manual updating of ‘Ohio’ provider licenses on the License Renewal Reports was not fully completed for nine of 12 months of SFY 2024. For the other three months of SFY 2024, the reports were worked in full, but not timely (ranging from five to 12 months after the reporting month). • Between July 2023 and March 2024, the eLicense job error reports did not contain the job verification exceptions report; therefore, it could not be manually reviewed for these months. The eLicense job error reports for April 2024, May 2024, and June 2024 contained the job verification exception report; however, there was no evidence of Department staff’s manual review of the verification exception reports. Without complete and timely reviews of provider licensing, there is an increased risk payments will be made to unlicensed, ineligible providers, resulting in the misuse of state resources or federal program monies. This could result in the federal awarding agency requiring the Department to repay these funds or imposing penalties or sanctions. Based on discussion with management, due to the system transition from the Medicaid Information Technology System to the OMES Provider Network Management (PNM) module, the license job error reports were not fully initiated until May 2023. Once the eLicense automated check was in place, the Department experienced a large volume of false positive matches on the Ohio e-License verification, resulting in a high number of exceptions to be reviewed and verified manually. While the Department added staff resources to perform the manual review and verification, it was a time-consuming process, and the Department experienced delays. The sheer volume of exceptions on this report was not manageable even with the addition of more staff, which resulted in delayed reviews and incomplete in-state reviews. Needed refinements to the match criteria for the monthly eLicense automated check and an automated process to terminate out of state licensed providers that did not make updates to their license information did not occur before the end of fiscal year 2024. Additionally, out of state providers are identified on the License Renewal Report. For the audit period, the Department manually reviewed and verified licenses for out of state providers. However, the Department experienced longer delays completing these reviews for the first 6 months of the state fiscal year due to staffing issues but started to see improvements in the second half of the state fiscal year. We recommend the Department reinforce and strengthen internal control procedures over the License Renewal Reports and eLicense job error reports reviews to ensure providers are eligible to provide services to Medicaid Cluster and CHIP recipients. The Department should ensure these report reviews are completed timely, consistently, and are properly documented/maintained. Management should periodically monitor these procedures to ensure they are operating effectively and as intended.

MEDICAID CLUSTER/CHIP – SURVEILLANCE UTILIZATION REVIEWS Finding Number: 2024-018 State Agency Number: MCD-06 Assistance Listing Numbers and Titles: 93.767 – Children’s Health Insurance Program (CHIP) 93.767 COVID-19 – CHIP 93.775/93.777/93.778 – Medicaid Cluster 93.775/93.777/93.778 COVID-19 – Medicaid Cluster Federal Award Identification Numbers / Years: 2205OH5022 / 2022 (CHIP) 2305OH5023 / 2023 (CHIP) 2405OH5024 / 2024 (CHIP) 2205OH5MAP / 2022 (Medicaid Cluster) 2305OH5MAP / 2023 (Medicaid Cluster) 2405OH5MAP / 2024 (Medicaid Cluster) Federal Agency: Department of Health and Human Services Compliance Requirement: Special Tests and Provisions – Utilization Control Repeat Finding from Prior Audit? Yes Prior Year Finding Number: 2023-013 SIGNIFICANT DEFICIENCY The Ohio Department of Medicaid (the Department) is the lead agency responsible for administering the Medicaid Cluster and CHIP federal grant programs for the State of Ohio. It is the Department’s responsibility to design and implement a system of internal controls to safeguard against unnecessary utilization of care and services associated with the Medicaid Cluster and CHIP programs. The Department is responsible for overall program compliance and must have appropriate oversight and monitoring procedures in place to ensure its statewide surveillance and utilization program safeguards against unnecessary or inappropriate use of Medicaid services against excess payments, assesses the quality of those services, and provides for the control of the utilization of all services provided under the state plan. During state fiscal year (SFY) 2024, the Department disbursed approximately $26.1 billion and $758.1 million in Medicaid Cluster and CHIP benefits, respectively, to providers for the managed care program and the fee for service medical claims through the Ohio Medicaid Enterprise System (OMES) Fiscal Intermediary (FI) module. The Department’s Surveillance and Utilization Review section utilized a vendor to identify the over-utilization of inpatient and outpatient hospital Medicaid services, including the State’s psychiatric hospitals. The vendor supports the Department by reviewing medical claims to determine if they were for an allowable use according to program requirements. If the vendor identifies an improper claim (i.e., billing errors, lack of pre-admission review, lack of medical necessity, etc.), the take back claim (an adjustment request for the provider overpayment) information is recorded on an inpatient/outpatient report and provided to the Department. However, in September 2023 the Department suspended the processing of these inpatient and outpatient hospital take back claims through OMES FI which resulted in the Department postponing the recoupment of provider overpayments. Furthermore, the Department anticipates a backlog of take back claims that will need to be reviewed and processed once the system is fixed. A lack of effective internal controls related to the over utilization of inpatient and outpatient hospital claims, increases the risk of improper and/or unnecessary medical claims going undetected. By not safeguarding against unnecessary or inappropriate use of Medicaid and CHIP services, there is an increased risk of provider payments being noncompliant with federal program requirements. Based on discussions with the Department, this issue was caused by the inability to override certain edits in OMES FI resulting in ineffective processing of take back claims. We recommend the Department re-evaluate its internal controls over its utilization reviews to reasonably ensure the inpatient and outpatient hospital take back claims are processed through the OMES FI module accurately and in a timely manner. The Department should take the necessary steps to correct the edits attributing to the untimely and ineffective processing of these take back claims. The Department should also develop and implement a process for reviewing the backlog of these take back claims to reasonably ensure improper payments to providers are recouped in a timely manner.

OPIOID STR & SUPTRS BG – CASH MANAGEMENT Finding Number: 2024-019 State Agency Number: MHA-01 Assistance Listing Number and Title: 93.788 – Opioid STR 93.959 – Substance Use, Prevention, Treatment and Recovery Services Block Grant (SUPTRS BG) 93.959 – COVID -19 SUPTRS BG Federal Award Identification Number / Year: H79TI085753 / 2022 (Opioid STR) B08TI083961 / 2021 (SUPTRS BG) Federal Agency: Department of Health and Human Services Compliance Requirement: Cash Management Repeat Finding from Prior Audit? No NONCOMPLIANCE AND MATERIAL WEAKNESS U.S. Treasury regulations, 31 C.F.R. Part 205, which implemented the Cash Management Improvement Act of 1990 (CMIA), require state recipients enter into agreements that prescribe specific methods of drawing down Federal funds (funding techniques) for selected large programs. The Opioid STR and SUPTRS BG programs were not included in the state fiscal year 2024 CMIA Agreement; therefore, 31 C.F.R. § 205.33(a) sets guidelines which states, in part: A State must minimize the time between the drawdown of Federal funds from the Federal government and their disbursement for Federal program purposes. A Federal Program Agency must limit a funds transfer to a State to the minimum amounts needed by the State and must time the disbursement to be in accord with the actual, immediate cash requirements of the State in carrying out a Federal assistance program or project. The timing and amount of funds transfers must be as close as is administratively feasible to a State's actual cash outlay for direct program costs and the proportionate share of any allowable indirect costs… The Department draws federal funds for the Opioid STR and SUPTRS BG programs similarly to those which follow the Modified Pre-Issuance funding technique and considers eight business days a reasonable amount of time to disburse the drawn federal funds for program expenses. It is management’s responsibility to implement control policies and procedures to reasonably ensure draws of federal funds are for immediate cash needs, processed accurately, and disbursed timely in accordance with applicable laws and regulations. During state fiscal year 2024, the Department drew down approximately $109.4 million and $82.3 million in federal funding for the Opioid STR program and the SUPTRS BG program, respectively. Once voucher payments are approved in the Ohio Administrative Knowledge System (OAKS) and the Payment Management System (PMS), the Department draws the Opioid STR and SUPTRS BG funds electronically from PMS to cover the amount of the vouchers, as the account is to maintain a zero cash balance. Before drawing down funds, the Senior Financial Analyst prepares a Cash Request noting the amount to be drawn and OAKS coding. The Cash Request is then forwarded to a different Senior Financial Analyst who draws the funds down in PMS and sends the support documentation back to the original analyst for creation of the revenue receipt in OAKS. The revenue receipt is then submitted to the Community Funding Operations Manager and Ohio Treasurer of State’s Office for approval. Once approved, the Department makes a payment in the form of an electronic funds transfer or check. However, the Department's controls did not prevent noncompliance with the cash management timeliness requirements as follows: • Of 19 disbursements tested from 19 Opioid STR draws, the Department did not disburse two payments (10.5%) within eight business days of the receipt of federal funds, as required by 31 C.F.R. § 205.33(a). The Department disbursed the funds two and 33 days after the required disbursement date. • Of 18 disbursements tested from 18 SUPTRS BG draws, the Department did not disburse one payment (5.6%) within eight business days of receipt of federal funds, as required by 31 C.F.R. § 205.33(a). The Department disbursed the funds 15 days after the required disbursement date. Not having effective controls over the timely disbursement of federal funds could lead to the Department not limiting draws to immediate cash needs and not expending funds timely. This could result in noncompliance with 31 C.F.R. § 205.33(a) and could subject the Department to sanctions, other penalties, or a repayment of part of the grant award amounts. In addition, noncompliance could subject the Department to paying interest charges on these draws. Based on discussions with management and review of supporting documents, this was caused by voucher processing and approval delays. We recommend the Department evaluate its existing cash management control procedures and update them as necessary to reasonably ensure all federal draw requests are disbursed timely and are drawn only for immediate cash needs, based on the funding technique established in accordance with 31 C.F.R. § 205.33(a). We also recommend the Department establish procedures to periodically monitor its compliance with the cash management requirements and initiate necessary actions to resolve any noncompliance that results.

ABANDONED MINE LAND RECLAMATION – TRANSPARENCY ACT REPORTING Finding Number: 2024-020 State Agency Number: DNR-01 Assistance Listing Number and Title: 15.252 – Abandoned Mine Land Reclamation Federal Award Identification Numbers / Years: S18AF20022 / 2018 S19AF20016 / 2019 S20AF20010 / 2020 S21AF10044 / 2021 S21AF10034 / 2021 S22AF00035 / 2022 S22AF00025 / 2022 S23AF00045 / 2023 S23AF00006 / 2023 S23AF00103 / 2023 S24AF00033 / 2024 Federal Agency: Department of Interior Compliance Requirement: Reporting Repeat Finding from Prior Audit? No NONCOMPLIANCE AND MATERIAL WEAKNESS The Federal Funding Accountability and Transparency Act (Pub. L. No. 109-282, as amended by Section 6202 of Public Law 110-252, hereafter referred to as the “Transparency Act” that are codified in 2 C.F.R. Part 170) requires prime recipients of federal awards who make first-tier subawards to report the subaward on the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS) website maintained by the federal Office of Management and Budget. Under the requirements of 2 C.F.R. Part 170, recipients (i.e., direct recipients) of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more on the FSRS website. Prime recipients must report by the end of the month following the month in which the obligation is made. It is management’s responsibility to design and implement internal controls to reasonably ensure compliance with laws and regulations and to ensure management’s objectives are achieved. The State of Ohio is considered the prime recipient for federal funds applicable to Transparency Act reporting and the state agencies receiving these federal funds are expected to report the subawards obligated in accordance with the Transparency Act. During state fiscal year 2024, the Ohio Department of Natural Resources (the Department) obligated approximately $22 million for 9 subawards which exceeded $30,000 and were required to be reported on the FSRS website in accordance with the Transparency Act for the Abandoned Mine Land Reclamation program. However, the Department did not have controls in place and did not submit subawards within the FSRS website during the audit period for the Abandoned Mine Land Reclamation program. As a result, the following errors were noted: Transactions Tested Subaward not reported Report not timely Subaward amount incorrect Subaward missing key elements 9 9 0 0 0 Dollar Amount of Tested Transactions Subaward not reported Report not timely Subaward amount incorrect Subaward missing key elements $22,717,981 $22,717,981 $0 $0 $0 By not complying with federal Transparency Act reporting requirements, the Department risks federal funding being reduced, taken away, or other sanctions imposed by the federal grantor agency. If the subawards are not reported within FSRS, the risk exists that those using the Transparency Reports could be relying on inaccurate information. Based on discussion with management, this issue was caused by oversight of the federal Transparency Act reporting requirements by the Department. We recommend the Department design and implement internal control procedures to collect and report on the FSRS website complete and accurate information regarding subawards made for the Abandoned Mine Land Reclamation’s Transparency Act reporting requirements. These procedures should include a supervisory review of the report information before it is submitted on the FSRS website. Management should periodically review these control procedures to ensure they are operating as intended.

2 C.F.R. § 2400.101 gives regulatory effect to the Department of Housing and Urban Development for 2 C.F.R.§ 200.303(a) which states, in part, that the non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). The Housing Assistance Payment contract or contract amendment for one out of sixty (2%) transactions tested was not reviewed and approved by the Executive Director as evidenced by a lack of a signature on the contract/amendment. The Voucher Control Sheet for four out of sixty (7%) transactions tested was not reviewed and approved by the HCV Supervisor as evidenced by lack of initials on the Voucher Control Sheet. The Authority should establish and implement policies and procedures to verify all internal controls over federal programs are operating effectively to prevent unallowable expenditures from being made in future audits, which could lead to potential findings for recovery or federal questioned costs.

Noncompliance and Material Weakness 2 C.F.R. § 376.10 gives regulatory effect to the Department of Health and Human Services for 2 C.F.R. Part 180. 2 C.F.R. § 180.220(b) provides that a contract for goods or services is a covered transaction if the contract is awarded by a participant in a nonprocurement transaction that is covered under § 180.210, and the amount of the contract is expected to equal or exceed $25,000. 2 C.F.R. § 376.220 states that in addition to the contracts covered under 2 C.F.R. § 180.220(b), this part also applies to all lower tiers of subcontracts under covered nonprocurement transactions, as permitted under the OMB guidance at 2 C.F.R. § 180.220(c). 2 C.F.R. § 180.300 provides that when you enter into a covered transaction with another person at the next lower tier, you must verify that the person with whom you intend to do business is not excluded or disqualified. You do this by: (a) checking SAM exclusions; or (b) collecting a certification from that person; or (c) adding a clause or condition to the covered transaction with that person. 45 C.F.R. § 75.329 provides the procurement methods required for non-Federal entities. 45 C.F.R. § 75.329(b) states small purchase procedures are those relatively simple and informal procurement methods for securing services, supplies, or other property that do not cost more than the Simplified Acquisition Threshold. If small purchase procedures are used, price or rate quotations must be obtained from an adequate number of qualified sources. Additionally, Board Policy VII-A.10 “Federal Funds - Procurement” provides procedures for the small purchases procurement method, including obtaining the required price quotes from at least three qualified sources. The policy also states that the Fiscal Manager shall confirm that the supplier is not debarred or suspended by doing one of the following: checking the Federal government's System for Award Management, which maintains a list of such debarred or suspended vendors at www.sam.gov; collecting a certification from the supplier; or adding a clause or condition to the covered transaction with that supplier. The Board did not have proper internal controls in place to ensure that procurement procedures were followed. Also, the Board did not have the proper internal controls in place to verify that all entities, with whom the Board had entered into covered transactions, had not been suspended or debarred. During testing for Opioid State Targeted Response Grant, we noted three instances of a payment to a vendor of more than $25,000 and there was no evidence the Board checked the SAM exclusions, collected a certification from the entity, or added a clause or condition to the covered transaction with the vendor. Due to the deficient internal control structure, the required verification was not completed for the three covered transactions in the Opioid State Targeted Response Grant Failing to have the appropriate controls in place may result in vendors receiving federal funds that are suspended or debarred. Prior to contracting with vendors that will be paid with federal funds, the Board should ensure that procurement requirements are followed. In addition, the Board should verify that the vendor is not suspended or debarred by checking the SAM exclusions, collecting a certification from the vendor, or adding a clause or condition to the covered transaction with the vendor. Officials’ Response: See Corrective Action Plan.

Noncompliance and Material Weakness 45 C.F.R. § 75.352(a) and (d) requires that all pass-through entities must ensure that every subaward is clearly identified to the subrecipient as a subaward and includes the following information at the time of the subaward and if any of these data elements change, include the changes in subsequent subaward modification. Required information includes federal award identification, federal award notification and all requirements imposed by the pass through-entity on the subrecipient so that the Federal award is used in accordance with Federal statues, regulations, and the terms and conditions of the Federal award. Additionally, the pass-through entity must monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. Although the Board entered into an agreement with Ohio Guidestone for several types of services, the Board did not include the required information indicating that the provider was a subrecipient of the Opioid State Targeted Response grant. The Board also did not properly monitor the activity of the subrecipient related to the grant requirements. Without adequate procedures in place to monitor subrecipient compliance with federal statutes, laws and regulations, there is an increased risk subrecipients may misuse subaward funds for unauthorized purposes. This could lead to fines, penalties, or repayment of program funding being imposed by the federal grantor agency. The Board should evaluate its current control procedures and processes over subrecipient monitoring and update them as necessary to reasonably ensure compliance with 45 C.F.R. § 75.352. The Board should ensure that subrecipients are properly notified of the subaward along with the requirements imposed by the pass through-entity on the subrecipient. The Board should also perform monitoring procedures over the subrecipient activity to ensure that the grant requirements are met. Officials’ Response: See Corrective Action Plan.

EMERGENCY RENTAL ASSISTANCE PROGRAM – PERIOD OF PERFORMANCE Finding Number: 2023-002 State Agency Number: DEV-01 Assistance Listing Number and Title: 21.023 COVID-19 – Emergency Rental Assistance Program Federal Award Identification Number / Year: ERA0006 / 2021 Federal Agency: Department of Treasury Compliance Requirement: Period of Performance Repeat Finding from Prior Audit? No QUESTIONED COSTS 15 U.S.C. § 9058a(e)(1) Emergency rental assistance states: Funds provided to an eligible grantee under a payment made under this section shall remain available through September 30, 2022. 2 C.F.R. § 1000.10 gives regulatory effect to the Department of Treasury for 2 C.F.R. Part 200 § 344(b), which establishes requirements over the federal awards and states: Unless the Federal awarding agency or pass-through entity authorizes an extension, a non-Federal entity must liquidate all financial obligations incurred under the Federal award no later than 120 calendar days after the end date of the period of performance as specified in the terms and conditions of the Federal award. During the audit period, the Department disbursed approximately $226.4 million in federal funds for the Emergency Rental Assistance Program (ERA), providing direct payments to eligible entities to assist eligible households with financial assistance and to provide housing stability services, and to cover costs for other affordable rental housing and eviction prevention activities. Although the Department had various controls in place over the ERA expenditure process, these controls did not prevent or detect the Department’s noncompliance with the program’s period of performance federal compliance requirements. For three of three (100%) ERA 1 subawards selected for testing, the Department did not liquidate the subawards, totaling $86,168, within 120 calendar days after the period of performance’s end date of January 28, 2023. Two of the ERA 1 subawards were disbursed on February 10, 2023, and one was disbursed on May 2, 2023, which resulted in these subawards being disbursed 13 and 94 days, respectively, past the liquidation period. As such, we will question the costs of all three ERA 1 subawards not liquidated within 120 calendar days, totaling $86,168. Failure to liquidate funds in the required time frame could result in repayment, reduction of future federal funding, or sanctions imposed by the federal grantor agency. Based on discussions with management, the late liquidations were a result of oversight due to the retirement of an Operations Manager, budget revisions, and internal IT/software issues. We recommend the Department evaluate its current policies and procedures relating to the processing of ERA expenditure transactions and update them, as necessary, to reasonably ensure compliance with the federal program’s period of performance requirements. The Department should consider performing a review of ERA expenditures to ensure the federal awards are liquidated within the required time frame. Management should periodically monitor these procedures to ensure they are operating effectively and as intended.

EMERGENCY RENTAL ASSISTANCE PROGRAM – PERIOD OF PERFORMANCE Finding Number: 2023-002 State Agency Number: DEV-01 Assistance Listing Number and Title: 21.023 COVID-19 – Emergency Rental Assistance Program Federal Award Identification Number / Year: ERA0006 / 2021 Federal Agency: Department of Treasury Compliance Requirement: Period of Performance Repeat Finding from Prior Audit? No QUESTIONED COSTS 15 U.S.C. § 9058a(e)(1) Emergency rental assistance states: Funds provided to an eligible grantee under a payment made under this section shall remain available through September 30, 2022. 2 C.F.R. § 1000.10 gives regulatory effect to the Department of Treasury for 2 C.F.R. Part 200 § 344(b), which establishes requirements over the federal awards and states: Unless the Federal awarding agency or pass-through entity authorizes an extension, a non-Federal entity must liquidate all financial obligations incurred under the Federal award no later than 120 calendar days after the end date of the period of performance as specified in the terms and conditions of the Federal award. During the audit period, the Department disbursed approximately $226.4 million in federal funds for the Emergency Rental Assistance Program (ERA), providing direct payments to eligible entities to assist eligible households with financial assistance and to provide housing stability services, and to cover costs for other affordable rental housing and eviction prevention activities. Although the Department had various controls in place over the ERA expenditure process, these controls did not prevent or detect the Department’s noncompliance with the program’s period of performance federal compliance requirements. For three of three (100%) ERA 1 subawards selected for testing, the Department did not liquidate the subawards, totaling $86,168, within 120 calendar days after the period of performance’s end date of January 28, 2023. Two of the ERA 1 subawards were disbursed on February 10, 2023, and one was disbursed on May 2, 2023, which resulted in these subawards being disbursed 13 and 94 days, respectively, past the liquidation period. As such, we will question the costs of all three ERA 1 subawards not liquidated within 120 calendar days, totaling $86,168. Failure to liquidate funds in the required time frame could result in repayment, reduction of future federal funding, or sanctions imposed by the federal grantor agency. Based on discussions with management, the late liquidations were a result of oversight due to the retirement of an Operations Manager, budget revisions, and internal IT/software issues. We recommend the Department evaluate its current policies and procedures relating to the processing of ERA expenditure transactions and update them, as necessary, to reasonably ensure compliance with the federal program’s period of performance requirements. The Department should consider performing a review of ERA expenditures to ensure the federal awards are liquidated within the required time frame. Management should periodically monitor these procedures to ensure they are operating effectively and as intended.

EMERGENCY SOLUTIONS GRANTS PROGRAM – OBLIGATION, EXPENDITURE, AND PAYMENT REQUIREMENTS Finding Number: 2023-003 State Agency Number: DEV-02 Assistance Listing Number and Title: 14.231 Emergency Solutions Grants Program 14.231 COVID-19 – Emergency Solutions Grants Program Federal Award Identification Number / Year: E-22-DC-39-0001 / 2022 E-20-DW-39-0001 / 2020 Federal Agency: Department of Housing and Urban Development Compliance Requirement: Special Tests and Provisions – Obligation, Expenditure and Payment Requirements Repeat Finding from Prior Audit? Yes Prior Audit Finding Number: 2022-002 NONCOMPLIANCE AND MATERIAL WEAKNESS 24. C.F.R. Part 576 § 203 relates to obligation and payment requirements for the Emergency Solutions Grants Program (ESGP) and states, in part: (a) Obligation of funds. (1) Funds allocated to States. (i) Within 60 days from the date that HUD [U.S. Department of Housing and Urban Development] signs the grant agreement with the State (or grant amendment for reallocated funds), the recipient must obligate the entire grant, except the amount for its administrative costs. This requirement is met by a subgrant agreement with, or a letter of award requiring payment from the grant to, a subrecipient. . . . (c) Payments to subrecipients. The recipient must pay each subrecipient for allowable costs within 30 days after receiving the subrecipient's complete payment request. This requirement also applies to each subrecipient that is a unit of general purpose local government. It is management’s responsibility to design and implement internal controls to reasonably ensure compliance with laws and regulations and to ensure management’s objectives are achieved. During the audit period, the Department was awarded approximately $6.2 million in new ESGP funding for the 2022 federal program year which is received on a biennial basis with new grants being awarded in odd-numbered years. Additionally, the Department expended approximately $19.6 million in ESGP funding to subrecipients from both new and existing fundings. The Department’s allocation and award of program funds to subrecipients involves the creation of an annual Consolidated Plan submitted to HUD, a subrecipient pre-application eligibility review, final allocation of program funds, and approval of the finalized subgrant agreement. Once an agreement is approved, subrecipients are required to submit a request for reimbursement to the Department to initiate payment. However, the following were noted: • Four of four (100%) ESGP subgrant agreements entered into during the audit period and selected for testing were obligated late. The number of days late ranged from 73 to 107, with an average of 82. • Two of 25 (8%) ESGP vouchers selected for testing were not paid within 30 days per 24. C.F.R. Part 576 § 203(c). The vouchers were paid two and nine days late, with an average of 5.5 days. Without procedures in place to ensure timely obligation and payment of funds in accordance with federal requirements, the Department could face a reduction or elimination of funding, or other penalties or sanctions imposed by the federal grantor agency. Based on discussions with management, there have been difficulties complying with the obligation requirement due to the short length of time given to obligate funds without impacting the overall experience of subrecipients or overall compliance with other program requirements. Management indicated there is ongoing communication with HUD to resolve this matter. Management also indicated the late payments to subrecipients resulted from a combination of IT issues, approval delay due to the unavailability of program staff, and fiscal year shutdown of the State’s accounting system at the close of state fiscal year 2023. We recommend the Department review and evaluate its current ESGP subgrant award processes for redundancies or areas where time savings can be implemented and identify processes that could be completed prior to the federal grantor agency awarding the funds. The Department should also review and evaluate its ESGP disbursement processes to ensure payments are made timely to subrecipients and in compliance with federal requirements. Management should periodically monitor these processes and procedures to ensure they are operating effectively and meeting their objectives.

EMERGENCY SOLUTIONS GRANTS PROGRAM – OBLIGATION, EXPENDITURE, AND PAYMENT REQUIREMENTS Finding Number: 2023-003 State Agency Number: DEV-02 Assistance Listing Number and Title: 14.231 Emergency Solutions Grants Program 14.231 COVID-19 – Emergency Solutions Grants Program Federal Award Identification Number / Year: E-22-DC-39-0001 / 2022 E-20-DW-39-0001 / 2020 Federal Agency: Department of Housing and Urban Development Compliance Requirement: Special Tests and Provisions – Obligation, Expenditure and Payment Requirements Repeat Finding from Prior Audit? Yes Prior Audit Finding Number: 2022-002 NONCOMPLIANCE AND MATERIAL WEAKNESS 24. C.F.R. Part 576 § 203 relates to obligation and payment requirements for the Emergency Solutions Grants Program (ESGP) and states, in part: (a) Obligation of funds. (1) Funds allocated to States. (i) Within 60 days from the date that HUD [U.S. Department of Housing and Urban Development] signs the grant agreement with the State (or grant amendment for reallocated funds), the recipient must obligate the entire grant, except the amount for its administrative costs. This requirement is met by a subgrant agreement with, or a letter of award requiring payment from the grant to, a subrecipient. . . . (c) Payments to subrecipients. The recipient must pay each subrecipient for allowable costs within 30 days after receiving the subrecipient's complete payment request. This requirement also applies to each subrecipient that is a unit of general purpose local government. It is management’s responsibility to design and implement internal controls to reasonably ensure compliance with laws and regulations and to ensure management’s objectives are achieved. During the audit period, the Department was awarded approximately $6.2 million in new ESGP funding for the 2022 federal program year which is received on a biennial basis with new grants being awarded in odd-numbered years. Additionally, the Department expended approximately $19.6 million in ESGP funding to subrecipients from both new and existing fundings. The Department’s allocation and award of program funds to subrecipients involves the creation of an annual Consolidated Plan submitted to HUD, a subrecipient pre-application eligibility review, final allocation of program funds, and approval of the finalized subgrant agreement. Once an agreement is approved, subrecipients are required to submit a request for reimbursement to the Department to initiate payment. However, the following were noted: • Four of four (100%) ESGP subgrant agreements entered into during the audit period and selected for testing were obligated late. The number of days late ranged from 73 to 107, with an average of 82. • Two of 25 (8%) ESGP vouchers selected for testing were not paid within 30 days per 24. C.F.R. Part 576 § 203(c). The vouchers were paid two and nine days late, with an average of 5.5 days. Without procedures in place to ensure timely obligation and payment of funds in accordance with federal requirements, the Department could face a reduction or elimination of funding, or other penalties or sanctions imposed by the federal grantor agency. Based on discussions with management, there have been difficulties complying with the obligation requirement due to the short length of time given to obligate funds without impacting the overall experience of subrecipients or overall compliance with other program requirements. Management indicated there is ongoing communication with HUD to resolve this matter. Management also indicated the late payments to subrecipients resulted from a combination of IT issues, approval delay due to the unavailability of program staff, and fiscal year shutdown of the State’s accounting system at the close of state fiscal year 2023. We recommend the Department review and evaluate its current ESGP subgrant award processes for redundancies or areas where time savings can be implemented and identify processes that could be completed prior to the federal grantor agency awarding the funds. The Department should also review and evaluate its ESGP disbursement processes to ensure payments are made timely to subrecipients and in compliance with federal requirements. Management should periodically monitor these processes and procedures to ensure they are operating effectively and meeting their objectives.

CORONAVIRUS STATE AND LOCAL FISCAL RECOVERY FUNDS – SUBRECIPENT MONITORING AND REPORTING Finding Number: 2023-004 State Agency Number: DEV-03 Assistance Listing Number and Title: 21.027 COVID-19 – Coronavirus State and Local Fiscal Recovery Funds (SLFRF) Federal Award Identification Number / Year: SLFRP2610 / 2021 SLFRP0130 / 2021 Federal Agency: Department of Treasury Compliance Requirements: Reporting, Subrecipient Monitoring Repeat Finding from Prior Audit? No NONCOMPLIANCE AND MATERIAL WEAKNESS 2 C.F.R. § 1000.10 gives regulatory effect to the Department of Treasury for 2. C.F.R. § 200.332, which establishes requirements over subawards for pass-through entities and states: All pass-through entities must: . . . (d) Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. Pass-through entity monitoring of the subrecipient must include: (1) Reviewing financial and performance reports required by the pass-through entity. (2) Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the Federal award provided to the subrecipient from the pass-through entity detected through audits, on-site reviews, and written confirmation from the subrecipient, highlighting the status of actions planned or taken to address Single Audit findings related to the particular subaward. . . . 2 C.F.R. § 1000.10 gives regulatory effect to the Department of Treasury for 2 C.F.R. § 200.328 which establishes requirements over financial reporting, and states: Unless otherwise approved by OMB, the Federal awarding agency must solicit only the OMB-approved governmentwide data elements for collection of financial information at time of publication the Federal Financial Report or such future, OMB-approved, governmentwide data elements available from the OMB-designated standards lead. This information must be collected with the frequency required by the terms and conditions of the Federal award, but no less frequently than annually nor more frequently than quarterly except in unusual circumstances, for example where more frequent reporting is necessary for the effective monitoring of the Federal award or could significantly affect program outcomes, and preferably in coordination with performance reporting. The Federal awarding agency must use OMB-approved common information collections, as applicable, when providing financial and performance reporting information. Also, 31 C.F.R. § 35.4(c) states, in part, Reporting and requests for other information. During the period of performance, recipients shall provide to the Secretary periodic reports providing detailed accounting of the uses of funds, modifications to a State or Territory’s tax revenue sources, and such other information as the Secretary may require for administration of this section. In addition to regular reporting requirements, the Secretary may request other additional information as may be necessary or appropriate, including as may be necessary to prevent evasions of the requirements of this subpart. It is management’s responsibility to implement control policies and procedures to reasonably ensure the federal reports they submit are accurate, complete and in compliance with program requirements. Management is also responsible for ensuring internal controls over subrecipient monitoring are in place and operating effectively through the audit period. During state fiscal year 2023, the Department disbursed approximately $125 million in SLFRF funding to subrecipients for Water Sewer Quality or Local Water and Sewer projects. The Department’s subrecipients were required to submit a program report on a quarterly basis which includes data on projects funded, expenditures, and contracts, and subawards equal to or greater than $50,000, through the Department’s Salesforce System. Information from the subrecipient’s program reports was utilized to compile the Department’s portion of the quarterly Performance and Expenditure Report which is sent to the Ohio Office of Budget and Management (OBM) for compilation and submission within the State’s Performance and Expenditure Reports to the Department of Treasury. However, for five of 11 (45.5%) subrecipients selected for testing, the Department did not obtain the required quarterly program reports from its subrecipients. Upon further review, the Department did not have a process in place to follow-up with its subrecipients to obtain the missing program reports. As a result, the Department would identify the missing subrecipient’s projects by noting “not started” or report the previous quarter’s data in its quarterly Performance and Expenditure Reports submitted to OBM. By not monitoring subrecipients to ensure the required reports are submitted timely, this increases the risk of inaccurate and insufficient information being reported to the Department. Additionally, a lack of internal controls over federal reporting increases the risk of financial and programmatic information submitted to the federal grantor agency being inaccurate which could result in federal funds being reduced, taken away, or other sanctions imposed by the federal grantor agency. Based on discussions with management, the Department experienced turnover during the audit period, which slowed the Department’s responsiveness to the issues noted over reporting, as well as, monitoring the subrecipient’s report submissions. We recommend the Department design and implement internal controls over its subrecipients to reasonably ensure the quarterly program reports submitted into the Salesforce System are timely, accurate, and complete. These procedures should be adequately documented and maintained to ensure the internal controls are in place and operating as management intended. The Department should also reevaluate their internal controls and procedures over the compilation of its quarterly Performance and Expenditure Reports to ensure the information is current, accurate and complete prior to submission to OBM. Management should periodically monitor these procedures to ensure they are working as intended.

CORONAVIRUS STATE AND LOCAL FISCAL RECOVERY FUNDS – SUBRECIPENT MONITORING AND REPORTING Finding Number: 2023-004 State Agency Number: DEV-03 Assistance Listing Number and Title: 21.027 COVID-19 – Coronavirus State and Local Fiscal Recovery Funds (SLFRF) Federal Award Identification Number / Year: SLFRP2610 / 2021 SLFRP0130 / 2021 Federal Agency: Department of Treasury Compliance Requirements: Reporting, Subrecipient Monitoring Repeat Finding from Prior Audit? No NONCOMPLIANCE AND MATERIAL WEAKNESS 2 C.F.R. § 1000.10 gives regulatory effect to the Department of Treasury for 2. C.F.R. § 200.332, which establishes requirements over subawards for pass-through entities and states: All pass-through entities must: . . . (d) Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. Pass-through entity monitoring of the subrecipient must include: (1) Reviewing financial and performance reports required by the pass-through entity. (2) Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the Federal award provided to the subrecipient from the pass-through entity detected through audits, on-site reviews, and written confirmation from the subrecipient, highlighting the status of actions planned or taken to address Single Audit findings related to the particular subaward. . . . 2 C.F.R. § 1000.10 gives regulatory effect to the Department of Treasury for 2 C.F.R. § 200.328 which establishes requirements over financial reporting, and states: Unless otherwise approved by OMB, the Federal awarding agency must solicit only the OMB-approved governmentwide data elements for collection of financial information at time of publication the Federal Financial Report or such future, OMB-approved, governmentwide data elements available from the OMB-designated standards lead. This information must be collected with the frequency required by the terms and conditions of the Federal award, but no less frequently than annually nor more frequently than quarterly except in unusual circumstances, for example where more frequent reporting is necessary for the effective monitoring of the Federal award or could significantly affect program outcomes, and preferably in coordination with performance reporting. The Federal awarding agency must use OMB-approved common information collections, as applicable, when providing financial and performance reporting information. Also, 31 C.F.R. § 35.4(c) states, in part, Reporting and requests for other information. During the period of performance, recipients shall provide to the Secretary periodic reports providing detailed accounting of the uses of funds, modifications to a State or Territory’s tax revenue sources, and such other information as the Secretary may require for administration of this section. In addition to regular reporting requirements, the Secretary may request other additional information as may be necessary or appropriate, including as may be necessary to prevent evasions of the requirements of this subpart. It is management’s responsibility to implement control policies and procedures to reasonably ensure the federal reports they submit are accurate, complete and in compliance with program requirements. Management is also responsible for ensuring internal controls over subrecipient monitoring are in place and operating effectively through the audit period. During state fiscal year 2023, the Department disbursed approximately $125 million in SLFRF funding to subrecipients for Water Sewer Quality or Local Water and Sewer projects. The Department’s subrecipients were required to submit a program report on a quarterly basis which includes data on projects funded, expenditures, and contracts, and subawards equal to or greater than $50,000, through the Department’s Salesforce System. Information from the subrecipient’s program reports was utilized to compile the Department’s portion of the quarterly Performance and Expenditure Report which is sent to the Ohio Office of Budget and Management (OBM) for compilation and submission within the State’s Performance and Expenditure Reports to the Department of Treasury. However, for five of 11 (45.5%) subrecipients selected for testing, the Department did not obtain the required quarterly program reports from its subrecipients. Upon further review, the Department did not have a process in place to follow-up with its subrecipients to obtain the missing program reports. As a result, the Department would identify the missing subrecipient’s projects by noting “not started” or report the previous quarter’s data in its quarterly Performance and Expenditure Reports submitted to OBM. By not monitoring subrecipients to ensure the required reports are submitted timely, this increases the risk of inaccurate and insufficient information being reported to the Department. Additionally, a lack of internal controls over federal reporting increases the risk of financial and programmatic information submitted to the federal grantor agency being inaccurate which could result in federal funds being reduced, taken away, or other sanctions imposed by the federal grantor agency. Based on discussions with management, the Department experienced turnover during the audit period, which slowed the Department’s responsiveness to the issues noted over reporting, as well as, monitoring the subrecipient’s report submissions. We recommend the Department design and implement internal controls over its subrecipients to reasonably ensure the quarterly program reports submitted into the Salesforce System are timely, accurate, and complete. These procedures should be adequately documented and maintained to ensure the internal controls are in place and operating as management intended. The Department should also reevaluate their internal controls and procedures over the compilation of its quarterly Performance and Expenditure Reports to ensure the information is current, accurate and complete prior to submission to OBM. Management should periodically monitor these procedures to ensure they are working as intended.

EMERGENCY RENTAL ASSISTANCE PROGRAM – REPORTING Finding Number: 2023-005 State Agency Number: DEV-04 Assistance Listing Number and Title: 21.023 COVID-19 – Emergency Rental Assistance Program (ERA) Federal Award Identification Number / Year: ERA0006 / 2021 ERAE0063 / 2021 Federal Agency: Department of Treasury Compliance Requirement: Reporting Repeat Finding from Prior Audit? No NONCOMPLIANCE AND MATERIAL WEAKNESS 2 C.F.R. § 1000.10 gives regulatory effect to the Department of Treasury for 2 C.F.R. § 200.328, which establishes requirements over federal reporting, and states: Unless otherwise approved by OMB, the Federal awarding agency must solicit only the OMB-approved governmentwide data elements for collection of financial information at time of publication the Federal Financial Report or such future, OMB-approved, governmentwide data elements available from the OMB-designated standards lead. This information must be collected with the frequency required by the terms and conditions of the Federal award, but no less frequently than annually nor more frequently than quarterly except in unusual circumstances, for example where more frequent reporting is necessary for the effective monitoring of the Federal award or could significantly affect program outcomes, and preferably in coordination with performance reporting. The Federal awarding agency must use OMB-approved common information collections, as applicable, when providing financial and performance reporting information. 2 C.F.R. § 1000.10 gives regulatory effect to the Department of Treasury for 2 C.F.R. § 200.329(b), which establishes requirements over federal reporting, and states: Reporting program performance. The Federal awarding agency must use OMB-approved common information collections, as applicable, when providing financial and performance reporting information. As appropriate and in accordance with above mentioned information collections, the Federal awarding agency must require the recipient to relate financial data and accomplishments to performance goals and objectives of the Federal award. Also, in accordance with above mentioned common information collections, and when required by the terms and conditions of the Federal award, recipients must provide cost information to demonstrate cost effective practices (e.g., through unit cost data). In some instances (e.g., discretionary research awards), this will be limited to the requirement to submit technical performance reports (to be evaluated in accordance with Federal awarding agency policy). Reporting requirements must be clearly articulated such that, where appropriate, performance during the execution of the Federal award has a standard against which non-Federal entity performance can be measured. It is management's responsibility to implement internal control procedures to reasonably ensure the federal reports they submit are accurate, complete, and in compliance with program requirements. It is imperative that management be able to provide the underlying data and related program documentation required to prepare and support these reports. The Department’s Office of Community Assistance is responsible for the preparation of the quarterly SF-425, Federal Financial Report, as required by 2 C.F.R. § 200.328 and the quarterly ERA Compliance Report, as required by 2 C.F.R. § 200.329(b) for the ERA program. The Office of Community Assistance compiles both reports by generating a combination of internal financial data and data submitted by the Department’s subrecipients. The SF-425, Federal Financial Report’s financial information is uploaded with the performance data information in the ERA Compliance Report. However, the Office of Community Assistance’s review of these quarterly reports was not adequate and/or operating effectively throughout the audit period. As a result, two of two (100%) quarterly SF-425 and ERA Compliance Reports tested, the Department was unable to provide supporting documentation for the amounts reported or provided insufficient supporting documentation for other amounts reported that resulted in inaccuracies and missing information for key data elements. A lack of adequate internal controls over federal reporting increases the risk of inaccurate and incomplete reports being submitted to the federal grantor agency. Reporting inaccurate or incomplete information could also subject the Department to federal sanctions, limiting the amount of funding for program activities. Based on discussions with management, the reported information was not adequately compared to internal support during the review process due to oversight and lack of data verification and reconciling procedures. We recommend the Department re-evaluate their existing internal control procedures over the SF-425 and ERA Compliance Reports to reasonably ensure the data being reported for the ERA program is accurate, complete, and agrees to supporting documentation. These procedures should include a review of the data submitted to ensure all required data elements are present and properly reported. Management should periodically review these procedures to ensure they are operating as intended.

EMERGENCY RENTAL ASSISTANCE PROGRAM – REPORTING Finding Number: 2023-005 State Agency Number: DEV-04 Assistance Listing Number and Title: 21.023 COVID-19 – Emergency Rental Assistance Program (ERA) Federal Award Identification Number / Year: ERA0006 / 2021 ERAE0063 / 2021 Federal Agency: Department of Treasury Compliance Requirement: Reporting Repeat Finding from Prior Audit? No NONCOMPLIANCE AND MATERIAL WEAKNESS 2 C.F.R. § 1000.10 gives regulatory effect to the Department of Treasury for 2 C.F.R. § 200.328, which establishes requirements over federal reporting, and states: Unless otherwise approved by OMB, the Federal awarding agency must solicit only the OMB-approved governmentwide data elements for collection of financial information at time of publication the Federal Financial Report or such future, OMB-approved, governmentwide data elements available from the OMB-designated standards lead. This information must be collected with the frequency required by the terms and conditions of the Federal award, but no less frequently than annually nor more frequently than quarterly except in unusual circumstances, for example where more frequent reporting is necessary for the effective monitoring of the Federal award or could significantly affect program outcomes, and preferably in coordination with performance reporting. The Federal awarding agency must use OMB-approved common information collections, as applicable, when providing financial and performance reporting information. 2 C.F.R. § 1000.10 gives regulatory effect to the Department of Treasury for 2 C.F.R. § 200.329(b), which establishes requirements over federal reporting, and states: Reporting program performance. The Federal awarding agency must use OMB-approved common information collections, as applicable, when providing financial and performance reporting information. As appropriate and in accordance with above mentioned information collections, the Federal awarding agency must require the recipient to relate financial data and accomplishments to performance goals and objectives of the Federal award. Also, in accordance with above mentioned common information collections, and when required by the terms and conditions of the Federal award, recipients must provide cost information to demonstrate cost effective practices (e.g., through unit cost data). In some instances (e.g., discretionary research awards), this will be limited to the requirement to submit technical performance reports (to be evaluated in accordance with Federal awarding agency policy). Reporting requirements must be clearly articulated such that, where appropriate, performance during the execution of the Federal award has a standard against which non-Federal entity performance can be measured. It is management's responsibility to implement internal control procedures to reasonably ensure the federal reports they submit are accurate, complete, and in compliance with program requirements. It is imperative that management be able to provide the underlying data and related program documentation required to prepare and support these reports. The Department’s Office of Community Assistance is responsible for the preparation of the quarterly SF-425, Federal Financial Report, as required by 2 C.F.R. § 200.328 and the quarterly ERA Compliance Report, as required by 2 C.F.R. § 200.329(b) for the ERA program. The Office of Community Assistance compiles both reports by generating a combination of internal financial data and data submitted by the Department’s subrecipients. The SF-425, Federal Financial Report’s financial information is uploaded with the performance data information in the ERA Compliance Report. However, the Office of Community Assistance’s review of these quarterly reports was not adequate and/or operating effectively throughout the audit period. As a result, two of two (100%) quarterly SF-425 and ERA Compliance Reports tested, the Department was unable to provide supporting documentation for the amounts reported or provided insufficient supporting documentation for other amounts reported that resulted in inaccuracies and missing information for key data elements. A lack of adequate internal controls over federal reporting increases the risk of inaccurate and incomplete reports being submitted to the federal grantor agency. Reporting inaccurate or incomplete information could also subject the Department to federal sanctions, limiting the amount of funding for program activities. Based on discussions with management, the reported information was not adequately compared to internal support during the review process due to oversight and lack of data verification and reconciling procedures. We recommend the Department re-evaluate their existing internal control procedures over the SF-425 and ERA Compliance Reports to reasonably ensure the data being reported for the ERA program is accurate, complete, and agrees to supporting documentation. These procedures should include a review of the data submitted to ensure all required data elements are present and properly reported. Management should periodically review these procedures to ensure they are operating as intended.

CDBG AND LIHEAP – TRANSPARENCY ACT REPORTING Finding Number: 2023-006 State Agency Number: DEV-05 Assistance Listing Numbers and Titles: 14.228 Community Development Block Grants/State’s Program and Non-Entitlement Grants in Hawaii (CDBG) 93.568 Low-Income Home Energy Assistance Program (LIHEAP) Federal Award Identification Number / Year: B-22-DC-39-0001 / 2022 (CDBG) 2201OHLIEA / 2022 (LIHEAP) Federal Agencies: Department of Housing and Urban Development Department of Health and Human Services Compliance Requirement: Reporting Repeat Finding from Prior Audit? Yes Prior Audit Finding Number: 2022-004 NONCOMPLIANCE AND MATERIAL WEAKNESS The Federal Funding Accountability and Transparency Act (Pub. L. No. 109-282, as amended by Section 6202 of Public Law 110-252, hereafter referred to as the “Transparency Act” that are codified in 2 C.F.R. Part 170) requires prime recipients of federal awards who make first-tier subawards to report the subaward on the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS) website maintained by the federal Office of Management and Budget. Under the requirements of 2 C.F.R. Part 170, recipients (i.e., direct recipients) of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more on the FSRS website. Prime recipients must report by the end of the month following the month in which the obligation is made. It is management’s responsibility to design and implement internal controls to reasonably ensure compliance with laws and regulations and to ensure management’s objectives are achieved. During the audit period, the Department obligated approximately $147 million for 409 first-tier subawards that exceeded $30,000 and were required to be reported on the FSRS website in accordance with the Transparency Act during the audit period, under the following major programs: See the Finding for chart/table The Department’s Finance Division manages the Transparency Act reporting for all applicable programs. Monthly, the Finance Division obtains information about the subgrants required to be reported or updated on the FSRS website from an automated monthly encumbrance report. Once prepared, the identified subawards are entered into the FSRS website. Then the Finance Division meets to review the FSRS reports and identifies any missing data or subawards. However, the Department does not perform a reconciliation of the subaward information entered into the FSRS website to ensure the information is complete and accurate. Additionally, the Department did not establish and implement formalized policies and procedures for Transparency Act reporting until the fourth quarter of the audit period. As a result, the following errors were noted for LIHEAP and CDBG: See the Finding for chart/table A lack of adequate internal controls over the preparation and review of reports increases the risk the reports submitted to the federal grantor agency are inaccurate and incomplete. In addition, by not complying with Federal Transparency Act reporting requirements, the Department risks federal funding being reduced, taken away, or other sanctions imposed by the federal grantor agency. If the subawards are not reported accurately and timely within FSRS, the risk exists that those using the Transparency Reports could be relying on inaccurate information. Based on discussions with management, the Department was still in the process of reviewing and updating its federal grant reporting procedures during the audit period which were not finalized until March 2023. Also, the Department has experienced issues obtaining the Unique Entity Identification (UEI) when it was not included in the subgrant agreement in order to report its subawards in the FSRS website. We recommend the Department continues to evaluate its internal controls over the FSRS reporting process by collecting and reporting complete, accurate, and timely information regarding the subawards subject to the Transparency Act. The Department should implement a procedure to reconcile the subaward information entered in the FSRS website to internal records to ensure the information reported is complete and accurate. We also recommend the Department formally document its policies and procedures over the FSRS reporting process and communicate these policies to staff within the Finance Division. Management should periodically review these procedures to ensure they promote compliance with federal regulations and are operating as intended.

CDBG AND LIHEAP – TRANSPARENCY ACT REPORTING Finding Number: 2023-006 State Agency Number: DEV-05 Assistance Listing Numbers and Titles: 14.228 Community Development Block Grants/State’s Program and Non-Entitlement Grants in Hawaii (CDBG) 93.568 Low-Income Home Energy Assistance Program (LIHEAP) Federal Award Identification Number / Year: B-22-DC-39-0001 / 2022 (CDBG) 2201OHLIEA / 2022 (LIHEAP) Federal Agencies: Department of Housing and Urban Development Department of Health and Human Services Compliance Requirement: Reporting Repeat Finding from Prior Audit? Yes Prior Audit Finding Number: 2022-004 NONCOMPLIANCE AND MATERIAL WEAKNESS The Federal Funding Accountability and Transparency Act (Pub. L. No. 109-282, as amended by Section 6202 of Public Law 110-252, hereafter referred to as the “Transparency Act” that are codified in 2 C.F.R. Part 170) requires prime recipients of federal awards who make first-tier subawards to report the subaward on the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS) website maintained by the federal Office of Management and Budget. Under the requirements of 2 C.F.R. Part 170, recipients (i.e., direct recipients) of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more on the FSRS website. Prime recipients must report by the end of the month following the month in which the obligation is made. It is management’s responsibility to design and implement internal controls to reasonably ensure compliance with laws and regulations and to ensure management’s objectives are achieved. During the audit period, the Department obligated approximately $147 million for 409 first-tier subawards that exceeded $30,000 and were required to be reported on the FSRS website in accordance with the Transparency Act during the audit period, under the following major programs: See the Finding for chart/table The Department’s Finance Division manages the Transparency Act reporting for all applicable programs. Monthly, the Finance Division obtains information about the subgrants required to be reported or updated on the FSRS website from an automated monthly encumbrance report. Once prepared, the identified subawards are entered into the FSRS website. Then the Finance Division meets to review the FSRS reports and identifies any missing data or subawards. However, the Department does not perform a reconciliation of the subaward information entered into the FSRS website to ensure the information is complete and accurate. Additionally, the Department did not establish and implement formalized policies and procedures for Transparency Act reporting until the fourth quarter of the audit period. As a result, the following errors were noted for LIHEAP and CDBG: See the Finding for chart/table A lack of adequate internal controls over the preparation and review of reports increases the risk the reports submitted to the federal grantor agency are inaccurate and incomplete. In addition, by not complying with Federal Transparency Act reporting requirements, the Department risks federal funding being reduced, taken away, or other sanctions imposed by the federal grantor agency. If the subawards are not reported accurately and timely within FSRS, the risk exists that those using the Transparency Reports could be relying on inaccurate information. Based on discussions with management, the Department was still in the process of reviewing and updating its federal grant reporting procedures during the audit period which were not finalized until March 2023. Also, the Department has experienced issues obtaining the Unique Entity Identification (UEI) when it was not included in the subgrant agreement in order to report its subawards in the FSRS website. We recommend the Department continues to evaluate its internal controls over the FSRS reporting process by collecting and reporting complete, accurate, and timely information regarding the subawards subject to the Transparency Act. The Department should implement a procedure to reconcile the subaward information entered in the FSRS website to internal records to ensure the information reported is complete and accurate. We also recommend the Department formally document its policies and procedures over the FSRS reporting process and communicate these policies to staff within the Finance Division. Management should periodically review these procedures to ensure they promote compliance with federal regulations and are operating as intended.

EDUCATION STABILIZATION FUND – ANNUAL REPORT Finding Number: 2023-007 State Agency Number: DEW-01 Assistance Listing Number and Title: 84.425 COVID-19 – Education Stabilization Fund Federal Award Identification Number / Year: S425D210035 / 2021 Federal Agency: Department of Education Compliance Requirement: Reporting Repeat Finding from Prior Audit? Yes Prior Audit Finding Number: 2022-008 NONCOMPLIANCE AND MATERIAL WEAKNESS The U.S. Department of Education’s (USED) Office of Elementary and Secondary Education’s website states: All grantees are required to report on Elementary and Secondary School Emergency Relief (ESSER) funds received under the Coronavirus Aid, Relief, and Economic Security (CARES) Act, the Coronavirus Response and Relief Supplemental Appropriations Act, 2021 (CRRSA Act), and the American Rescue Plan (ARP Act). Grantees must submit an annual report describing how the State and subrecipients used the awarded funds during the performance period. Part B(9) of the Certification and Agreement for Funding under the Education Stabilization Fund Program Elementary and Secondary School Emergency Relief Fund (ESSER Fund) between the Department and USED states, in part: …The Secretary may require additional reporting in the future, which may include: the methodology LEAs [Local Education Agencies] will use to provide services or assistance to students and staff in both public and non-public schools, the uses of funds by the LEAs or other entities and demonstration of their compliance with Section 18003(d) of the CARES Act ... Further, the 2023 U.S. Office of Management and Budget’s Compliance Supplement states, in part: ESSER. . .grantees must submit an annual performance report (OMB No. 1810-0749…) with data on expenditures, planned expenditures, subrecipients, and uses of funds, including for mandatory reservations. The Department worked with the Management Council of the Ohio Education Computer Network to create a data portal for each school district to report their ESSER activity. The Department then used this data and financial data from the State’s accounting system, the Ohio Administrative Knowledge System (OAKS), to compile the annual report and upload it into the Data Collection Tool, the application USED established to collect the data. However, while the Department had control procedures in place, they were not sufficient to ensure the completeness and accuracy of the information included in the annual report. The Department reported $145,396 in ESSER II contract expenditures as the total amount of State Educational Agencies (SEA) Reserve the SEA expended directly in the current period; however, $2,031,739 should have been reported in the annual report, resulting in an understatement of $1,886,343. Without proper procedures in place to ensure the amounts included in the report are complete and accurate, there is an increased risk that amounts reported to the federal grantor agency are incorrect. Inaccurate reporting could subject the Department to fines or other sanctions imposed by the federal grantor agency. Based on discussions with management, three ESSER II contract vouchers, totaling $1,886,343, were incorrectly excluded from the annual report due to management oversight. We recommend the Department reevaluate its current policies and procedures to reasonably ensure all amounts reported on the annual report are complete and accurate. This should include ensuring the financial data extracted from OAKS is complete and accurate prior to including the financial data in the annual report. These procedures should be periodically monitored by Management to ensure they are working as intended.

EDUCATION STABILIZATION FUND – ANNUAL REPORT Finding Number: 2023-007 State Agency Number: DEW-01 Assistance Listing Number and Title: 84.425 COVID-19 – Education Stabilization Fund Federal Award Identification Number / Year: S425D210035 / 2021 Federal Agency: Department of Education Compliance Requirement: Reporting Repeat Finding from Prior Audit? Yes Prior Audit Finding Number: 2022-008 NONCOMPLIANCE AND MATERIAL WEAKNESS The U.S. Department of Education’s (USED) Office of Elementary and Secondary Education’s website states: All grantees are required to report on Elementary and Secondary School Emergency Relief (ESSER) funds received under the Coronavirus Aid, Relief, and Economic Security (CARES) Act, the Coronavirus Response and Relief Supplemental Appropriations Act, 2021 (CRRSA Act), and the American Rescue Plan (ARP Act). Grantees must submit an annual report describing how the State and subrecipients used the awarded funds during the performance period. Part B(9) of the Certification and Agreement for Funding under the Education Stabilization Fund Program Elementary and Secondary School Emergency Relief Fund (ESSER Fund) between the Department and USED states, in part: …The Secretary may require additional reporting in the future, which may include: the methodology LEAs [Local Education Agencies] will use to provide services or assistance to students and staff in both public and non-public schools, the uses of funds by the LEAs or other entities and demonstration of their compliance with Section 18003(d) of the CARES Act ... Further, the 2023 U.S. Office of Management and Budget’s Compliance Supplement states, in part: ESSER. . .grantees must submit an annual performance report (OMB No. 1810-0749…) with data on expenditures, planned expenditures, subrecipients, and uses of funds, including for mandatory reservations. The Department worked with the Management Council of the Ohio Education Computer Network to create a data portal for each school district to report their ESSER activity. The Department then used this data and financial data from the State’s accounting system, the Ohio Administrative Knowledge System (OAKS), to compile the annual report and upload it into the Data Collection Tool, the application USED established to collect the data. However, while the Department had control procedures in place, they were not sufficient to ensure the completeness and accuracy of the information included in the annual report. The Department reported $145,396 in ESSER II contract expenditures as the total amount of State Educational Agencies (SEA) Reserve the SEA expended directly in the current period; however, $2,031,739 should have been reported in the annual report, resulting in an understatement of $1,886,343. Without proper procedures in place to ensure the amounts included in the report are complete and accurate, there is an increased risk that amounts reported to the federal grantor agency are incorrect. Inaccurate reporting could subject the Department to fines or other sanctions imposed by the federal grantor agency. Based on discussions with management, three ESSER II contract vouchers, totaling $1,886,343, were incorrectly excluded from the annual report due to management oversight. We recommend the Department reevaluate its current policies and procedures to reasonably ensure all amounts reported on the annual report are complete and accurate. This should include ensuring the financial data extracted from OAKS is complete and accurate prior to including the financial data in the annual report. These procedures should be periodically monitored by Management to ensure they are working as intended.

OPIOID STR – TRANSPARENCY ACT REPORTING Finding Number: 2023-008 State Agency Number: DOH-01 Assistance Listing Number and Title: 93.788 – Opioid STR Federal Award Identification Number / Year: H79TI081684 / 2020 H79TI083294 / 2021 H79TI085753 / 2022 Federal Agency: Department of Health and Human Services Compliance Requirement: Reporting Repeat Finding from Prior Audit? No NONCOMPLIANCE AND MATERIAL WEAKNESS NOTE: Finding number 2023-019 contains additional information which is integral to and should be read in conjunction with this finding. The Federal Funding Accountability and Transparency Act (Pub. L. No. 109-282, as amended by Section 6202 of Public Law 110-252, hereafter referred to as the “Transparency Act” that are codified in 2 C.F.R. Part 170) requires prime recipients of federal awards who make first-tier subawards to report the subaward on the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS) website maintained by the federal Office of Management and Budget. Under the requirements of 2 C.F.R. Part 170, recipients (i.e., direct recipients) of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more on the FSRS website. Prime recipients must report by the end of the month following the month in which the obligation is made. It is management’s responsibility to design and implement internal controls to reasonably ensure compliance with laws and regulations and to ensure management’s objectives are achieved. The State of Ohio is considered the prime recipient for federal funds applicable to Transparency Act reporting and the state agencies receiving these federal funds are expected to report the subawards obligated in accordance with the Transparency Act. During state fiscal year 2023, the Department obligated approximately $3.5 million for 42 subawards which exceeded $30,000 and were required to be reported on the FSRS website in accordance with the Transparency Act for the Opioid STR program. Based on an inter-agency agreement, the Department is responsible for requesting funds from the Ohio Department of Mental Health and Addiction Services (Mental Health) via an Intra-State Transfer Voucher to initiate the draw down of federal funds and transfer to the Department for disbursement to its subrecipients. These obligations were established to provide subawards to subrecipients; however, the Department had no control procedures in place during the audit period to ensure this subaward information was collected and provided to Mental Health for submission into the FSRS website, as follows: See the Finding for chart/table By not complying with federal Transparency Act reporting requirements, the Department risks federal funding being reduced, taken away, or other sanctions imposed by the federal grantor agency. If the subawards are not reported within FSRS, the risk exists that those using the Transparency Reports could be relying on inaccurate information. Based on discussions with management, they were not aware the Transparency Act reporting requirement applied to them since the inter-agency agreement with Mental Health did not include anything related to the Department’s responsibility. Management also indicated they believe the responsibility of entering information into FSRS resides with Mental Health for the Opioid STR program. We recommend the Department work with Mental Health (the partner agency) to establish Transparency Act reporting responsibilities and to ensure compliance with Federal regulations. These responsibilities should be clearly outlined in the inter-agency agreement. We also recommend the Department design and implement internal control procedures to collect complete and accurate information regarding subawards subject to the Transparency Act for entry on the FSRS website. These procedures should include a supervisory review of the reported information before it is submitted on the FSRS website.

OPIOID STR – TRANSPARENCY ACT REPORTING Finding Number: 2023-008 State Agency Number: DOH-01 Assistance Listing Number and Title: 93.788 – Opioid STR Federal Award Identification Number / Year: H79TI081684 / 2020 H79TI083294 / 2021 H79TI085753 / 2022 Federal Agency: Department of Health and Human Services Compliance Requirement: Reporting Repeat Finding from Prior Audit? No NONCOMPLIANCE AND MATERIAL WEAKNESS NOTE: Finding number 2023-019 contains additional information which is integral to and should be read in conjunction with this finding. The Federal Funding Accountability and Transparency Act (Pub. L. No. 109-282, as amended by Section 6202 of Public Law 110-252, hereafter referred to as the “Transparency Act” that are codified in 2 C.F.R. Part 170) requires prime recipients of federal awards who make first-tier subawards to report the subaward on the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS) website maintained by the federal Office of Management and Budget. Under the requirements of 2 C.F.R. Part 170, recipients (i.e., direct recipients) of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more on the FSRS website. Prime recipients must report by the end of the month following the month in which the obligation is made. It is management’s responsibility to design and implement internal controls to reasonably ensure compliance with laws and regulations and to ensure management’s objectives are achieved. The State of Ohio is considered the prime recipient for federal funds applicable to Transparency Act reporting and the state agencies receiving these federal funds are expected to report the subawards obligated in accordance with the Transparency Act. During state fiscal year 2023, the Department obligated approximately $3.5 million for 42 subawards which exceeded $30,000 and were required to be reported on the FSRS website in accordance with the Transparency Act for the Opioid STR program. Based on an inter-agency agreement, the Department is responsible for requesting funds from the Ohio Department of Mental Health and Addiction Services (Mental Health) via an Intra-State Transfer Voucher to initiate the draw down of federal funds and transfer to the Department for disbursement to its subrecipients. These obligations were established to provide subawards to subrecipients; however, the Department had no control procedures in place during the audit period to ensure this subaward information was collected and provided to Mental Health for submission into the FSRS website, as follows: See the Finding for chart/table By not complying with federal Transparency Act reporting requirements, the Department risks federal funding being reduced, taken away, or other sanctions imposed by the federal grantor agency. If the subawards are not reported within FSRS, the risk exists that those using the Transparency Reports could be relying on inaccurate information. Based on discussions with management, they were not aware the Transparency Act reporting requirement applied to them since the inter-agency agreement with Mental Health did not include anything related to the Department’s responsibility. Management also indicated they believe the responsibility of entering information into FSRS resides with Mental Health for the Opioid STR program. We recommend the Department work with Mental Health (the partner agency) to establish Transparency Act reporting responsibilities and to ensure compliance with Federal regulations. These responsibilities should be clearly outlined in the inter-agency agreement. We also recommend the Department design and implement internal control procedures to collect complete and accurate information regarding subawards subject to the Transparency Act for entry on the FSRS website. These procedures should include a supervisory review of the reported information before it is submitted on the FSRS website.

UNEMPLOYMENT INSURANCE – IMPROPER PAYMENTS Finding Number: 2023-009 State Agency Number: JFS-01 Assistance Listing Number and Title: 17.225 – Unemployment Insurance 17.225 COVID-19 – Unemployment Insurance Federal Award Identification Number / Year: UI-34078-20-55-A-39 / 2020 UI-35668-21-55-A-39 / 2021 UI-37243-22-55-A-39 / 2022 UI-39342-23-55-A-39 / 2023 Federal Agency: Department of Labor Compliance Requirements: Activities Allowed or Unallowed, Allowable Costs/Costs Principles, Eligibility Repeat Finding from Prior Audit? Yes Prior Audit Finding Number: 2022-010 QUESTIONED COSTS, NONCOMPLIANCE, AND SIGNIFICANT DEFICIENCY 2 C.F.R. § 2900.4 gives regulatory effect to the Department of Labor (DOL) for 2 C.F.R. § 200.1 which states, in part: Improper payment means: (1) Any payment that should not have been made or that was made in an incorrect amount under statutory, contractual, administrative, or other legally applicable requirements. (i) Incorrect amounts are overpayments or underpayments that are made to eligible recipients (including inappropriate denials of payment or service, any payment that does not account for credit for applicable discounts, payments that are for an incorrect amount, and duplicate payments). An improper payment also includes any payment that was made to an ineligible recipient or for an ineligible good or service, or payments for goods or services not received (except for such payments authorized by law). . . . 15 U.S.C. § 9023(b)(3) pertaining to Federal Pandemic Unemployment Compensation (FPUC) states, in part: (15) In general The amount specified in this paragraph is the following amount: (i) For weeks of unemployment beginning after the date on which an agreement is entered into under this section and ending on or before July 31, 2020, $600. (ii) For weeks of unemployment beginning after December 26, 2020 (or, if later, the date on which such agreement is entered into), and ending on or before September 6, 2021, $300. 15 U.S.C. § 9025(a)(4) pertaining to Pandemic Emergency Unemployment Compensation (PEUC) states, in part: (A) the amount of pandemic emergency unemployment compensation which shall be payable to any individual for any week of total unemployment shall be equal to: (i) the amount of the regular compensation (including dependents’ allowances) payable to such individual during such individual’s benefit year under the State law for a week of total unemployment; (ii) the amount of Federal Pandemic Unemployment Compensation under section 9023(b)(1)(B) of this title; and (iii) the amount (if any) of Mixed Earner Unemployment Compensation under section 9023(b)(1)(C) of this title; . . . Ohio Rev. Code (ORC) § 4141.29 states, in part: . . . (A) No individual is entitled to a waiting period or benefits for any week unless the individual: . . . (4)(a)(i) Is able to work and available for suitable work and, except as provided in division (A)(4)(a)(ii) or (iii) of this section, is actively seeking suitable work either in a locality in which the individual has earned wages subject to this chapter during the individual's base period, or if the individual leaves that locality, then in a locality where suitable work normally is performed. . . . (4)(b)(i) The individual shall be instructed as to the efforts that the individual must make in the search for suitable work, including that, within six months after October 11, 2013, the individual shall register with the OhioMeansJobs web site, . . . . . . (7) Participates in the reemployment and eligibility assessment program, or other reemployment services, as required by the director. As used in division (A)(7) of this section, "reemployment services" includes job search assistance activities, skills assessments, and the provision of labor market statistics or analysis. . . . (B) An individual suffering total or partial unemployment is eligible for benefits for unemployment occurring subsequent to a waiting period of one week and no benefits shall be payable during this required waiting period. Not more than one week of waiting period shall be required of any individual in any benefit year in order to establish the individual's eligibility for total or partial unemployment benefits. (C) The waiting period for total or partial unemployment shall commence on the first day of the first week with respect to which the individual first files a claim for benefits at an employment office or other place of registration maintained or designated by the director or on the first day of the first week with respect to which the individual has otherwise filed a claim for benefits in accordance with the rules of the department of job and family services, provided such claim is allowed by the director. . . . The federal government established rules, regulations, and requirements related to eligibility, benefit amounts and timing, monitoring responsibilities, etc. regarding Unemployment benefits and the expanded Unemployment benefits related to the pandemic. It is management’s responsibility to implement controls, processes, and procedures to provide reasonable assurance over the reliability of financial reporting, effectiveness and efficiency of operations, and compliance with these rules, regulations, and requirements. During state fiscal year 2023, the Department disbursed more than $699.6 million in unemployment benefits through the Ohio Job Insurance (OJI) benefit system. Approximately $659.3 million in regular unemployment, $12.7 million related to FPUC, and $2.8 million related to PEUC. The Department also reported to the U.S. Department of Labor outstanding Unemployment Insurance overpayments totaling $72.9 million as of June 30, 2023. Of these total overpayments, $31.7 million was identified as fraud and $41.2 million as non-fraud relating to regular unemployment and federal pandemic unemployment benefits. Eligibility for unemployment benefits including FPUC and PEUC was determined within OJI based upon requirements outlined in state and/or federal laws. FPUC provided additional benefits of $600 and/or $300 per week to individuals that qualified for regular unemployment or Pandemic Unemployment Assistance (PUA) benefits. PEUC allowed up to a maximum of 53 additional weeks of benefits for individuals who exhausted regular unemployment compensation and PUA benefits. The OJI system includes various automated controls to ensure benefits are not paid in excess of the allowable amount, claimants appropriately serve a waiting week for their claim, and, where required, work search activities are completed. Weekly, claimants confirmed their unemployment status and completed the required work search activities or COVID-19 self-attestation questionnaire within OJI. If the claimant’s benefit payment was flagged, an adjudicator performed an additional review and requested fact-finding information for either monetary or nonmonetary issues. The claimant continued to receive weekly benefit payments until the adjudicator investigated the issue and confirmed the claimant’s ineligible status. If an issue was suspected of fraud, the issue was routed to the Department’s Benefit Payment Control section to be investigated, adjudicated and, if applicable, an overpayment flag was created in OJI. The Department’s policy, which is based on U.S. Department of Labor guidance, is to adjudicate possible fraud cases within 21 days or 90 days, depending on the circumstances of the case. Although the Department had various controls in place over regular and pandemic unemployment benefit payments, these controls did not prevent or detect the following noncompliance errors, resulting in questioned costs totaling $11,343 ($7,800 for FPUC and $3,543 for regular unemployment benefits): • For one of 17 (5.9%) unemployment benefit claims identified in an OJI system data match as potentially being duplicate payments, the claimant was paid duplicate FPUC benefits of $600 a week for several weeks of benefits in state fiscal year 2023. As a result, the claimant was overpaid FPUC benefits of $7,800 during the audit period. • For one of 25 (4%) regular unemployment benefit claims identified in an OJI system data match as potentially exceeding the maximum allowable number of weeks, the Claims Examiner did not adjudicate the issue flagged by the system for not completing a Career Profile Assessment in the OhioMeansJobs website in a timely manner, resulting in an overpayment of $1,770. • For three of 60 (5%) regular unemployment benefit claims selected for testing, the claimant was not eligible to receive benefits for the weeks claimed or was overpaid, as follows:  One claimant filed a weekly claim and certified the required two work search activities were completed. However, the claimant described the work search activities as "none." Because the claimant did not complete work search activities, we will question costs for all weeks the claimant did not complete work search activities, or two weeks totaling $852.  One claimant did not complete a Career Profile Assessment in the OhioMeansJobs website. When the system flagged the issue, the Claims Examiner did not adjudicate the issue in a timely manner, resulting in an overpayment of $530.  One claimant worked full-time during the waiting week of the claim. After the claimant served the waiting week, the employer notified the Department of the claimant's earnings during the waiting week which exceeded their weekly benefit amount, and the OJI system flagged this issue. However, the Claims Examiner did not appropriately adjudicate the issue; as a result, the claimant did not serve a waiting week for the claim and was overpaid benefits. We will therefore question costs for one week of the claim, totaling $391. ADDITIONAL QUESTIONED COSTS: In August 2023, the Office of the Ohio Inspector General referred a report to the Auditor of State for further consideration. The report included an investigation of suspected illegal or improper activity by a Department employee in the Office of Workforce Development. As part of the investigation, investigators determined the employee improperly accessed and/or cleared unemployment issues for various claimants, which were outside of the employee’s job duties. As a result of the employee actions, the Department may have improperly paid unemployment benefits to five claimants totaling $84,414. We will question costs totaling $84,414 for the improper payments ($46,800 for FPUC, $24,629 for regular unemployment benefits, and $12,985 in PEUC). Due to an impending court case with the employee, the Department has decided to wait and adjudicate any overpayments once the case is resolved. Without effective internal controls for the eligibility determination and benefit payment processes, there is an increased risk benefit payments will be inaccurate or unallowable. The risk is increased if the system contains significant flaws or eligibility redeterminations are not made timely or accurately. Overpayments to ineligible claimants may subject the Department to penalties or sanctions which may jeopardize future funding and limit its ability to fulfill program requirements to provide benefits to those in need. Based on discussions with management, these errors were due to oversight, system design flaws within OJI, and significant workload increases due to the impact the pandemic had on the program. We recommend Department management: • Evaluate and strengthen current internal control procedures over the Unemployment Insurance program to assure claimants are eligible and receive the correct weekly benefits. This should include evaluating the cause of the errors identified above and updating controls as necessary. • Periodically monitor the established controls to determine if they are working effectively and as intended. • Perform periodic reviews of the claimant files to reasonably ensure the information is properly maintained and accurately entered into the related systems. • Evaluate overpayments and/or payments to ineligible claimants and offset future benefits or seek reimbursement, where necessary. Auditor of State’s Conclusion The response to this finding included in the State of Ohio Corrective Action Plan indicated they disagreed with the additional questioned costs related to an employee improperly clearing unemployment issues for claimants and required an Auditor of State’s Conclusion. This portion of the finding identified suspected illegal or improper activity by a Department employee in which Unemployment Insurance claimants may have received benefits in which they were not entitled to. Although the Department is waiting to investigate these claims until after the criminal process is completed, our review of the Office of the Ohio Inspector General’s report and related support during the audit period identified potential improper payments and requires reporting as questioned costs. 2 C.F.R. § 200 defines questioned costs as a cost that is questioned by the auditor because of an audit finding. Questioned costs are not an improper payment until reviewed and confirmed to be improper. Therefore, the finding will remain as stated above.

UNEMPLOYMENT INSURANCE – IMPROPER PAYMENTS Finding Number: 2023-009 State Agency Number: JFS-01 Assistance Listing Number and Title: 17.225 – Unemployment Insurance 17.225 COVID-19 – Unemployment Insurance Federal Award Identification Number / Year: UI-34078-20-55-A-39 / 2020 UI-35668-21-55-A-39 / 2021 UI-37243-22-55-A-39 / 2022 UI-39342-23-55-A-39 / 2023 Federal Agency: Department of Labor Compliance Requirements: Activities Allowed or Unallowed, Allowable Costs/Costs Principles, Eligibility Repeat Finding from Prior Audit? Yes Prior Audit Finding Number: 2022-010 QUESTIONED COSTS, NONCOMPLIANCE, AND SIGNIFICANT DEFICIENCY 2 C.F.R. § 2900.4 gives regulatory effect to the Department of Labor (DOL) for 2 C.F.R. § 200.1 which states, in part: Improper payment means: (1) Any payment that should not have been made or that was made in an incorrect amount under statutory, contractual, administrative, or other legally applicable requirements. (i) Incorrect amounts are overpayments or underpayments that are made to eligible recipients (including inappropriate denials of payment or service, any payment that does not account for credit for applicable discounts, payments that are for an incorrect amount, and duplicate payments). An improper payment also includes any payment that was made to an ineligible recipient or for an ineligible good or service, or payments for goods or services not received (except for such payments authorized by law). . . . 15 U.S.C. § 9023(b)(3) pertaining to Federal Pandemic Unemployment Compensation (FPUC) states, in part: (15) In general The amount specified in this paragraph is the following amount: (i) For weeks of unemployment beginning after the date on which an agreement is entered into under this section and ending on or before July 31, 2020, $600. (ii) For weeks of unemployment beginning after December 26, 2020 (or, if later, the date on which such agreement is entered into), and ending on or before September 6, 2021, $300. 15 U.S.C. § 9025(a)(4) pertaining to Pandemic Emergency Unemployment Compensation (PEUC) states, in part: (A) the amount of pandemic emergency unemployment compensation which shall be payable to any individual for any week of total unemployment shall be equal to: (i) the amount of the regular compensation (including dependents’ allowances) payable to such individual during such individual’s benefit year under the State law for a week of total unemployment; (ii) the amount of Federal Pandemic Unemployment Compensation under section 9023(b)(1)(B) of this title; and (iii) the amount (if any) of Mixed Earner Unemployment Compensation under section 9023(b)(1)(C) of this title; . . . Ohio Rev. Code (ORC) § 4141.29 states, in part: . . . (A) No individual is entitled to a waiting period or benefits for any week unless the individual: . . . (4)(a)(i) Is able to work and available for suitable work and, except as provided in division (A)(4)(a)(ii) or (iii) of this section, is actively seeking suitable work either in a locality in which the individual has earned wages subject to this chapter during the individual's base period, or if the individual leaves that locality, then in a locality where suitable work normally is performed. . . . (4)(b)(i) The individual shall be instructed as to the efforts that the individual must make in the search for suitable work, including that, within six months after October 11, 2013, the individual shall register with the OhioMeansJobs web site, . . . . . . (7) Participates in the reemployment and eligibility assessment program, or other reemployment services, as required by the director. As used in division (A)(7) of this section, "reemployment services" includes job search assistance activities, skills assessments, and the provision of labor market statistics or analysis. . . . (B) An individual suffering total or partial unemployment is eligible for benefits for unemployment occurring subsequent to a waiting period of one week and no benefits shall be payable during this required waiting period. Not more than one week of waiting period shall be required of any individual in any benefit year in order to establish the individual's eligibility for total or partial unemployment benefits. (C) The waiting period for total or partial unemployment shall commence on the first day of the first week with respect to which the individual first files a claim for benefits at an employment office or other place of registration maintained or designated by the director or on the first day of the first week with respect to which the individual has otherwise filed a claim for benefits in accordance with the rules of the department of job and family services, provided such claim is allowed by the director. . . . The federal government established rules, regulations, and requirements related to eligibility, benefit amounts and timing, monitoring responsibilities, etc. regarding Unemployment benefits and the expanded Unemployment benefits related to the pandemic. It is management’s responsibility to implement controls, processes, and procedures to provide reasonable assurance over the reliability of financial reporting, effectiveness and efficiency of operations, and compliance with these rules, regulations, and requirements. During state fiscal year 2023, the Department disbursed more than $699.6 million in unemployment benefits through the Ohio Job Insurance (OJI) benefit system. Approximately $659.3 million in regular unemployment, $12.7 million related to FPUC, and $2.8 million related to PEUC. The Department also reported to the U.S. Department of Labor outstanding Unemployment Insurance overpayments totaling $72.9 million as of June 30, 2023. Of these total overpayments, $31.7 million was identified as fraud and $41.2 million as non-fraud relating to regular unemployment and federal pandemic unemployment benefits. Eligibility for unemployment benefits including FPUC and PEUC was determined within OJI based upon requirements outlined in state and/or federal laws. FPUC provided additional benefits of $600 and/or $300 per week to individuals that qualified for regular unemployment or Pandemic Unemployment Assistance (PUA) benefits. PEUC allowed up to a maximum of 53 additional weeks of benefits for individuals who exhausted regular unemployment compensation and PUA benefits. The OJI system includes various automated controls to ensure benefits are not paid in excess of the allowable amount, claimants appropriately serve a waiting week for their claim, and, where required, work search activities are completed. Weekly, claimants confirmed their unemployment status and completed the required work search activities or COVID-19 self-attestation questionnaire within OJI. If the claimant’s benefit payment was flagged, an adjudicator performed an additional review and requested fact-finding information for either monetary or nonmonetary issues. The claimant continued to receive weekly benefit payments until the adjudicator investigated the issue and confirmed the claimant’s ineligible status. If an issue was suspected of fraud, the issue was routed to the Department’s Benefit Payment Control section to be investigated, adjudicated and, if applicable, an overpayment flag was created in OJI. The Department’s policy, which is based on U.S. Department of Labor guidance, is to adjudicate possible fraud cases within 21 days or 90 days, depending on the circumstances of the case. Although the Department had various controls in place over regular and pandemic unemployment benefit payments, these controls did not prevent or detect the following noncompliance errors, resulting in questioned costs totaling $11,343 ($7,800 for FPUC and $3,543 for regular unemployment benefits): • For one of 17 (5.9%) unemployment benefit claims identified in an OJI system data match as potentially being duplicate payments, the claimant was paid duplicate FPUC benefits of $600 a week for several weeks of benefits in state fiscal year 2023. As a result, the claimant was overpaid FPUC benefits of $7,800 during the audit period. • For one of 25 (4%) regular unemployment benefit claims identified in an OJI system data match as potentially exceeding the maximum allowable number of weeks, the Claims Examiner did not adjudicate the issue flagged by the system for not completing a Career Profile Assessment in the OhioMeansJobs website in a timely manner, resulting in an overpayment of $1,770. • For three of 60 (5%) regular unemployment benefit claims selected for testing, the claimant was not eligible to receive benefits for the weeks claimed or was overpaid, as follows:  One claimant filed a weekly claim and certified the required two work search activities were completed. However, the claimant described the work search activities as "none." Because the claimant did not complete work search activities, we will question costs for all weeks the claimant did not complete work search activities, or two weeks totaling $852.  One claimant did not complete a Career Profile Assessment in the OhioMeansJobs website. When the system flagged the issue, the Claims Examiner did not adjudicate the issue in a timely manner, resulting in an overpayment of $530.  One claimant worked full-time during the waiting week of the claim. After the claimant served the waiting week, the employer notified the Department of the claimant's earnings during the waiting week which exceeded their weekly benefit amount, and the OJI system flagged this issue. However, the Claims Examiner did not appropriately adjudicate the issue; as a result, the claimant did not serve a waiting week for the claim and was overpaid benefits. We will therefore question costs for one week of the claim, totaling $391. ADDITIONAL QUESTIONED COSTS: In August 2023, the Office of the Ohio Inspector General referred a report to the Auditor of State for further consideration. The report included an investigation of suspected illegal or improper activity by a Department employee in the Office of Workforce Development. As part of the investigation, investigators determined the employee improperly accessed and/or cleared unemployment issues for various claimants, which were outside of the employee’s job duties. As a result of the employee actions, the Department may have improperly paid unemployment benefits to five claimants totaling $84,414. We will question costs totaling $84,414 for the improper payments ($46,800 for FPUC, $24,629 for regular unemployment benefits, and $12,985 in PEUC). Due to an impending court case with the employee, the Department has decided to wait and adjudicate any overpayments once the case is resolved. Without effective internal controls for the eligibility determination and benefit payment processes, there is an increased risk benefit payments will be inaccurate or unallowable. The risk is increased if the system contains significant flaws or eligibility redeterminations are not made timely or accurately. Overpayments to ineligible claimants may subject the Department to penalties or sanctions which may jeopardize future funding and limit its ability to fulfill program requirements to provide benefits to those in need. Based on discussions with management, these errors were due to oversight, system design flaws within OJI, and significant workload increases due to the impact the pandemic had on the program. We recommend Department management: • Evaluate and strengthen current internal control procedures over the Unemployment Insurance program to assure claimants are eligible and receive the correct weekly benefits. This should include evaluating the cause of the errors identified above and updating controls as necessary. • Periodically monitor the established controls to determine if they are working effectively and as intended. • Perform periodic reviews of the claimant files to reasonably ensure the information is properly maintained and accurately entered into the related systems. • Evaluate overpayments and/or payments to ineligible claimants and offset future benefits or seek reimbursement, where necessary. Auditor of State’s Conclusion The response to this finding included in the State of Ohio Corrective Action Plan indicated they disagreed with the additional questioned costs related to an employee improperly clearing unemployment issues for claimants and required an Auditor of State’s Conclusion. This portion of the finding identified suspected illegal or improper activity by a Department employee in which Unemployment Insurance claimants may have received benefits in which they were not entitled to. Although the Department is waiting to investigate these claims until after the criminal process is completed, our review of the Office of the Ohio Inspector General’s report and related support during the audit period identified potential improper payments and requires reporting as questioned costs. 2 C.F.R. § 200 defines questioned costs as a cost that is questioned by the auditor because of an audit finding. Questioned costs are not an improper payment until reviewed and confirmed to be improper. Therefore, the finding will remain as stated above.

SNAP CLUSTER AND TANF – IEVS ALERTS Finding Number: 2023-010 State Agency Number: JFS-02 Assistance Listing Numbers and Titles: 10.551/10.561 – SNAP Cluster 93.558 – Temporary Assistance for Needy Families (TANF) Federal Award Identification Number / Year: 212OH102S2514 / 2021 (SNAP Cluster) 212OH102S6018 / 2021 (SNAP Cluster) 222OH102S2514 / 2022 (SNAP Cluster) 222OH102S6018 / 2022 (SNAP Cluster) 232OH102S2514 / 2023 (SNAP Cluster) 232OH102S6018 / 2023 (SNAP Cluster) 2101OHTANF / 2021 (TANF) 2201OHTANF / 2022 (TANF) 2301OHTANF / 2023 (TANF) Federal Agencies: Department of Agriculture Department of Health and Human Services Compliance Requirements: Eligibility, Special Tests and Provisions – Income Eligibility Verification System Repeat Finding from Prior Audit? Yes Prior Audit Finding Numbers: 2022-013, 2022-017 NONCOMPLIANCE AND MATERIAL WEAKNESS 7 C.F.R. § 272.8(c), states the following regarding the Supplemental Nutrition Assistance Program (SNAP) Cluster: (1) State agency action on information items about recipient households shall include: (i) Review of the information and comparison of it to case record information; (ii) For all new or previously unverified information received, contact with the households and/or collateral contacts to resolve discrepancies as specified in §§ 273.2(f)(4)(iv) and 273.2 (f)(9)(iii) and (f)(9)(iv); and (iii) If discrepancies warrant reducing benefits or terminating eligibility, notices of adverse action. (2) State agencies must initiate and pursue the actions on recipient households specified in paragraph (c)(1) of this section so that the actions are completed within 45 days of receipt of the information items. Actions may be completed later than 45 days from the receipt of information if: (A) The only reason that the actions cannot be completed is the nonreceipt of verification requested from collateral contacts; and (B) The actions are completed as specified in § 273.12 of this chapter when verification from a collateral contact is received or in conjunction with the next case action when such verification is not received, whichever is earlier. (3) When the actions specified in paragraph (c)(1) of this section substantiate an over issuance, State agencies must establish and take actions on claims as specified in § 273.18 of this chapter. (4) State agencies must use appropriate procedures to monitor the timeliness requirements in paragraph (c)(2) of this section. 45 C.F.R. § 205.56(a)(1)(iv) states the following regarding the Temporary Assistance for Needy Families (TANF) program: For individuals who are recipients when the information is received or for whom a decision could not be made prior to authorization of benefits, the State agency shall within forty-five (45) days of its receipt, initiate a notice of case action or an entry in the case record that no case action is necessary, except that: Completion of action may be delayed beyond forty-five (45) days on no more than twenty (20) percent of the information items targeted for follow-up, if: (A) The reason that the action cannot be completed within forty-five (45) days is the nonreceipt of requested third-party verification; and (B) Action is completed promptly, when third party verification is received or at the next time eligibility is redetermined, whichever is earlier. If action is completed when eligibility is redetermined and third party verification has not been received, the State agency shall make its decision based on information provided by the recipient and any other information in its possession. As the lead agency responsible for administering the SNAP Cluster and TANF federal programs for the State of Ohio, the Department is responsible for providing reasonable assurance only eligible individuals receive assistance and documentation maintained is accurate, complete, and properly recorded in the Ohio Benefits system to ensure appropriate eligibility determinations. It is the Department’s responsibility to implement sufficient controls, systems, processes, and procedures to reasonably ensure compliance with the rules and regulations associated with these programs and only eligible recipients receive benefits. When automated systems are utilized to perform certain functions related to this compliance, management must ensure the system is properly designed and operating effectively. The Department is also responsible for overall program compliance and must have appropriate oversight and monitoring procedures in place to ensure those they rely on are operating in accordance with all expectations, guidelines, and requirements related to their tasks. The SNAP Cluster and TANF federal programs are administered using a multi-agency approach: overall compliance and administration of the programs fall under the Department, and programming and administration of the State’s eligibility determination computer system, Ohio Benefits, falls under the Ohio Department of Administrative Services (DAS). The Department also utilizes the 88 Ohio counties in the eligibility determination process to work with applicants, receive/enter eligibility documentation into the Ohio Benefits system, and follow up on alerts issued by the system. The Ohio Benefits system was utilized for processing eligibility for the SNAP Cluster and TANF programs with total expenditures to recipients of approximately $4.3 billion and $211 million, respectively, in state fiscal year (SFY) 2023. The Ohio Benefits system contains the eligibility and benefit information/determinations for these programs, including the Income Eligibility Verification System (IEVS) functionality which compares reported recipient income to income information maintained by outside data sources (Social Security Administration, Internal Revenue Service (IRS), etc.). Information that does not agree is communicated in the form of an Ohio Benefits system alert. The Ohio Benefits system then determines if the alert is a ‘match’ that requires action. The IEVS match, indicated by ‘Yes’ in the Ohio Benefits system, is forwarded to the appropriate county agency for investigation and resolution. Each match has a defined due date, which is unique based on the priority level and other policy and process related factors. However, we noted the following weaknesses: • Volume of Alerts – During SFY 2023, more than 16.4 million alerts were issued (4.3 million IEVS alerts and 12.1 million non-IEVS alerts) for all public assistance programs that utilize Ohio Benefits, including the SNAP Cluster and TANF programs. Alerts can be generated by Ohio Benefits via interface outputs/updates, batch outputs or other triggers within the system. Ongoing enhancements to the Ohio Benefits alerts process were made in coordination with personnel from the Department, the Ohio Department of Medicaid, and DAS throughout the audit period to address design weaknesses and streamline and reduce the volume of IRS matches received and delivered to county agencies. However, system enhancements were not fully implemented until later in the audit period which resulted in an increased workload for the county agencies and ineffective application of the alert/match process. In addition, the Department conducts Fraud Triad Reviews, which in part, includes a review of 1) IEVS processing timeliness, 2) proper verifications, 3) proper disposition coding and 4) random supervisory reviews. The Department instructs County supervisors to conduct random reviews of cases with an IEVS alert to ensure they were cleared properly and timely, as well as monitor the JFSR 4005, IEVS Monthly Summary Report to track completion of IEVS alerts. The Department stated it continues to monitor the JFSR 4005, IEVS Monthly Summary Report to better identify those county agencies which require additional training and technical assistance; however, no evidence is documented or maintained. • Caseworker Reliance/Training – The current process relies heavily on the knowledge and judgement of county caseworkers in the eligibility process, including reviewing IEVS matches. The Department also continues to conduct statewide trainings and individual trainings for county agencies to assist them in working IEVS alerts/matches; however, these trainings are typically optional and/or attended by a representative of the county agency who is expected to relay the information to others. Additionally, we noted the following noncompliance with federal regulations where IEVS alerts were not cleared timely. • Clearing Alerts – While the Department has controls and procedures in place to review and monitor the IEVS alerts and matches generated and processed by the Ohio Benefits system, there were instances when matches were not being completed by the county agencies in accordance with the requirements and timeframes established in 7 C.F.R. § 272.8, and 45 C.F.R. § 205.56. Furthermore, an Ohio Benefits report showed 261,444 of the 478,685 (55%) IEVS matches sent to the county agencies during the audit period were not cleared within 45 days as required. The matches were cleared between one and 434 days beyond the 45-day requirement, for an average of 132 days late. Failure to implement system enhancements timely, perform monitoring activities, mandate training for county caseworkers, and complete IEVS alerts within the established timeframes increases the risk benefits given to ineligible recipients or for inappropriate amounts will not be identified timely. This condition could adversely affect the Department’s ability to comply with IEVS requirements for these federal programs which could result in federal sanctions or penalties. Based on discussions with management, the Ohio Benefits enhancements were made later in the audit period; therefore, the full benefit was not realized. As a result, the training provided to county agencies on how to use reports to identify the work required to attain timeliness was not conducted until after the audit period. Management indicated they continue to monitor the system and enhancements to ensure they meet the desired impact, as well as reach out to county and state personnel to offer technical assistance. While training is offered and made available to county personnel, management indicated the Department’s county administered approach creates challenges to making training mandatory. We recommend Department management continue to work collectively with DAS to implement/update robust processes, procedures, and system controls to address the weaknesses associated with the IEVS process within the Ohio Benefits system. These changes/updates should include, but not be limited to: • Including a more centralized evaluation of alert/match activity and/or better use of automated tools to vet and prioritize items requiring follow-up at the county level. This would allow Department level personnel to become more experienced and adept at identifying and investigating anomalies and help focus the resources of both Department and county personnel. • Continuing to perform periodic and timely reviews of the JFSR 4005, IEVS Monthly Summary Report at the Department level to monitor the status and completion of IEVS matches; these reviews should be evidenced and documented. Such procedures should also include required monitoring by each County IEVS Coordinator or other supervisory personnel (through the eligibility system), which should be explicitly identified in the sub-grant agreements with the county agencies and include appropriate ramifications for noncompliance with the stated requirements. • Requiring mandatory training for all county agency employees who are entering the assistance group information into Ohio Benefits to help ensure proper and complete information is being collected, entered, and verified prior to an individual’s eligibility determination being made. The Department should continue to provide this training initially to ensure all users are knowledgeable of the process, procedures, and impacts of the work they do. As changes occur to the rules/regulations, system, or process, detailed training should be required of all users on those changes. • Continuing to monitor the IEVS alert processing procedures guide for the matches issued by the Ohio Benefits system to ensure matches are properly documented within the system, worked within the proper timeframes, and proper verification documentation is obtained and maintained by the county agencies for resolved matches. • Continuing to identify and coordinate Ohio Benefits program changes to address the system design weaknesses as discovered. This should include working collaboratively with DAS to prioritize program changes which could directly impact the eligibility determinations or benefit amounts to ensure they are corrected in a timely manner to prevent and detect further improper payments. In addition, the Department should continue to evaluate these enhancements to assist DAS in determining if the desired outcome was achieved. We also recommend Department management continue to monitor the status of system enhancements and roll-out of resources to the appropriate personnel to ensure they are implemented timely and as planned.

SNAP CLUSTER AND TANF – IEVS ALERTS Finding Number: 2023-010 State Agency Number: JFS-02 Assistance Listing Numbers and Titles: 10.551/10.561 – SNAP Cluster 93.558 – Temporary Assistance for Needy Families (TANF) Federal Award Identification Number / Year: 212OH102S2514 / 2021 (SNAP Cluster) 212OH102S6018 / 2021 (SNAP Cluster) 222OH102S2514 / 2022 (SNAP Cluster) 222OH102S6018 / 2022 (SNAP Cluster) 232OH102S2514 / 2023 (SNAP Cluster) 232OH102S6018 / 2023 (SNAP Cluster) 2101OHTANF / 2021 (TANF) 2201OHTANF / 2022 (TANF) 2301OHTANF / 2023 (TANF) Federal Agencies: Department of Agriculture Department of Health and Human Services Compliance Requirements: Eligibility, Special Tests and Provisions – Income Eligibility Verification System Repeat Finding from Prior Audit? Yes Prior Audit Finding Numbers: 2022-013, 2022-017 NONCOMPLIANCE AND MATERIAL WEAKNESS 7 C.F.R. § 272.8(c), states the following regarding the Supplemental Nutrition Assistance Program (SNAP) Cluster: (1) State agency action on information items about recipient households shall include: (i) Review of the information and comparison of it to case record information; (ii) For all new or previously unverified information received, contact with the households and/or collateral contacts to resolve discrepancies as specified in §§ 273.2(f)(4)(iv) and 273.2 (f)(9)(iii) and (f)(9)(iv); and (iii) If discrepancies warrant reducing benefits or terminating eligibility, notices of adverse action. (2) State agencies must initiate and pursue the actions on recipient households specified in paragraph (c)(1) of this section so that the actions are completed within 45 days of receipt of the information items. Actions may be completed later than 45 days from the receipt of information if: (A) The only reason that the actions cannot be completed is the nonreceipt of verification requested from collateral contacts; and (B) The actions are completed as specified in § 273.12 of this chapter when verification from a collateral contact is received or in conjunction with the next case action when such verification is not received, whichever is earlier. (3) When the actions specified in paragraph (c)(1) of this section substantiate an over issuance, State agencies must establish and take actions on claims as specified in § 273.18 of this chapter. (4) State agencies must use appropriate procedures to monitor the timeliness requirements in paragraph (c)(2) of this section. 45 C.F.R. § 205.56(a)(1)(iv) states the following regarding the Temporary Assistance for Needy Families (TANF) program: For individuals who are recipients when the information is received or for whom a decision could not be made prior to authorization of benefits, the State agency shall within forty-five (45) days of its receipt, initiate a notice of case action or an entry in the case record that no case action is necessary, except that: Completion of action may be delayed beyond forty-five (45) days on no more than twenty (20) percent of the information items targeted for follow-up, if: (A) The reason that the action cannot be completed within forty-five (45) days is the nonreceipt of requested third-party verification; and (B) Action is completed promptly, when third party verification is received or at the next time eligibility is redetermined, whichever is earlier. If action is completed when eligibility is redetermined and third party verification has not been received, the State agency shall make its decision based on information provided by the recipient and any other information in its possession. As the lead agency responsible for administering the SNAP Cluster and TANF federal programs for the State of Ohio, the Department is responsible for providing reasonable assurance only eligible individuals receive assistance and documentation maintained is accurate, complete, and properly recorded in the Ohio Benefits system to ensure appropriate eligibility determinations. It is the Department’s responsibility to implement sufficient controls, systems, processes, and procedures to reasonably ensure compliance with the rules and regulations associated with these programs and only eligible recipients receive benefits. When automated systems are utilized to perform certain functions related to this compliance, management must ensure the system is properly designed and operating effectively. The Department is also responsible for overall program compliance and must have appropriate oversight and monitoring procedures in place to ensure those they rely on are operating in accordance with all expectations, guidelines, and requirements related to their tasks. The SNAP Cluster and TANF federal programs are administered using a multi-agency approach: overall compliance and administration of the programs fall under the Department, and programming and administration of the State’s eligibility determination computer system, Ohio Benefits, falls under the Ohio Department of Administrative Services (DAS). The Department also utilizes the 88 Ohio counties in the eligibility determination process to work with applicants, receive/enter eligibility documentation into the Ohio Benefits system, and follow up on alerts issued by the system. The Ohio Benefits system was utilized for processing eligibility for the SNAP Cluster and TANF programs with total expenditures to recipients of approximately $4.3 billion and $211 million, respectively, in state fiscal year (SFY) 2023. The Ohio Benefits system contains the eligibility and benefit information/determinations for these programs, including the Income Eligibility Verification System (IEVS) functionality which compares reported recipient income to income information maintained by outside data sources (Social Security Administration, Internal Revenue Service (IRS), etc.). Information that does not agree is communicated in the form of an Ohio Benefits system alert. The Ohio Benefits system then determines if the alert is a ‘match’ that requires action. The IEVS match, indicated by ‘Yes’ in the Ohio Benefits system, is forwarded to the appropriate county agency for investigation and resolution. Each match has a defined due date, which is unique based on the priority level and other policy and process related factors. However, we noted the following weaknesses: • Volume of Alerts – During SFY 2023, more than 16.4 million alerts were issued (4.3 million IEVS alerts and 12.1 million non-IEVS alerts) for all public assistance programs that utilize Ohio Benefits, including the SNAP Cluster and TANF programs. Alerts can be generated by Ohio Benefits via interface outputs/updates, batch outputs or other triggers within the system. Ongoing enhancements to the Ohio Benefits alerts process were made in coordination with personnel from the Department, the Ohio Department of Medicaid, and DAS throughout the audit period to address design weaknesses and streamline and reduce the volume of IRS matches received and delivered to county agencies. However, system enhancements were not fully implemented until later in the audit period which resulted in an increased workload for the county agencies and ineffective application of the alert/match process. In addition, the Department conducts Fraud Triad Reviews, which in part, includes a review of 1) IEVS processing timeliness, 2) proper verifications, 3) proper disposition coding and 4) random supervisory reviews. The Department instructs County supervisors to conduct random reviews of cases with an IEVS alert to ensure they were cleared properly and timely, as well as monitor the JFSR 4005, IEVS Monthly Summary Report to track completion of IEVS alerts. The Department stated it continues to monitor the JFSR 4005, IEVS Monthly Summary Report to better identify those county agencies which require additional training and technical assistance; however, no evidence is documented or maintained. • Caseworker Reliance/Training – The current process relies heavily on the knowledge and judgement of county caseworkers in the eligibility process, including reviewing IEVS matches. The Department also continues to conduct statewide trainings and individual trainings for county agencies to assist them in working IEVS alerts/matches; however, these trainings are typically optional and/or attended by a representative of the county agency who is expected to relay the information to others. Additionally, we noted the following noncompliance with federal regulations where IEVS alerts were not cleared timely. • Clearing Alerts – While the Department has controls and procedures in place to review and monitor the IEVS alerts and matches generated and processed by the Ohio Benefits system, there were instances when matches were not being completed by the county agencies in accordance with the requirements and timeframes established in 7 C.F.R. § 272.8, and 45 C.F.R. § 205.56. Furthermore, an Ohio Benefits report showed 261,444 of the 478,685 (55%) IEVS matches sent to the county agencies during the audit period were not cleared within 45 days as required. The matches were cleared between one and 434 days beyond the 45-day requirement, for an average of 132 days late. Failure to implement system enhancements timely, perform monitoring activities, mandate training for county caseworkers, and complete IEVS alerts within the established timeframes increases the risk benefits given to ineligible recipients or for inappropriate amounts will not be identified timely. This condition could adversely affect the Department’s ability to comply with IEVS requirements for these federal programs which could result in federal sanctions or penalties. Based on discussions with management, the Ohio Benefits enhancements were made later in the audit period; therefore, the full benefit was not realized. As a result, the training provided to county agencies on how to use reports to identify the work required to attain timeliness was not conducted until after the audit period. Management indicated they continue to monitor the system and enhancements to ensure they meet the desired impact, as well as reach out to county and state personnel to offer technical assistance. While training is offered and made available to county personnel, management indicated the Department’s county administered approach creates challenges to making training mandatory. We recommend Department management continue to work collectively with DAS to implement/update robust processes, procedures, and system controls to address the weaknesses associated with the IEVS process within the Ohio Benefits system. These changes/updates should include, but not be limited to: • Including a more centralized evaluation of alert/match activity and/or better use of automated tools to vet and prioritize items requiring follow-up at the county level. This would allow Department level personnel to become more experienced and adept at identifying and investigating anomalies and help focus the resources of both Department and county personnel. • Continuing to perform periodic and timely reviews of the JFSR 4005, IEVS Monthly Summary Report at the Department level to monitor the status and completion of IEVS matches; these reviews should be evidenced and documented. Such procedures should also include required monitoring by each County IEVS Coordinator or other supervisory personnel (through the eligibility system), which should be explicitly identified in the sub-grant agreements with the county agencies and include appropriate ramifications for noncompliance with the stated requirements. • Requiring mandatory training for all county agency employees who are entering the assistance group information into Ohio Benefits to help ensure proper and complete information is being collected, entered, and verified prior to an individual’s eligibility determination being made. The Department should continue to provide this training initially to ensure all users are knowledgeable of the process, procedures, and impacts of the work they do. As changes occur to the rules/regulations, system, or process, detailed training should be required of all users on those changes. • Continuing to monitor the IEVS alert processing procedures guide for the matches issued by the Ohio Benefits system to ensure matches are properly documented within the system, worked within the proper timeframes, and proper verification documentation is obtained and maintained by the county agencies for resolved matches. • Continuing to identify and coordinate Ohio Benefits program changes to address the system design weaknesses as discovered. This should include working collaboratively with DAS to prioritize program changes which could directly impact the eligibility determinations or benefit amounts to ensure they are corrected in a timely manner to prevent and detect further improper payments. In addition, the Department should continue to evaluate these enhancements to assist DAS in determining if the desired outcome was achieved. We also recommend Department management continue to monitor the status of system enhancements and roll-out of resources to the appropriate personnel to ensure they are implemented timely and as planned.

VARIOUS PROGRAMS –TRANSPARENCY ACT REPORTING Finding Number: 2023-011 State Agency Number: JFS-03 Assistance Listing Numbers and Titles: 17.258/17.259/17.278 – WIOA Cluster 93.658 – Foster Care Title IV-E (FC) 93.659 – Adoption Assistance (AA) 93.667 – Social Services Block Grant (SSBG) Federal Award Identification Number / Year: AA385492255A39 / 2022 (WIOA Cluster) 2301OHFOST / 2021 (FC) 2101OHFOST / 2023 (FC) 2101OHADPT / 2021 (AA) 2201OHSOSR / 2022 (SSBG) 2301OHSOSR / 2023 (SSBG) Federal Agencies: Department of Labor Department of Health and Human Services Compliance Requirement: Reporting Repeat Finding from Prior Audit? Yes Prior Audit Finding Number: 2022-015 NONCOMPLIANCE AND MATERIAL WEAKNESS NOTE: Finding number 2023-019 contains additional information which is integral to and should be read in conjunction with this finding. The Federal Funding Accountability and Transparency Act (Pub. L. No. 109-282, as amended by Section 6202 of Public Law 110-252, hereafter referred to as the “Transparency Act” that are codified in 2 C.F.R. Part 170) requires prime recipients of federal awards who make first-tier subawards to report the subaward on the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS) website maintained by the federal Office of Management and Budget. Under the requirements of 2 C.F.R. Part 170, recipients (i.e., direct recipients) of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more on the FSRS website. Prime recipients must report by the end of the month following the month in which the obligation is made. It is management’s responsibility to design and implement internal controls to reasonably ensure compliance with laws and regulations and to ensure management’s objectives are achieved. The State of Ohio is considered the prime recipient for federal funds applicable to Transparency Act reporting and the state agencies receiving these federal funds are expected to report the subawards obligated in accordance with the Transparency Act. During state fiscal year 2023, the Department obligated approximately $188.6 million for 632 subawards which exceeded $30,000 and were required to be reported on the FSRS website in accordance with the Transparency Act, under the following major programs: See the Finding for chart/table For county subaward reporting, the Office of County Finance and Technical Assistance coordinated the filing of the reports for the subsidy payments processed through the County Finance Information System Web (CFIS), which makes up the majority of the subaward reporting. The Senior Fiscal Analyst runs a report in Ohio Administrative Knowledge System (OAKS) Business Intelligence (BI) that lists all the grant distributions from the previous month, compares the report to the CFIS system, and then enters the information into the FSRS website. For contracts and state subaward reporting, the Office of Contracts and Acquisitions runs a report from OAKS BI that lists all contracts and acquisitions the Department entered in the prior month. The Senior Financial Analyst then reviews the listing and contacts the various program areas to determine the information to be reported on the FSRS website. However, the Department’s internal controls were not operating effectively. As a result, the following errors were noted: See the Finding for chart/table Social Services Block Grant Quarterly, the Department transfers a portion of the Title XX (SSBG) award to its partner agencies, one being the Ohio Department of Mental Health and Addiction Services (MHA). MHA also administers the program and obligates subawards for its portion of the program. The State of Ohio Comprehensive Title XX Social Services Plan submitted to and approved by the Department’s federal grantor agency indicates the Department is responsible for complying with any program reporting requirements. However, the Department had no control procedures in place during the audit period to ensure MHA’s subaward information was collected and submitted into the FSRS website. As a result, the Department did not submit MHA’s subaward information into FSRS, as follows: See the Finding for chart/table A lack of effective internal controls over the preparation and review of reports increases the risk the reports submitted to the federal grantor agency are inaccurate and incomplete. In addition, by not complying with federal Transparency Act reporting requirements, the Department risks federal funding being reduced, taken away, or other sanctions imposed by the federal grantor agency. If the subawards are not reported accurately within FSRS, the risk exists that those using the Transparency Reports could be relying on inaccurate information. Based on discussions with management, these issues were caused by oversight and manual error. We recommend the Department collect and report on the FSRS website complete and accurate information, including from its partner agencies, regarding subawards subject to the Transparency Act. We also recommend the Department evaluate its Transparency Act reporting control procedures and update them as necessary, including responsibilities between it and the partner agencies, to promote compliance with the Federal regulations, as well as accuracy and completeness of information submitted. These procedures should be adequately documented and communicated to staff as well as the partner agencies to help ensure the subgrant awards are properly reported in compliance with the Transparency Act for the respective programs.

VARIOUS PROGRAMS –TRANSPARENCY ACT REPORTING Finding Number: 2023-011 State Agency Number: JFS-03 Assistance Listing Numbers and Titles: 17.258/17.259/17.278 – WIOA Cluster 93.658 – Foster Care Title IV-E (FC) 93.659 – Adoption Assistance (AA) 93.667 – Social Services Block Grant (SSBG) Federal Award Identification Number / Year: AA385492255A39 / 2022 (WIOA Cluster) 2301OHFOST / 2021 (FC) 2101OHFOST / 2023 (FC) 2101OHADPT / 2021 (AA) 2201OHSOSR / 2022 (SSBG) 2301OHSOSR / 2023 (SSBG) Federal Agencies: Department of Labor Department of Health and Human Services Compliance Requirement: Reporting Repeat Finding from Prior Audit? Yes Prior Audit Finding Number: 2022-015 NONCOMPLIANCE AND MATERIAL WEAKNESS NOTE: Finding number 2023-019 contains additional information which is integral to and should be read in conjunction with this finding. The Federal Funding Accountability and Transparency Act (Pub. L. No. 109-282, as amended by Section 6202 of Public Law 110-252, hereafter referred to as the “Transparency Act” that are codified in 2 C.F.R. Part 170) requires prime recipients of federal awards who make first-tier subawards to report the subaward on the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS) website maintained by the federal Office of Management and Budget. Under the requirements of 2 C.F.R. Part 170, recipients (i.e., direct recipients) of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more on the FSRS website. Prime recipients must report by the end of the month following the month in which the obligation is made. It is management’s responsibility to design and implement internal controls to reasonably ensure compliance with laws and regulations and to ensure management’s objectives are achieved. The State of Ohio is considered the prime recipient for federal funds applicable to Transparency Act reporting and the state agencies receiving these federal funds are expected to report the subawards obligated in accordance with the Transparency Act. During state fiscal year 2023, the Department obligated approximately $188.6 million for 632 subawards which exceeded $30,000 and were required to be reported on the FSRS website in accordance with the Transparency Act, under the following major programs: See the Finding for chart/table For county subaward reporting, the Office of County Finance and Technical Assistance coordinated the filing of the reports for the subsidy payments processed through the County Finance Information System Web (CFIS), which makes up the majority of the subaward reporting. The Senior Fiscal Analyst runs a report in Ohio Administrative Knowledge System (OAKS) Business Intelligence (BI) that lists all the grant distributions from the previous month, compares the report to the CFIS system, and then enters the information into the FSRS website. For contracts and state subaward reporting, the Office of Contracts and Acquisitions runs a report from OAKS BI that lists all contracts and acquisitions the Department entered in the prior month. The Senior Financial Analyst then reviews the listing and contacts the various program areas to determine the information to be reported on the FSRS website. However, the Department’s internal controls were not operating effectively. As a result, the following errors were noted: See the Finding for chart/table Social Services Block Grant Quarterly, the Department transfers a portion of the Title XX (SSBG) award to its partner agencies, one being the Ohio Department of Mental Health and Addiction Services (MHA). MHA also administers the program and obligates subawards for its portion of the program. The State of Ohio Comprehensive Title XX Social Services Plan submitted to and approved by the Department’s federal grantor agency indicates the Department is responsible for complying with any program reporting requirements. However, the Department had no control procedures in place during the audit period to ensure MHA’s subaward information was collected and submitted into the FSRS website. As a result, the Department did not submit MHA’s subaward information into FSRS, as follows: See the Finding for chart/table A lack of effective internal controls over the preparation and review of reports increases the risk the reports submitted to the federal grantor agency are inaccurate and incomplete. In addition, by not complying with federal Transparency Act reporting requirements, the Department risks federal funding being reduced, taken away, or other sanctions imposed by the federal grantor agency. If the subawards are not reported accurately within FSRS, the risk exists that those using the Transparency Reports could be relying on inaccurate information. Based on discussions with management, these issues were caused by oversight and manual error. We recommend the Department collect and report on the FSRS website complete and accurate information, including from its partner agencies, regarding subawards subject to the Transparency Act. We also recommend the Department evaluate its Transparency Act reporting control procedures and update them as necessary, including responsibilities between it and the partner agencies, to promote compliance with the Federal regulations, as well as accuracy and completeness of information submitted. These procedures should be adequately documented and communicated to staff as well as the partner agencies to help ensure the subgrant awards are properly reported in compliance with the Transparency Act for the respective programs.

CHIP – INELIGIBILE RECIPIENTS Finding Number: 2023-012 State Agency Number: MCD-02 Assistance Listing Number and Title: 93.767 – Children’s Health Insurance Program (CHIP) 93.767 COVID 19 – CHIP Federal Award Identification Number / Year: 2205OH5022 / 2022 2305OH5023 / 2023 Federal Agency: Department of Health and Human Services Compliance Requirements: Activities Allowed or Unallowed, Allowable Costs/Cost Principles, Eligibility Repeat Finding from Prior Audit? Yes Prior Audit Finding Number: 2022-018 QUESTIONED COSTS 42 U.S.C. § 1397bb(b), pertaining to the Children’s Health Insurance Program (CHIP) states, in part: (1) Eligibility Standards (A) The plan shall include a description of the standards used to determine the eligibility of targeted low-income children for child health assistance under the plan. . . . 42 C.F.R. § 457.50, State Plan requirements pertaining to CHIP states, in part: The State plan is a comprehensive written statement, submitted by the State to CMS for approval, that describes the purpose, nature, and scope of the State’s CHIP and gives an assurance that the program is administered in conformity with the specific requirements of title XXI, title XIX (as appropriate), and the regulations in this chapter. The State plan contains all information necessary for CMS to determine whether the plan can be approved to serve as a basis for Federal financial participation (FFP) in the State program. . . . 42 C.F.R. § 457.380(d), Eligibility verification pertaining to CHIP states: Income. If the State does not accept self-attestation of income, the State must verify the income of an individual by using the data sources and following standards and procedures for verification of financial eligibility consistent with § 435.945(a), § 435.948, and §435.952 of this chapter. 42 C.F.R. § 457.960, Reporting changes in eligibility and redetermining eligibility pertaining to CHIP states: If the State requires reporting of changes in circumstances that may affect the enrollee's eligibility for child health assistance, the State must: (a) Establish procedures to ensure that enrollees make timely and accurate reports of any such change; and (b) Promptly redetermine eligibility when the State has information about these changes. 42 C.F.R. § 457.965, Documentation The State must include in each applicant’s record of facts to support the State’s determination of the applicant’s eligibility for CHIP. Section 2101(a)(2) of the Social Security Act permits the State of Ohio to implement the CHIP program and provide benefits as an expansion of the State’s Title XIX Medicaid plan, rather than operating a separate CHIP program. 42 C.F.R. § 433.400, pertaining to continued enrollment during the public health emergency states, in part: . . . (b) Definitions Validly enrolled means that the beneficiary was enrolled in Medicaid based on a determination of eligibility. A beneficiary is not validly enrolled if the agency determines the eligibility was erroneously granted at the most recent determination, redetermination, or renewal of eligibility (if such last determination was completed prior to March 18, 2020) because of agency error or fraud . . . or abuse . . . . (c) General Requirements (2) Except as provided in paragraph (d) of this section, for all beneficiaries validly enrolled for benefits . . as of or after March 18, 2020, the state must maintain the beneficiary’s enrollment . . . through the end of the month in which the public health emergency for COVID-19 ends. (i)(A) For beneficiaries whose Medicaid coverage meets the definition of MEC (Minimum Essential Coverage) . . . as of or after March 18, 2020, the state must continue to provide Medicaid coverage that meets the definition of MEC . . . . (d) Exceptions (1) . . . a state may terminate a beneficiary’s Medicaid enrollment prior to the first day of the month after the public health emergency for COVID-19 ends in the following circumstances: (i) The beneficiary or beneficiary’s representative requests a voluntary termination of eligibility; (ii) The beneficiary ceases to be a resident of the state; or (iii) The beneficiary dies . . . . The CHIP State Plan outlines the specific eligibility conditions and standards within Section 4 – Eligibility Standards and Methodology for CHIP. During the Public Health Emergency (PHE), the Department issued several Medicaid Eligibility Procedure Letters (MEPLs) to Medicaid personnel, including county caseworkers, on how to address the federal rule changes put into place during the PHE. One such MEPL gave guidance on acceptable and nonacceptable transitions of benefit aid categories to maintain MEC, as described in 42 C.F.R. § 433.400. It is management’s responsibility to implement policies and procedures to provide reasonable assurance they have complied with these requirements. As the lead agency responsible for administering the CHIP federal grant awards for the State of Ohio, the Department is responsible for providing reasonable assurance only eligible individuals receive assistance and documentation maintained is accurate, complete, and properly recorded in the Ohio Benefits system to ensure appropriate eligibility determinations. It is also the Department’s responsibility to implement sufficient controls, systems, processes, and procedures to reasonably ensure compliance with the rules and regulations associated with these programs and only eligible recipients receive benefits. The Department is responsible for overall program compliance and must have appropriate oversight and monitoring procedures in place to ensure those they rely on are operating in accordance with all expectations, guidelines, and requirements related to their tasks. The CHIP program is administered using a multi-agency approach, as follows: overall compliance and administration of CHIP falls under the Department, and programming and administration of the State’s eligibility determination computer system, Ohio Benefits, falls under the Ohio Department of Administrative Services (DAS). The Ohio Benefits system contains the eligibility and benefit information/determinations for these programs. The Department also, through a Memorandum of Understanding with the Ohio Department of Job & Family Services (JFS), utilizes the 88 Ohio counties in the eligibility determination process to work with applicants, receive/enter eligibility documentation into the Ohio Benefits system, and follow up on alerts issued by the system. Currently, individuals applying to receive public assistance benefits complete an application through various methods. The County Departments of Job & Family Services (CDJFS) collect and maintain any documentation provided by the individual either in a paper case file or in the OnBase Enterprise Documentation Management System (EDMS) maintained under contract by DAS and utilized by the Department. After collecting documentation, the county caseworker enters the individual’s information into the Ohio Benefits system which determines the initial eligibility benefit amount and assigns the benefit aid category, where applicable. This process is also used to perform eligibility redeterminations on an annual basis or when prompted through a system alert. Once the determination is made, the Ohio Benefits system uploads the eligibility information to the Department’s payment system to process the payment. During SFY 2023, the Department administered two IT systems to adjudicate provider claims and determine if services were provided to eligible recipients by an eligible provider and allowable prior to payment. The Medicaid Information Technology System (MITS) processed the Department’s managed care capitation payments and fee for service provider claim payments for a majority of the year. In February 2023, the Department began a phased implementation of the Fiscal Intermediary (FI), a part of the new Ohio Medicaid Enterprise System (OMES), which will replace MITS. The following noncompliance was noted related to eligibility for the CHIP program, which included questioned costs totaling $60,862: • Four of 80 (5%) CHIP recipients selected for testing were not eligible to receive benefits on the date services were performed as they were not validly enrolled beneficiaries based on information in Ohio Benefits, the State’s official eligibility determination system. Therefore, these items will result in questioned costs for all claims paid for services provided for these individuals during the time they were ineligible, totaling $51,130. The items noted included issues such as: o The recipient failed to timely report an increase in income and/or new employment. o The caseworker failed to verify and update reported changes in income. o The caseworker failed to timely update Ohio Benefits with an increase in income. These CHIP recipients were enrolled in fee for service benefits; however, upon further investigation, it was determined that three of the ineligible recipients were also enrolled in the Managed Care program during the fiscal year. This resulted in questioned costs for the capitation payments made to Managed Care Plans on behalf of these recipients, totaling $9,732. The items noted above resulted in questioned costs for CHIP, as summarized in the table below: See the Finding for chart/table Without proper controls for entering, processing, and maintaining recipient information, there is an increased risk that benefits paid to or on behalf of recipients will be inaccurate or unallowable. Overpayments or payments to or on behalf of ineligible recipients may subject the Department to penalties or sanctions which may jeopardize future funding and limit its ability to fulfill program requirements to provide benefits to those in need. Based on discussions with management, oversight by staff led to the issues identified. We recommend the Department evaluate and seek reimbursement for all claims that were incorrectly paid. We also recommend management continue to work collectively with the related state agencies to implement/update robust processes, procedures, and system programming to address the weaknesses in the overall eligibility process, including those associated with the Ohio Benefits system. We also recommend the Department regularly evaluating selected benefit payments for all programs to verify the recipient’s eligibility, verify the recipient information entered into Ohio Benefits by the CDJFS is accurate and the information is being maintained to support the State’s eligibility decision, and ensure initial eligibility determinations and redeterminations are completed timely. Any problems noted should be promptly corrected to reduce the risk of benefit payments being made to or on behalf of ineligible individuals and additional training provided to the State and/or county employees affected.

CHIP – INELIGIBILE RECIPIENTS Finding Number: 2023-012 State Agency Number: MCD-02 Assistance Listing Number and Title: 93.767 – Children’s Health Insurance Program (CHIP) 93.767 COVID 19 – CHIP Federal Award Identification Number / Year: 2205OH5022 / 2022 2305OH5023 / 2023 Federal Agency: Department of Health and Human Services Compliance Requirements: Activities Allowed or Unallowed, Allowable Costs/Cost Principles, Eligibility Repeat Finding from Prior Audit? Yes Prior Audit Finding Number: 2022-018 QUESTIONED COSTS 42 U.S.C. § 1397bb(b), pertaining to the Children’s Health Insurance Program (CHIP) states, in part: (1) Eligibility Standards (A) The plan shall include a description of the standards used to determine the eligibility of targeted low-income children for child health assistance under the plan. . . . 42 C.F.R. § 457.50, State Plan requirements pertaining to CHIP states, in part: The State plan is a comprehensive written statement, submitted by the State to CMS for approval, that describes the purpose, nature, and scope of the State’s CHIP and gives an assurance that the program is administered in conformity with the specific requirements of title XXI, title XIX (as appropriate), and the regulations in this chapter. The State plan contains all information necessary for CMS to determine whether the plan can be approved to serve as a basis for Federal financial participation (FFP) in the State program. . . . 42 C.F.R. § 457.380(d), Eligibility verification pertaining to CHIP states: Income. If the State does not accept self-attestation of income, the State must verify the income of an individual by using the data sources and following standards and procedures for verification of financial eligibility consistent with § 435.945(a), § 435.948, and §435.952 of this chapter. 42 C.F.R. § 457.960, Reporting changes in eligibility and redetermining eligibility pertaining to CHIP states: If the State requires reporting of changes in circumstances that may affect the enrollee's eligibility for child health assistance, the State must: (a) Establish procedures to ensure that enrollees make timely and accurate reports of any such change; and (b) Promptly redetermine eligibility when the State has information about these changes. 42 C.F.R. § 457.965, Documentation The State must include in each applicant’s record of facts to support the State’s determination of the applicant’s eligibility for CHIP. Section 2101(a)(2) of the Social Security Act permits the State of Ohio to implement the CHIP program and provide benefits as an expansion of the State’s Title XIX Medicaid plan, rather than operating a separate CHIP program. 42 C.F.R. § 433.400, pertaining to continued enrollment during the public health emergency states, in part: . . . (b) Definitions Validly enrolled means that the beneficiary was enrolled in Medicaid based on a determination of eligibility. A beneficiary is not validly enrolled if the agency determines the eligibility was erroneously granted at the most recent determination, redetermination, or renewal of eligibility (if such last determination was completed prior to March 18, 2020) because of agency error or fraud . . . or abuse . . . . (c) General Requirements (2) Except as provided in paragraph (d) of this section, for all beneficiaries validly enrolled for benefits . . as of or after March 18, 2020, the state must maintain the beneficiary’s enrollment . . . through the end of the month in which the public health emergency for COVID-19 ends. (i)(A) For beneficiaries whose Medicaid coverage meets the definition of MEC (Minimum Essential Coverage) . . . as of or after March 18, 2020, the state must continue to provide Medicaid coverage that meets the definition of MEC . . . . (d) Exceptions (1) . . . a state may terminate a beneficiary’s Medicaid enrollment prior to the first day of the month after the public health emergency for COVID-19 ends in the following circumstances: (i) The beneficiary or beneficiary’s representative requests a voluntary termination of eligibility; (ii) The beneficiary ceases to be a resident of the state; or (iii) The beneficiary dies . . . . The CHIP State Plan outlines the specific eligibility conditions and standards within Section 4 – Eligibility Standards and Methodology for CHIP. During the Public Health Emergency (PHE), the Department issued several Medicaid Eligibility Procedure Letters (MEPLs) to Medicaid personnel, including county caseworkers, on how to address the federal rule changes put into place during the PHE. One such MEPL gave guidance on acceptable and nonacceptable transitions of benefit aid categories to maintain MEC, as described in 42 C.F.R. § 433.400. It is management’s responsibility to implement policies and procedures to provide reasonable assurance they have complied with these requirements. As the lead agency responsible for administering the CHIP federal grant awards for the State of Ohio, the Department is responsible for providing reasonable assurance only eligible individuals receive assistance and documentation maintained is accurate, complete, and properly recorded in the Ohio Benefits system to ensure appropriate eligibility determinations. It is also the Department’s responsibility to implement sufficient controls, systems, processes, and procedures to reasonably ensure compliance with the rules and regulations associated with these programs and only eligible recipients receive benefits. The Department is responsible for overall program compliance and must have appropriate oversight and monitoring procedures in place to ensure those they rely on are operating in accordance with all expectations, guidelines, and requirements related to their tasks. The CHIP program is administered using a multi-agency approach, as follows: overall compliance and administration of CHIP falls under the Department, and programming and administration of the State’s eligibility determination computer system, Ohio Benefits, falls under the Ohio Department of Administrative Services (DAS). The Ohio Benefits system contains the eligibility and benefit information/determinations for these programs. The Department also, through a Memorandum of Understanding with the Ohio Department of Job & Family Services (JFS), utilizes the 88 Ohio counties in the eligibility determination process to work with applicants, receive/enter eligibility documentation into the Ohio Benefits system, and follow up on alerts issued by the system. Currently, individuals applying to receive public assistance benefits complete an application through various methods. The County Departments of Job & Family Services (CDJFS) collect and maintain any documentation provided by the individual either in a paper case file or in the OnBase Enterprise Documentation Management System (EDMS) maintained under contract by DAS and utilized by the Department. After collecting documentation, the county caseworker enters the individual’s information into the Ohio Benefits system which determines the initial eligibility benefit amount and assigns the benefit aid category, where applicable. This process is also used to perform eligibility redeterminations on an annual basis or when prompted through a system alert. Once the determination is made, the Ohio Benefits system uploads the eligibility information to the Department’s payment system to process the payment. During SFY 2023, the Department administered two IT systems to adjudicate provider claims and determine if services were provided to eligible recipients by an eligible provider and allowable prior to payment. The Medicaid Information Technology System (MITS) processed the Department’s managed care capitation payments and fee for service provider claim payments for a majority of the year. In February 2023, the Department began a phased implementation of the Fiscal Intermediary (FI), a part of the new Ohio Medicaid Enterprise System (OMES), which will replace MITS. The following noncompliance was noted related to eligibility for the CHIP program, which included questioned costs totaling $60,862: • Four of 80 (5%) CHIP recipients selected for testing were not eligible to receive benefits on the date services were performed as they were not validly enrolled beneficiaries based on information in Ohio Benefits, the State’s official eligibility determination system. Therefore, these items will result in questioned costs for all claims paid for services provided for these individuals during the time they were ineligible, totaling $51,130. The items noted included issues such as: o The recipient failed to timely report an increase in income and/or new employment. o The caseworker failed to verify and update reported changes in income. o The caseworker failed to timely update Ohio Benefits with an increase in income. These CHIP recipients were enrolled in fee for service benefits; however, upon further investigation, it was determined that three of the ineligible recipients were also enrolled in the Managed Care program during the fiscal year. This resulted in questioned costs for the capitation payments made to Managed Care Plans on behalf of these recipients, totaling $9,732. The items noted above resulted in questioned costs for CHIP, as summarized in the table below: See the Finding for chart/table Without proper controls for entering, processing, and maintaining recipient information, there is an increased risk that benefits paid to or on behalf of recipients will be inaccurate or unallowable. Overpayments or payments to or on behalf of ineligible recipients may subject the Department to penalties or sanctions which may jeopardize future funding and limit its ability to fulfill program requirements to provide benefits to those in need. Based on discussions with management, oversight by staff led to the issues identified. We recommend the Department evaluate and seek reimbursement for all claims that were incorrectly paid. We also recommend management continue to work collectively with the related state agencies to implement/update robust processes, procedures, and system programming to address the weaknesses in the overall eligibility process, including those associated with the Ohio Benefits system. We also recommend the Department regularly evaluating selected benefit payments for all programs to verify the recipient’s eligibility, verify the recipient information entered into Ohio Benefits by the CDJFS is accurate and the information is being maintained to support the State’s eligibility decision, and ensure initial eligibility determinations and redeterminations are completed timely. Any problems noted should be promptly corrected to reduce the risk of benefit payments being made to or on behalf of ineligible individuals and additional training provided to the State and/or county employees affected.

MEDICAID/CHIP – SERVICE ORGANIZATION MONITORING Finding Number: 2023-013 State Agency Number: MCD-03 Assistance Listing Numbers and Titles: 93.767 – Children’s Health Insurance Program (CHIP) 93.767 COVID 19 – CHIP 93.775/93.777/93.778 – Medicaid Cluster 93.775/93.777/93.778 COVID 19 – Medicaid Cluster Federal Award Identification Number / Year: 2205OH5022 / 2022 (CHIP) 2305OH5023 / 2023 (CHIP) 2205OH5MAP / 2022 (Medicaid Cluster) 2305OH5MAP / 2023 (Medicaid Cluster) Federal Agency: Department of Health and Human Services Compliance Requirements: Activities Allowed or Unallowed, Allowable Costs/Cost Principles, Special Tests and Provisions Repeat Finding from Prior Audit? No NONCOMPLIANCE AND MATERIAL WEAKNESS NOTE: Finding number 2023-001 details weaknesses in internal control related to the Medicaid Cluster regarding the Department’s monitoring of a service organization. This finding is integral to and should be read in conjunction with this finding. 42 C.F.R. § 438.3(m) states the following regarding contract requirements for Managed Care: (m) Audited financial reports. The contract must require MCOs, [Managed Care Organization] PIHPs [Prepaid inpatient health plan], and PAHPs [Prepaid ambulatory health plan] to submit audited financial reports specific to the Medicaid contract on an annual basis. The audit must be conducted in accordance with generally accepted accounting principles and generally accepted auditing standards. The Ohio Department of Medicaid (the Department) is the lead agency responsible for administering the Medicaid Cluster and CHIP federal grant programs for the State of Ohio. It is the Department’s responsibility to design and implement a system of internal control that is adequate to provide reasonable assurance over the accuracy of payments made to program recipients or providers and compliance with the rules and regulations associated with the Medicaid Cluster and CHIP. The Department is responsible for overall program compliance and must have appropriate oversight and monitoring procedures in place to ensure those they rely on are operating in accordance with all expectations, guidelines, and requirements related to their tasks. Additionally, when the system is not directly administered by the Department, such as when utilizing a service organization, it is critical the appropriate monitoring controls are designed and implemented to reasonably ensure the service organization has adequate controls to achieve management’s goals and objectives and complies with applicable laws and regulations. The American Institute of Certified Public Accountants’ Attestation Standard (AT-C 320), Reporting on an Examination of Controls at a Service Organization Relevant to User Entities’ Internal Control Over Financial Reporting, prescribes standards for reporting on service organizations, commonly referred to as SOC reports. It is management’s responsibility to obtain these SOC reports to monitor service organizations and to identify and manage risks. During state fiscal year (SFY) 2023, the Department disbursed approximately $28.4 billion and $622.1 million in Medicaid Cluster and CHIP benefits respectively to providers for the managed care program and the fee for service medical claims. During SFY 2023, the Department administered two IT systems to adjudicate provider claims and determine if services were provided to eligible recipients by an eligible provider and allowable prior to payment. The Medicaid Information Technology System (MITS) processed approximately $15.4 billion of the Department’s Medicaid Cluster and CHIP managed care capitation payments and fee for service provider claim payments for a majority of the year. In February 2023, the Department began a phased implementation of the Fiscal Intermediary (FI), a part of the new Ohio Medicaid Enterprise System (OMES), which processed approximately $13.7 billion of the Department’s Medicaid Cluster and CHIP managed care capitation payments and fee for service provider claim payments for the last five months of the fiscal year. The new OMES system processed approximately 47% of the Department’s Medicaid and CHIP provider payments for SFY 2023. OMES is a web-based system, consisting of several modules, and the Department contracted with a service organization to build, maintain, and operate this new system. The FI module supports the processing of Medicaid claims, prior authorization, payment of claims, and management of the encounter data resulting from the managed care services. The Department did not have adequate monitoring procedures in place over claims processing activities performed by the service organization, as follows: • Provider Payments – Weekly, the FI module creates a voucher interface file that is directly uploaded into the Ohio Administrative Knowledge System (OAKS) and once approved by the Department, the payment is released to the service organization which is responsible for disbursing the Medicaid claim payments to the providers. Once the service organization processes these provider payments, the total amount disbursed by the service organization is sent to the Department via email. However, the Department did not have an adequate monitoring process in place during the audit period to ensure the individual payments made to providers by the service organization were accurate, complete, and processed in a timely manner. • Suspended Claims – Claim information entered in the FI module must pass several edit checks in order to be accepted for adjudication. During the edit check process, if the claim results in an error code designated to suspend, the claim is diverted into a suspense queue for review by the service organization. The result of this review may be denial, correction, or manual override. However, the Department did not have a monitoring process in place to ensure the accuracy of suspended claims processed by the service organization. • Adjusted Claims – The Department utilized a vendor to identify over-utilization of Inpatient and Outpatient Hospital Medicaid services, which entails a review of medical records to determine if the claim was appropriate (i.e., billing errors, lack of pre-admission review, lack of medical necessity, etc.). After review by the Department, if the claim is determined to be improper, the claim will be reversed or adjusted. The Department sends the adjustment report to the service organization to process the adjustment in the FI module. However, the Department did not have a monitoring procedure in place to ensure the accuracy of the adjustments processed by the service organization. Furthermore, the Department’s contract with the service organization requires that the service organization receive a SOC-1 Type 1 audit within five months of the implementation of the OMES system, or July 1, 2023, to assess the overall financial controls put in place by design. However, the Department has not obtained and reviewed such a report. Additionally, we noted the following noncompliance with federal regulations in which the required reports were not obtained by the Department from the service organization: • In October 2022, the Department implemented a Single Pharmacy Benefit Manager (SPBM), which provided pharmacy services across all Ohio Medicaid managed care plans and members. The Department has a contract with the service organization identified above to provide this benefit. The SPBM is a PAHP and is implemented through a non-risk contract; however, the vendor did not submit audited financial statements to the Department for review in accordance with the contract and 42 C.F.R. § 438.3(m). Without adequate monitoring controls, the Department cannot be reasonably assured the service organization is complying with the applicable contract requirements, as well as meeting management’s goals and objectives. Additionally, by not establishing adequate monitoring controls over the service organization’s payments to Medicaid providers or the suspended and adjusted provider claims, there is an increased risk that provider payments will be noncompliant with federal program requirements, inaccurate, incomplete, or not made at all. Based on discussions with Department management, they are in the middle of the implementation phase of OMES next generation and are continuing to develop new monitoring processes for OMES that will replace monitoring previously completed for MITS. Part of this process will include a regular review and assessment of the financial cycle banking report. Management also indicated the Department performs retrospective reviews of claims and provider payments based on program claims and spending trends where outliers require further investigation. Additionally, the Department is working to develop a compliance checklist related to 42 C.F.R. § 438 and other submission requirements to ensure required submissions are provided by the vendor timely. We recommend the Department develop and implement internal controls to strengthen the monitoring over the service organization’s activities to reasonably ensure suspended and adjusted claims and the Medicaid provider payments are processed accurately, timely, and paid to the correct providers. These procedures should be adequately documented to provide the Department with reasonable assurance they have been performed and are operating as management intended. We also recommend the Department continue to work with the service organization to obtain the required annual reports, including an audited financial report and a SOC-1 Type 2 audit to ensure control procedures are in place and operating effectively and that any Medicaid Cluster and CHIP specific requirements are operating as management intended. At a minimum, the SOC-1 Type 2 report should cover six-months of the Department’s audit period. The Department should implement the appropriate and timely review of the SOC-1 Type 2 report to identify any weaknesses, issues, or required complimentary user entity controls, and implement sufficient controls to address these items. The Department should also document and maintain its review of the SOC-1 Type 2 report, decisions made, and any actions taken to ensure management’s objectives are being met. See Finding 2023-001 – MEDICAID CLUSTER – SERVICE ORGANIZATION MONITORING in Section 2 above on page 31. Government Auditing Standards also requires us to report the material weakness portion of this finding in Section 2 of this Schedule.

MEDICAID/CHIP – SERVICE ORGANIZATION MONITORING Finding Number: 2023-013 State Agency Number: MCD-03 Assistance Listing Numbers and Titles: 93.767 – Children’s Health Insurance Program (CHIP) 93.767 COVID 19 – CHIP 93.775/93.777/93.778 – Medicaid Cluster 93.775/93.777/93.778 COVID 19 – Medicaid Cluster Federal Award Identification Number / Year: 2205OH5022 / 2022 (CHIP) 2305OH5023 / 2023 (CHIP) 2205OH5MAP / 2022 (Medicaid Cluster) 2305OH5MAP / 2023 (Medicaid Cluster) Federal Agency: Department of Health and Human Services Compliance Requirements: Activities Allowed or Unallowed, Allowable Costs/Cost Principles, Special Tests and Provisions Repeat Finding from Prior Audit? No NONCOMPLIANCE AND MATERIAL WEAKNESS NOTE: Finding number 2023-001 details weaknesses in internal control related to the Medicaid Cluster regarding the Department’s monitoring of a service organization. This finding is integral to and should be read in conjunction with this finding. 42 C.F.R. § 438.3(m) states the following regarding contract requirements for Managed Care: (m) Audited financial reports. The contract must require MCOs, [Managed Care Organization] PIHPs [Prepaid inpatient health plan], and PAHPs [Prepaid ambulatory health plan] to submit audited financial reports specific to the Medicaid contract on an annual basis. The audit must be conducted in accordance with generally accepted accounting principles and generally accepted auditing standards. The Ohio Department of Medicaid (the Department) is the lead agency responsible for administering the Medicaid Cluster and CHIP federal grant programs for the State of Ohio. It is the Department’s responsibility to design and implement a system of internal control that is adequate to provide reasonable assurance over the accuracy of payments made to program recipients or providers and compliance with the rules and regulations associated with the Medicaid Cluster and CHIP. The Department is responsible for overall program compliance and must have appropriate oversight and monitoring procedures in place to ensure those they rely on are operating in accordance with all expectations, guidelines, and requirements related to their tasks. Additionally, when the system is not directly administered by the Department, such as when utilizing a service organization, it is critical the appropriate monitoring controls are designed and implemented to reasonably ensure the service organization has adequate controls to achieve management’s goals and objectives and complies with applicable laws and regulations. The American Institute of Certified Public Accountants’ Attestation Standard (AT-C 320), Reporting on an Examination of Controls at a Service Organization Relevant to User Entities’ Internal Control Over Financial Reporting, prescribes standards for reporting on service organizations, commonly referred to as SOC reports. It is management’s responsibility to obtain these SOC reports to monitor service organizations and to identify and manage risks. During state fiscal year (SFY) 2023, the Department disbursed approximately $28.4 billion and $622.1 million in Medicaid Cluster and CHIP benefits respectively to providers for the managed care program and the fee for service medical claims. During SFY 2023, the Department administered two IT systems to adjudicate provider claims and determine if services were provided to eligible recipients by an eligible provider and allowable prior to payment. The Medicaid Information Technology System (MITS) processed approximately $15.4 billion of the Department’s Medicaid Cluster and CHIP managed care capitation payments and fee for service provider claim payments for a majority of the year. In February 2023, the Department began a phased implementation of the Fiscal Intermediary (FI), a part of the new Ohio Medicaid Enterprise System (OMES), which processed approximately $13.7 billion of the Department’s Medicaid Cluster and CHIP managed care capitation payments and fee for service provider claim payments for the last five months of the fiscal year. The new OMES system processed approximately 47% of the Department’s Medicaid and CHIP provider payments for SFY 2023. OMES is a web-based system, consisting of several modules, and the Department contracted with a service organization to build, maintain, and operate this new system. The FI module supports the processing of Medicaid claims, prior authorization, payment of claims, and management of the encounter data resulting from the managed care services. The Department did not have adequate monitoring procedures in place over claims processing activities performed by the service organization, as follows: • Provider Payments – Weekly, the FI module creates a voucher interface file that is directly uploaded into the Ohio Administrative Knowledge System (OAKS) and once approved by the Department, the payment is released to the service organization which is responsible for disbursing the Medicaid claim payments to the providers. Once the service organization processes these provider payments, the total amount disbursed by the service organization is sent to the Department via email. However, the Department did not have an adequate monitoring process in place during the audit period to ensure the individual payments made to providers by the service organization were accurate, complete, and processed in a timely manner. • Suspended Claims – Claim information entered in the FI module must pass several edit checks in order to be accepted for adjudication. During the edit check process, if the claim results in an error code designated to suspend, the claim is diverted into a suspense queue for review by the service organization. The result of this review may be denial, correction, or manual override. However, the Department did not have a monitoring process in place to ensure the accuracy of suspended claims processed by the service organization. • Adjusted Claims – The Department utilized a vendor to identify over-utilization of Inpatient and Outpatient Hospital Medicaid services, which entails a review of medical records to determine if the claim was appropriate (i.e., billing errors, lack of pre-admission review, lack of medical necessity, etc.). After review by the Department, if the claim is determined to be improper, the claim will be reversed or adjusted. The Department sends the adjustment report to the service organization to process the adjustment in the FI module. However, the Department did not have a monitoring procedure in place to ensure the accuracy of the adjustments processed by the service organization. Furthermore, the Department’s contract with the service organization requires that the service organization receive a SOC-1 Type 1 audit within five months of the implementation of the OMES system, or July 1, 2023, to assess the overall financial controls put in place by design. However, the Department has not obtained and reviewed such a report. Additionally, we noted the following noncompliance with federal regulations in which the required reports were not obtained by the Department from the service organization: • In October 2022, the Department implemented a Single Pharmacy Benefit Manager (SPBM), which provided pharmacy services across all Ohio Medicaid managed care plans and members. The Department has a contract with the service organization identified above to provide this benefit. The SPBM is a PAHP and is implemented through a non-risk contract; however, the vendor did not submit audited financial statements to the Department for review in accordance with the contract and 42 C.F.R. § 438.3(m). Without adequate monitoring controls, the Department cannot be reasonably assured the service organization is complying with the applicable contract requirements, as well as meeting management’s goals and objectives. Additionally, by not establishing adequate monitoring controls over the service organization’s payments to Medicaid providers or the suspended and adjusted provider claims, there is an increased risk that provider payments will be noncompliant with federal program requirements, inaccurate, incomplete, or not made at all. Based on discussions with Department management, they are in the middle of the implementation phase of OMES next generation and are continuing to develop new monitoring processes for OMES that will replace monitoring previously completed for MITS. Part of this process will include a regular review and assessment of the financial cycle banking report. Management also indicated the Department performs retrospective reviews of claims and provider payments based on program claims and spending trends where outliers require further investigation. Additionally, the Department is working to develop a compliance checklist related to 42 C.F.R. § 438 and other submission requirements to ensure required submissions are provided by the vendor timely. We recommend the Department develop and implement internal controls to strengthen the monitoring over the service organization’s activities to reasonably ensure suspended and adjusted claims and the Medicaid provider payments are processed accurately, timely, and paid to the correct providers. These procedures should be adequately documented to provide the Department with reasonable assurance they have been performed and are operating as management intended. We also recommend the Department continue to work with the service organization to obtain the required annual reports, including an audited financial report and a SOC-1 Type 2 audit to ensure control procedures are in place and operating effectively and that any Medicaid Cluster and CHIP specific requirements are operating as management intended. At a minimum, the SOC-1 Type 2 report should cover six-months of the Department’s audit period. The Department should implement the appropriate and timely review of the SOC-1 Type 2 report to identify any weaknesses, issues, or required complimentary user entity controls, and implement sufficient controls to address these items. The Department should also document and maintain its review of the SOC-1 Type 2 report, decisions made, and any actions taken to ensure management’s objectives are being met. See Finding 2023-001 – MEDICAID CLUSTER – SERVICE ORGANIZATION MONITORING in Section 2 above on page 31. Government Auditing Standards also requires us to report the material weakness portion of this finding in Section 2 of this Schedule.

MEDICAID/CHIP – IEVS ALERTS Finding Number: 2023-014 State Agency Number: MCD-04 Assistance Listing Numbers and Titles: 93.767 – Children’s Health Insurance Program (CHIP) 93.767 COVID-19 – CHIP 93.775/93.777/93.778 – Medicaid Cluster 93.775/93.777/93.778 COVID-19 – Medicaid Cluster Federal Award Identification Number / Year: 2205OH5022 / 2022 (CHIP) 2305OH5023 / 2023 (CHIP) 2205OH5MAP / 2022 (Medicaid Cluster) 2305OH5MAP / 2023 (Medicaid Cluster) Federal Agency: Department of Health and Human Services Compliance Requirement: Eligibility Repeat Finding from Prior Audit? Yes Prior Audit Finding Number: 2022-019 NONCOMPLIANCE AND MATERIAL WEAKNESS 42 C.F.R. § 435.945 states, in part, the following regarding the Medicaid Cluster program: (a) Except where the law requires other procedures . . . the agency may accept attestation of information needed to determine the eligibility of an individual for Medicaid . . . without requiring further information (including documentation) from the individual. (b) The agency must request and use information relevant to verifying an individual's eligibility for Medicaid in accordance with § 435.948 through § 435.956 . . . 42 C.F.R. § 457.380, states, in part, the following regarding the Children’s Health Insurance Program (CHIP): (a) General requirements. Except where law requires other procedures . . . the State may accept attestation of information needed to determine the eligibility of an individual for CHIP. . . without requiring further information (including documentation) from the individual. (b) Status as a citizen, national or a non-citizen. (1) Except for newborns identified in § 435.406(a)(1)(iii)(E) of this chapter, who are exempt from any requirement to verify citizenship, the agency must— . . . (ii) Provide a reasonable opportunity period to verify such status in accordance with § 435.956(a)(5) and (b) of this chapter and provide benefits during such reasonable opportunity period to individuals determined to be otherwise eligible for CHIP. Furthermore, 42 U.S.C. § 1320b–7(a) Requirements of State eligibility systems states, in part: In order to meet the requirements of this section, a State must have in effect an income and eligibility verification system which meets the requirements of subsection (d) and under which— (1) the State shall require, as a condition of eligibility for benefits under any program listed in subsection (b), that each applicant for or recipient of benefits under that program furnish to the State his social security account number (or numbers, if he has more than one such number), and the State shall utilize such account numbers in the administration of that program so as to enable the association of the records pertaining to the applicant or recipient with his account number; (2) wage information from agencies administering State unemployment compensation laws available pursuant to section 3304(a)(16) of the Internal Revenue Code of 1986, wage information reported pursuant to paragraph (3) of this subsection, and wage, income, and other information from the Social Security Administration and the Internal Revenue Service available pursuant to section 6103(l)(7) of such Code, shall be requested and utilized to the extent that such information may be useful in verifying eligibility for, and the amount of, benefits available under any program listed in subsection (b), as determined by the Secretary of Health and Human Services . . . . (4) the State agencies administering the programs . . . adhere to standardized formats and procedures . . . under which — (A) the agencies will exchange with each other information in their possession which may be of use in establishing or verifying eligibility or benefit amounts under any other such program . . . (C) the use of such information shall be targeted to those uses which are most likely to be productive in identifying and preventing ineligibility and incorrect payments. . . . In order to comply with 42 C.F.R. § 435.945 and 42 U.S.C. § 1320b-7, the State of Ohio codified specific rules related to its Income Eligibility Verification System (IEVS) in the Ohio Administrative Code. Ohio Admin. Code 5160:1-1-04 states, in part: (A) This rule describes the requirements in section 1137 of the Social Security Act and in section 42 C.F.R. 435.945. . ., requiring state agencies administering certain federally funded, state administered public assistance programs, to establish procedures for obtaining, using and verifying information relevant to determinations of eligibility. The Ohio department of medicaid shall obtain and share income and benefit information with the following sources: (1) The social security administration (SSA). (2) The internal revenue service (IRS). (3) The state wage information collection agency (SWICA). (4) The agencies administering the State unemployment compensation (UC) laws. . . . (C) Administrative agency responsibilities. Within forty-five days of receipt of the information, the administrative agency shall initiate, pursue, and complete the actions specified. . .: (3) Review and compare against the case record all information received from the IEVS data matches to determine whether the information affects the individual's eligibility, in accordance with 42 C.F.R. 435.948. (4) Obtain additional information or documentation from the individual, if needed, to determine eligibility and initiate appropriate action in accordance with 42 C.F.R. 435.952(c). (5) . . . The administrative agency shall verify information. . . . (6) Update case information and redetermine eligibility when the verification received is discrepant from information currently listed in the electronic eligibility system. As the lead agency responsible for administering the Medicaid Cluster and CHIP federal programs for the State of Ohio, the Department is responsible for providing reasonable assurance only eligible individuals receive assistance and documentation maintained is accurate, complete, and properly recorded in the Ohio Benefits system to ensure appropriate eligibility determinations. It is the Department’s responsibility to implement sufficient controls, systems, processes, and procedures to reasonably ensure compliance with the rules and regulations associated with these programs and only eligible recipients receive benefits. When automated systems are utilized to perform certain functions related to this compliance, management must ensure the system is properly designed and operating effectively. The Department is also responsible for overall program compliance and must have appropriate oversight and monitoring procedures in place to ensure those they rely on are operating in accordance with all expectations, guidelines, and requirements related to their tasks. The Medicaid Cluster and CHIP federal programs are administered using a multi-agency approach: overall compliance and administration of the programs fall under the Department, and programming and administration of the State’s eligibility determination computer system, Ohio Benefits, falls under the Ohio Department of Administrative Services (DAS). The Department also, through a Memorandum of Understanding with the Ohio Department of Job & Family Services (JFS), utilizes the 88 Ohio counties in the eligibility determination process to work with applicants, receive/enter eligibility documentation into the Ohio Benefits system, and follow up on alerts issued by the system. The Ohio Benefits system was utilized for processing eligibility for the Medicaid Cluster and CHIP programs’ recipients with total expenditures of approximately $28.4 billion and $622.1 million, respectively during state fiscal year (SFY) 2023. The Ohio Benefits system contains the eligibility and benefit information/determinations for these programs, including the Income Eligibility Verification System (IEVS) functionality which compares reported recipient income to income information maintained by outside data sources (Social Security Administration, Internal Revenue Service (IRS), etc.). Information that does not agree is communicated in the form of an Ohio Benefits system alert. The Ohio Benefits system then determines if the alert is a ‘match’ that requires action. The IEVS match, indicated by ‘Yes’ in the Ohio Benefits system, is forwarded to the appropriate county agency for investigation and resolution. Each match has a defined due date, which is unique based on the priority level and other policy and process related factors. However, we noted the following weaknesses: • Volume of Alerts – During SFY 2023, more than 16.4 million alerts were issued (4.3 million IEVS alerts and 12.1 million non-IEVS alerts) for all public assistance programs that utilize Ohio Benefits, including the Medicaid Cluster and CHIP programs. Alerts can be generated by Ohio Benefits via interface outputs/updates, batch outputs or other triggers within the system. Ongoing enhancements to the Ohio Benefits alerts process were made in coordination with personnel from the Department, the JFS, and DAS throughout the audit period to address design weaknesses and streamline and reduce the volume of IRS matches received and delivered to county agencies. However, system enhancements were not fully implemented until later in audit period which resulted in an increased workload for the county agencies and ineffective application of the alert/match process. • Caseworker Reliance/Training – The current process relies heavily on the knowledge and judgement of county caseworkers in the eligibility process, including reviewing IEVS matches. The Department relies heavily on JFS to coordinate with and provide statewide and individual trainings for county agencies to assist them in working IEVS alerts/matches; however, these trainings are typically optional and/or attended by a representative of the county agency who is expected to relay the information to others. Additionally, we noted the following noncompliance with federal regulations where IEVS alerts were not cleared timely. • Clearing Alerts – While the Department has controls and procedures in place to review and monitor IEVS alerts and matches generated and process by the Ohio Benefits system, there were instances when matches were not being completed by the county agencies in accordance with the required timeframes. Furthermore, an Ohio Benefits data file containing IEVS matches showed 1,391,949 of the 2,460,927 (56.6%) IEVS alerts sent to the county agencies during the audit period were not cleared within 45 days as required. The matches were cleared between one and 441 days beyond the 45-day requirement, for an average of 221 days late. Failure to implement system enhancements timely, perform monitoring activities, mandate training for county caseworkers, and complete IEVS alerts within the established timeframe increases the risk benefits given to ineligible recipients or for inappropriate amounts will not be identified timely. This condition could adversely affect the Department’s ability to comply with IEVS requirements for these federal programs which could result in federal sanctions or penalties. Based on discussions with management, the high volume of alert generation likely caused the timeliness issues. Management indicated they continue to work with JFS and DAS to enhance the statewide eligibility system to reduce the high volume of alerts. We recommend the Department continue to work collectively with the related state agencies to implement/update robust processes, procedures, and system controls to address the weaknesses associated with the IEVS process within the Ohio Benefits system. These changes/updates should include, but not be limited to: • Including a more centralized evaluation of alert/match activity and/or better use of automated tools to vet and prioritize items requiring follow-up at the county level. This would allow Department level personnel to become more experienced and adept at identifying and investigating anomalies and help focus the resources of both Department and county personnel. • Requiring mandatory IEVS training for all county agency employees who are entering the assistance group information into Ohio Benefits to help ensure proper and complete information is being collected, entered, and verified prior to an individual’s eligibility determination being made. The Department should continue to provide this training initially to ensure all users are knowledgeable of the process, procedures, and impacts of the work they do. As changes occur to the rules/regulations, system, or process, detailed training should be required of all users on those changes. • Continuing to monitor the IEVS alert processing procedures guide for the matches issued by the Ohio Benefits system to ensure matches are properly documented within the system, worked within the proper timeframes, and proper verification documentation is obtained and maintained by the county agencies for resolved matches. • Continuing to identify and coordinate Ohio Benefits program changes to address the system design weaknesses as discovered. This should include working collaboratively with DAS to prioritize program changes which could directly impact the eligibility determinations or benefit amounts to ensure they are corrected in a timely manner to prevent and detect further improper payments. In addition, the Department should continue to evaluate these enhancements to assist DAS in determining if the desired outcome was achieved. We also recommend the Department continue to monitor the status of system enhancements and roll-out of resources to the appropriate personnel to ensure they are implemented timely and as planned.

MEDICAID/CHIP – IEVS ALERTS Finding Number: 2023-014 State Agency Number: MCD-04 Assistance Listing Numbers and Titles: 93.767 – Children’s Health Insurance Program (CHIP) 93.767 COVID-19 – CHIP 93.775/93.777/93.778 – Medicaid Cluster 93.775/93.777/93.778 COVID-19 – Medicaid Cluster Federal Award Identification Number / Year: 2205OH5022 / 2022 (CHIP) 2305OH5023 / 2023 (CHIP) 2205OH5MAP / 2022 (Medicaid Cluster) 2305OH5MAP / 2023 (Medicaid Cluster) Federal Agency: Department of Health and Human Services Compliance Requirement: Eligibility Repeat Finding from Prior Audit? Yes Prior Audit Finding Number: 2022-019 NONCOMPLIANCE AND MATERIAL WEAKNESS 42 C.F.R. § 435.945 states, in part, the following regarding the Medicaid Cluster program: (a) Except where the law requires other procedures . . . the agency may accept attestation of information needed to determine the eligibility of an individual for Medicaid . . . without requiring further information (including documentation) from the individual. (b) The agency must request and use information relevant to verifying an individual's eligibility for Medicaid in accordance with § 435.948 through § 435.956 . . . 42 C.F.R. § 457.380, states, in part, the following regarding the Children’s Health Insurance Program (CHIP): (a) General requirements. Except where law requires other procedures . . . the State may accept attestation of information needed to determine the eligibility of an individual for CHIP. . . without requiring further information (including documentation) from the individual. (b) Status as a citizen, national or a non-citizen. (1) Except for newborns identified in § 435.406(a)(1)(iii)(E) of this chapter, who are exempt from any requirement to verify citizenship, the agency must— . . . (ii) Provide a reasonable opportunity period to verify such status in accordance with § 435.956(a)(5) and (b) of this chapter and provide benefits during such reasonable opportunity period to individuals determined to be otherwise eligible for CHIP. Furthermore, 42 U.S.C. § 1320b–7(a) Requirements of State eligibility systems states, in part: In order to meet the requirements of this section, a State must have in effect an income and eligibility verification system which meets the requirements of subsection (d) and under which— (1) the State shall require, as a condition of eligibility for benefits under any program listed in subsection (b), that each applicant for or recipient of benefits under that program furnish to the State his social security account number (or numbers, if he has more than one such number), and the State shall utilize such account numbers in the administration of that program so as to enable the association of the records pertaining to the applicant or recipient with his account number; (2) wage information from agencies administering State unemployment compensation laws available pursuant to section 3304(a)(16) of the Internal Revenue Code of 1986, wage information reported pursuant to paragraph (3) of this subsection, and wage, income, and other information from the Social Security Administration and the Internal Revenue Service available pursuant to section 6103(l)(7) of such Code, shall be requested and utilized to the extent that such information may be useful in verifying eligibility for, and the amount of, benefits available under any program listed in subsection (b), as determined by the Secretary of Health and Human Services . . . . (4) the State agencies administering the programs . . . adhere to standardized formats and procedures . . . under which — (A) the agencies will exchange with each other information in their possession which may be of use in establishing or verifying eligibility or benefit amounts under any other such program . . . (C) the use of such information shall be targeted to those uses which are most likely to be productive in identifying and preventing ineligibility and incorrect payments. . . . In order to comply with 42 C.F.R. § 435.945 and 42 U.S.C. § 1320b-7, the State of Ohio codified specific rules related to its Income Eligibility Verification System (IEVS) in the Ohio Administrative Code. Ohio Admin. Code 5160:1-1-04 states, in part: (A) This rule describes the requirements in section 1137 of the Social Security Act and in section 42 C.F.R. 435.945. . ., requiring state agencies administering certain federally funded, state administered public assistance programs, to establish procedures for obtaining, using and verifying information relevant to determinations of eligibility. The Ohio department of medicaid shall obtain and share income and benefit information with the following sources: (1) The social security administration (SSA). (2) The internal revenue service (IRS). (3) The state wage information collection agency (SWICA). (4) The agencies administering the State unemployment compensation (UC) laws. . . . (C) Administrative agency responsibilities. Within forty-five days of receipt of the information, the administrative agency shall initiate, pursue, and complete the actions specified. . .: (3) Review and compare against the case record all information received from the IEVS data matches to determine whether the information affects the individual's eligibility, in accordance with 42 C.F.R. 435.948. (4) Obtain additional information or documentation from the individual, if needed, to determine eligibility and initiate appropriate action in accordance with 42 C.F.R. 435.952(c). (5) . . . The administrative agency shall verify information. . . . (6) Update case information and redetermine eligibility when the verification received is discrepant from information currently listed in the electronic eligibility system. As the lead agency responsible for administering the Medicaid Cluster and CHIP federal programs for the State of Ohio, the Department is responsible for providing reasonable assurance only eligible individuals receive assistance and documentation maintained is accurate, complete, and properly recorded in the Ohio Benefits system to ensure appropriate eligibility determinations. It is the Department’s responsibility to implement sufficient controls, systems, processes, and procedures to reasonably ensure compliance with the rules and regulations associated with these programs and only eligible recipients receive benefits. When automated systems are utilized to perform certain functions related to this compliance, management must ensure the system is properly designed and operating effectively. The Department is also responsible for overall program compliance and must have appropriate oversight and monitoring procedures in place to ensure those they rely on are operating in accordance with all expectations, guidelines, and requirements related to their tasks. The Medicaid Cluster and CHIP federal programs are administered using a multi-agency approach: overall compliance and administration of the programs fall under the Department, and programming and administration of the State’s eligibility determination computer system, Ohio Benefits, falls under the Ohio Department of Administrative Services (DAS). The Department also, through a Memorandum of Understanding with the Ohio Department of Job & Family Services (JFS), utilizes the 88 Ohio counties in the eligibility determination process to work with applicants, receive/enter eligibility documentation into the Ohio Benefits system, and follow up on alerts issued by the system. The Ohio Benefits system was utilized for processing eligibility for the Medicaid Cluster and CHIP programs’ recipients with total expenditures of approximately $28.4 billion and $622.1 million, respectively during state fiscal year (SFY) 2023. The Ohio Benefits system contains the eligibility and benefit information/determinations for these programs, including the Income Eligibility Verification System (IEVS) functionality which compares reported recipient income to income information maintained by outside data sources (Social Security Administration, Internal Revenue Service (IRS), etc.). Information that does not agree is communicated in the form of an Ohio Benefits system alert. The Ohio Benefits system then determines if the alert is a ‘match’ that requires action. The IEVS match, indicated by ‘Yes’ in the Ohio Benefits system, is forwarded to the appropriate county agency for investigation and resolution. Each match has a defined due date, which is unique based on the priority level and other policy and process related factors. However, we noted the following weaknesses: • Volume of Alerts – During SFY 2023, more than 16.4 million alerts were issued (4.3 million IEVS alerts and 12.1 million non-IEVS alerts) for all public assistance programs that utilize Ohio Benefits, including the Medicaid Cluster and CHIP programs. Alerts can be generated by Ohio Benefits via interface outputs/updates, batch outputs or other triggers within the system. Ongoing enhancements to the Ohio Benefits alerts process were made in coordination with personnel from the Department, the JFS, and DAS throughout the audit period to address design weaknesses and streamline and reduce the volume of IRS matches received and delivered to county agencies. However, system enhancements were not fully implemented until later in audit period which resulted in an increased workload for the county agencies and ineffective application of the alert/match process. • Caseworker Reliance/Training – The current process relies heavily on the knowledge and judgement of county caseworkers in the eligibility process, including reviewing IEVS matches. The Department relies heavily on JFS to coordinate with and provide statewide and individual trainings for county agencies to assist them in working IEVS alerts/matches; however, these trainings are typically optional and/or attended by a representative of the county agency who is expected to relay the information to others. Additionally, we noted the following noncompliance with federal regulations where IEVS alerts were not cleared timely. • Clearing Alerts – While the Department has controls and procedures in place to review and monitor IEVS alerts and matches generated and process by the Ohio Benefits system, there were instances when matches were not being completed by the county agencies in accordance with the required timeframes. Furthermore, an Ohio Benefits data file containing IEVS matches showed 1,391,949 of the 2,460,927 (56.6%) IEVS alerts sent to the county agencies during the audit period were not cleared within 45 days as required. The matches were cleared between one and 441 days beyond the 45-day requirement, for an average of 221 days late. Failure to implement system enhancements timely, perform monitoring activities, mandate training for county caseworkers, and complete IEVS alerts within the established timeframe increases the risk benefits given to ineligible recipients or for inappropriate amounts will not be identified timely. This condition could adversely affect the Department’s ability to comply with IEVS requirements for these federal programs which could result in federal sanctions or penalties. Based on discussions with management, the high volume of alert generation likely caused the timeliness issues. Management indicated they continue to work with JFS and DAS to enhance the statewide eligibility system to reduce the high volume of alerts. We recommend the Department continue to work collectively with the related state agencies to implement/update robust processes, procedures, and system controls to address the weaknesses associated with the IEVS process within the Ohio Benefits system. These changes/updates should include, but not be limited to: • Including a more centralized evaluation of alert/match activity and/or better use of automated tools to vet and prioritize items requiring follow-up at the county level. This would allow Department level personnel to become more experienced and adept at identifying and investigating anomalies and help focus the resources of both Department and county personnel. • Requiring mandatory IEVS training for all county agency employees who are entering the assistance group information into Ohio Benefits to help ensure proper and complete information is being collected, entered, and verified prior to an individual’s eligibility determination being made. The Department should continue to provide this training initially to ensure all users are knowledgeable of the process, procedures, and impacts of the work they do. As changes occur to the rules/regulations, system, or process, detailed training should be required of all users on those changes. • Continuing to monitor the IEVS alert processing procedures guide for the matches issued by the Ohio Benefits system to ensure matches are properly documented within the system, worked within the proper timeframes, and proper verification documentation is obtained and maintained by the county agencies for resolved matches. • Continuing to identify and coordinate Ohio Benefits program changes to address the system design weaknesses as discovered. This should include working collaboratively with DAS to prioritize program changes which could directly impact the eligibility determinations or benefit amounts to ensure they are corrected in a timely manner to prevent and detect further improper payments. In addition, the Department should continue to evaluate these enhancements to assist DAS in determining if the desired outcome was achieved. We also recommend the Department continue to monitor the status of system enhancements and roll-out of resources to the appropriate personnel to ensure they are implemented timely and as planned.

IT – MEDICAID/CHIP – PROVIDER REVALIDATIONS Finding Number: 2023-015 State Agency Number: MCD-05 Assistance Listing Numbers and Titles: 93.767 – Children’s Health Insurance Program (CHIP) 93.767 COVID-19 – CHIP 93.775/93.777/93.778 – Medicaid Cluster 93.775/93.777/93.778 COVID-19 – Medicaid Cluster Federal Award Identification Number / Year: 2205OH5022 / 2022 (CHIP) 2305OH5023 / 2023 (CHIP) 2205OH5MAP / 2022 (Medicaid Cluster) 2305OH5MAP / 2023 (Medicaid Cluster) Federal Agency: Department of Health and Human Services Compliance Requirement: Special Tests and Provisions – Provider Eligibility Repeat Finding from Prior Audit? No NONCOMPLIANCE AND MATERIAL WEAKNESS 42 C.F.R. § 455.414, Revalidation of enrollment, states: The State Medicaid agency must revalidate the enrollment of all providers regardless of provider type at least every 5 years. It is management’s responsibility to develop and implement internal control procedures to validate provider licenses timely to ensure their eligibility to continue participation in the Medicaid Cluster and CHIP programs. During state fiscal year 2023, the Department disbursed approximately $28.4 billion for the Medicaid Cluster and $622.1 million for Children’s Health Insurance Program (CHIP). The Department administers the Medicaid Information Technology System (MITS) and the Ohio Medicaid Enterprise System (OMES), which are automated applications, to determine if the services provided to eligible recipients were by an eligible provider and allowable prior to payment. The Department’s provider revalidation process requires all providers (except Managed Care) are subject to a 5-year or 3-year time limited agreement if they are required to be recredentialed. With the implementation of the OMES Provider Network Management (PNM) module and centralized credentialing, a provider’s revalidation is initiated by the Department 120 days prior to the Medicaid Agreement end date. A 120-day Revalidation Notice is sent to the provider which contains the Registration ID and instructions on how to enter the PNM portal in order to revalidate their provider agreement. Providers are also issued a 90-day, 60-day, and 30-day notice if the revalidation has not been initiated at any of these points in time. However, the following exceptions were noted during testing of the Department’s provider revalidation process: • A separate list of providers that went through the revalidation process while MITS was still in place from 7/1/2022 – 9/30/2022 was not provided by the Department; therefore, the revalidation process could not be tested for this period. • For 12 of 40 (30%) providers selected for testing, the Re-Enrollment Due Date did not agree with the Revalidation Date documented in the PNM module. • For three of 40 (7.5%) providers selected for testing, the Department did not provide the provider application. • For two of 40 (5%) providers selected for testing, the Enrollment Status could not be verified because the Department did not provide documentation of the revalidation process. • For two of 40 (5%) providers selected for testing, the Department did not provide the following: o PNM Workflow documentation to support the revalidation process was completed; and o Revalidation (or Termination Letters on file within the PNM module. If a provider is not revalidated timely or the revalidation process is not properly followed, the Department increases the risk of disbursing unallowable payments to ineligible Medicaid Cluster and CHIP providers. Failure to comply with federal laws and regulations could result in a reduction of future federal funding or sanctions imposed by the federal grantor agency. Based on discussions with management, there was an issue with some of the revalidation letters in which the effective period stated did not match the next re-enrollment period. The Department followed up with the OMES vendor and confirmed there was a system defect that contributed to the issues noted. We recommend the Department follow its documented provider revalidation processes and procedures to help ensure the enrollment of all providers are properly revalidated and in a timely manner. We also recommend the Department ensure communications regarding revalidations or terminations be sent to the providers upon completion of the process. Lastly, we recommend the Department work with its vendor to correct any system defects in the provider revalidation process to help ensure providers are properly revalidated.

IT – MEDICAID/CHIP – PROVIDER REVALIDATIONS Finding Number: 2023-015 State Agency Number: MCD-05 Assistance Listing Numbers and Titles: 93.767 – Children’s Health Insurance Program (CHIP) 93.767 COVID-19 – CHIP 93.775/93.777/93.778 – Medicaid Cluster 93.775/93.777/93.778 COVID-19 – Medicaid Cluster Federal Award Identification Number / Year: 2205OH5022 / 2022 (CHIP) 2305OH5023 / 2023 (CHIP) 2205OH5MAP / 2022 (Medicaid Cluster) 2305OH5MAP / 2023 (Medicaid Cluster) Federal Agency: Department of Health and Human Services Compliance Requirement: Special Tests and Provisions – Provider Eligibility Repeat Finding from Prior Audit? No NONCOMPLIANCE AND MATERIAL WEAKNESS 42 C.F.R. § 455.414, Revalidation of enrollment, states: The State Medicaid agency must revalidate the enrollment of all providers regardless of provider type at least every 5 years. It is management’s responsibility to develop and implement internal control procedures to validate provider licenses timely to ensure their eligibility to continue participation in the Medicaid Cluster and CHIP programs. During state fiscal year 2023, the Department disbursed approximately $28.4 billion for the Medicaid Cluster and $622.1 million for Children’s Health Insurance Program (CHIP). The Department administers the Medicaid Information Technology System (MITS) and the Ohio Medicaid Enterprise System (OMES), which are automated applications, to determine if the services provided to eligible recipients were by an eligible provider and allowable prior to payment. The Department’s provider revalidation process requires all providers (except Managed Care) are subject to a 5-year or 3-year time limited agreement if they are required to be recredentialed. With the implementation of the OMES Provider Network Management (PNM) module and centralized credentialing, a provider’s revalidation is initiated by the Department 120 days prior to the Medicaid Agreement end date. A 120-day Revalidation Notice is sent to the provider which contains the Registration ID and instructions on how to enter the PNM portal in order to revalidate their provider agreement. Providers are also issued a 90-day, 60-day, and 30-day notice if the revalidation has not been initiated at any of these points in time. However, the following exceptions were noted during testing of the Department’s provider revalidation process: • A separate list of providers that went through the revalidation process while MITS was still in place from 7/1/2022 – 9/30/2022 was not provided by the Department; therefore, the revalidation process could not be tested for this period. • For 12 of 40 (30%) providers selected for testing, the Re-Enrollment Due Date did not agree with the Revalidation Date documented in the PNM module. • For three of 40 (7.5%) providers selected for testing, the Department did not provide the provider application. • For two of 40 (5%) providers selected for testing, the Enrollment Status could not be verified because the Department did not provide documentation of the revalidation process. • For two of 40 (5%) providers selected for testing, the Department did not provide the following: o PNM Workflow documentation to support the revalidation process was completed; and o Revalidation (or Termination Letters on file within the PNM module. If a provider is not revalidated timely or the revalidation process is not properly followed, the Department increases the risk of disbursing unallowable payments to ineligible Medicaid Cluster and CHIP providers. Failure to comply with federal laws and regulations could result in a reduction of future federal funding or sanctions imposed by the federal grantor agency. Based on discussions with management, there was an issue with some of the revalidation letters in which the effective period stated did not match the next re-enrollment period. The Department followed up with the OMES vendor and confirmed there was a system defect that contributed to the issues noted. We recommend the Department follow its documented provider revalidation processes and procedures to help ensure the enrollment of all providers are properly revalidated and in a timely manner. We also recommend the Department ensure communications regarding revalidations or terminations be sent to the providers upon completion of the process. Lastly, we recommend the Department work with its vendor to correct any system defects in the provider revalidation process to help ensure providers are properly revalidated.

IT – MEDICAID/CHIP – PROVIDER LICENSE EXCEPTION REPORTS Finding Number: 2023-016 State Agency Number: MCD-06 Assistance Listing Numbers and Titles: 93.767 – Children’s Health Insurance Program (CHIP) 93.767 COVID-19 – CHIP 93.775/93.777/93.778 – Medicaid Cluster 93.775/93.777/93.778 COVID-19 – Medicaid Cluster Federal Award Identification Number / Year: 2205OH5022 / 2022 (CHIP) 2305OH5023 / 2023 (CHIP) 2205OH5MAP / 2022 (Medicaid Cluster) 2305OH5MAP / 2023 (Medicaid Cluster) Federal Agency: Department of Health and Human Services Compliance Requirement: Special Tests and Provisions – Provider Eligibility Repeat Finding from Prior Audit? No NONCOMPLIANCE AND MATERIAL WEAKNESS 42 C.F.R. § 455.412, Verification of provider licenses, states: The State Medicaid agency must do all of the following: (a) Have a method for verifying that any provider purporting to be licensed in accordance with the laws of any State is licensed by such State. (b) Confirm that the provider’s license has not expired and that there are no current limitations on the provider’s license. It is management’s responsibility to develop and implement internal control procedures to reasonably ensure provider licenses are properly verified. Management is also responsible for ensuring the internal control procedures are operating effectively throughout the audit period. During state fiscal year 2023, the Department disbursed approximately $28.4 billion for the Medicaid Cluster and $622.1 million for the Children’s Health Insurance Program (CHIP). The Department administers the Medicaid Information Technology System (MITS) and the Ohio Medicaid Enterprise System (OMES), which are automated applications, to determine if the services provided to eligible recipients were by an eligible provider and allowable prior to payment. During the audit period, the Department had a variety of processes in place to help ensure providers were eligible to provide medical services, including provider revalidation (required every five or three years), identification and termination of providers with disciplinary action taken by the State licensing boards, and automated checks against exclusion databases over the entire provider master file. The Department also had an automated process in place to update the provider license panel in MITS on a weekly basis, and then monthly for OMES, with data received from the State licensing boards. License Exception Reports are generated by MITS/OMES when the system is unable to update the license information (out-of-state providers, name mismatches, etc.) or when the matching criteria is unable to make a 100% match via the automated process. The Department maintains procedures for manually reviewing and updating license information for providers who are documented on these exception reports. However, for 11 of 12 (91.7%) months, the Department did not complete a full review and manually update the licensing information for all providers documented on the exception reports. Without complete and timely reviews of provider licensing, there is an increased risk payments will be made to unlicensed, ineligible providers, resulting in the misuse of state resources or federal program monies. This could result in the federal awarding agency requiring the Department to repay these funds or imposing penalties or sanctions. Based on discussion with management, staff spot-checked the reports; however, due to issues with implementing OMES and switching over to the Provider Network Management module, as well as the extensive number of enrolled licensed providers, staff resources were strained which led to them being behind on completing the monthly reviews. We recommend the Department reinforce and strengthen internal control procedures over the review of the License Exception Reports to ensure providers are eligible to provide services to Medicaid Cluster and CHIP recipients. The Department should ensure the License Exception Report reviews are completed timely, consistently, and are properly documented/maintained. Management should periodically monitor these procedures to ensure they are operating effectively and as intended.

IT – MEDICAID/CHIP – PROVIDER LICENSE EXCEPTION REPORTS Finding Number: 2023-016 State Agency Number: MCD-06 Assistance Listing Numbers and Titles: 93.767 – Children’s Health Insurance Program (CHIP) 93.767 COVID-19 – CHIP 93.775/93.777/93.778 – Medicaid Cluster 93.775/93.777/93.778 COVID-19 – Medicaid Cluster Federal Award Identification Number / Year: 2205OH5022 / 2022 (CHIP) 2305OH5023 / 2023 (CHIP) 2205OH5MAP / 2022 (Medicaid Cluster) 2305OH5MAP / 2023 (Medicaid Cluster) Federal Agency: Department of Health and Human Services Compliance Requirement: Special Tests and Provisions – Provider Eligibility Repeat Finding from Prior Audit? No NONCOMPLIANCE AND MATERIAL WEAKNESS 42 C.F.R. § 455.412, Verification of provider licenses, states: The State Medicaid agency must do all of the following: (a) Have a method for verifying that any provider purporting to be licensed in accordance with the laws of any State is licensed by such State. (b) Confirm that the provider’s license has not expired and that there are no current limitations on the provider’s license. It is management’s responsibility to develop and implement internal control procedures to reasonably ensure provider licenses are properly verified. Management is also responsible for ensuring the internal control procedures are operating effectively throughout the audit period. During state fiscal year 2023, the Department disbursed approximately $28.4 billion for the Medicaid Cluster and $622.1 million for the Children’s Health Insurance Program (CHIP). The Department administers the Medicaid Information Technology System (MITS) and the Ohio Medicaid Enterprise System (OMES), which are automated applications, to determine if the services provided to eligible recipients were by an eligible provider and allowable prior to payment. During the audit period, the Department had a variety of processes in place to help ensure providers were eligible to provide medical services, including provider revalidation (required every five or three years), identification and termination of providers with disciplinary action taken by the State licensing boards, and automated checks against exclusion databases over the entire provider master file. The Department also had an automated process in place to update the provider license panel in MITS on a weekly basis, and then monthly for OMES, with data received from the State licensing boards. License Exception Reports are generated by MITS/OMES when the system is unable to update the license information (out-of-state providers, name mismatches, etc.) or when the matching criteria is unable to make a 100% match via the automated process. The Department maintains procedures for manually reviewing and updating license information for providers who are documented on these exception reports. However, for 11 of 12 (91.7%) months, the Department did not complete a full review and manually update the licensing information for all providers documented on the exception reports. Without complete and timely reviews of provider licensing, there is an increased risk payments will be made to unlicensed, ineligible providers, resulting in the misuse of state resources or federal program monies. This could result in the federal awarding agency requiring the Department to repay these funds or imposing penalties or sanctions. Based on discussion with management, staff spot-checked the reports; however, due to issues with implementing OMES and switching over to the Provider Network Management module, as well as the extensive number of enrolled licensed providers, staff resources were strained which led to them being behind on completing the monthly reviews. We recommend the Department reinforce and strengthen internal control procedures over the review of the License Exception Reports to ensure providers are eligible to provide services to Medicaid Cluster and CHIP recipients. The Department should ensure the License Exception Report reviews are completed timely, consistently, and are properly documented/maintained. Management should periodically monitor these procedures to ensure they are operating effectively and as intended.

IT – MEDICAID/CHIP – LACK OF FEDERAL EXCLUSION DATABASE CHECKS Finding Number: 2023-017 State Agency Number: MCD-07 Assistance Listing Numbers and Titles: 93.767 – Children’s Health Insurance Program (CHIP) 93.767 COVID-19 – CHIP 93.775/93.777/93.778 – Medicaid Cluster 93.775/93.777/93.778 COVID-19 – Medicaid Cluster Federal Award Identification Number / Year: 2205OH5022 / 2022 (CHIP) 2305OH5023 / 2023 (CHIP) 2205OH5MAP / 2022 (Medicaid Cluster) 2305OH5MAP / 2023 (Medicaid Cluster) Federal Agency: Department of Health and Human Services Compliance Requirement: Special Tests and Provisions – Provider Eligibility Repeat Finding from Prior Audit? No NONCOMPLIANCE AND MATERIAL WEAKNESS 42 C.F.R. § 455.436 Federal database checks, states: The State Medicaid agency must do all of the following: (a) Confirm the identity and determine the exclusion status of providers and any person with an ownership or control interest or who is an agent or managing employee of the provider through routine checks of Federal databases. (b) Check the Social Security Administration's Death Master File, the National Plan and Provider Enumeration System (NPPES), the List of Excluded Individuals/Entities (LEIE), the Excluded Parties List System (EPLS), and any such other databases as the Secretary may prescribe. (c) (1) Consult appropriate databases to confirm identity upon enrollment and reenrollment; and (2) Check the LEIE and EPLS no less frequently than monthly. It is management’s responsibility to design and implement internal controls to reasonably ensure compliance with laws and regulations and to ensure management’s objectives are achieved. During state fiscal year 2023, the Department disbursed approximately $28.4 billion in benefits for the Medicaid Cluster and $622.1 million for the Children’s Health Insurance Program (CHIP). The Department administers the Medicaid Information Technology System (MITS), which is an automated application used to determine if the services provided to eligible recipients were by an eligible provider and allowable prior to payment. The Department and its vendor also administer the Provider Network Management (PNM) module of the Ohio Medicaid Enterprise System (OMES), the system being developed to replace MITS. On October 1, 2022, the OMES PNM module replaced MITS as the system of record for provider enrollment and provider data management for all Ohio Medicaid providers. The MITS application and PNM module were designed to include automated verifications of provider licenses and updates through an interface with Ohio Department of Administrative Services (DAS) e-License website. However, the following exceptions were noted related to federal exclusion list matches: • MITS Monthly Database jobs, which include federal exclusion checks, were paused for the month of September 2022 during the cut-over from MITS to OMES PNM. After PNM went live on October 1, 2022, the Department and the vendor identified several system issues related to the converted license data structure that would have inappropriately impacted approximately 29,000 providers and prevented the PNM module from properly executing the federal exclusion check jobs for the months of October 2022 through April 2023. The jobs were fully re-instated in May 2023. When complete and accurate cross-checks against the Federal Exclusion databases are not performed, there is an increased risk unauthorized providers could bill for services and receive unallowable payments. Based on discussions with the Department, during September 2022 and October 2022 there was a blackout period for data conversion during the transition of MITS data to the PNM module which attributed to the issues noted. The Department’s PNM module was designed to include automated provider license verifications and updates through an interface with DAS’s e-License website; however, after going live, the Department and its vendor identified several system issues that would have inappropriately impacted many providers where the converted license data structure needed refinement and the PNM could not properly execute the e-License job. Additionally, the automated e-License verification job (that includes the update, exception, terminations, and batch confirmation reports) in the PNM module did not run as expected starting October 2022 through April 2023. We recommend the Department continue to coordinate with DAS and its vendor to help ensure the required federal exclusion database checks are performed properly and in a timely manner. In addition, the Department should ensure the federal exclusion database checks are properly documented and maintained. Management should periodically monitor these procedures to ensure they are operating effectively and as intended.

IT – MEDICAID/CHIP – LACK OF FEDERAL EXCLUSION DATABASE CHECKS Finding Number: 2023-017 State Agency Number: MCD-07 Assistance Listing Numbers and Titles: 93.767 – Children’s Health Insurance Program (CHIP) 93.767 COVID-19 – CHIP 93.775/93.777/93.778 – Medicaid Cluster 93.775/93.777/93.778 COVID-19 – Medicaid Cluster Federal Award Identification Number / Year: 2205OH5022 / 2022 (CHIP) 2305OH5023 / 2023 (CHIP) 2205OH5MAP / 2022 (Medicaid Cluster) 2305OH5MAP / 2023 (Medicaid Cluster) Federal Agency: Department of Health and Human Services Compliance Requirement: Special Tests and Provisions – Provider Eligibility Repeat Finding from Prior Audit? No NONCOMPLIANCE AND MATERIAL WEAKNESS 42 C.F.R. § 455.436 Federal database checks, states: The State Medicaid agency must do all of the following: (a) Confirm the identity and determine the exclusion status of providers and any person with an ownership or control interest or who is an agent or managing employee of the provider through routine checks of Federal databases. (b) Check the Social Security Administration's Death Master File, the National Plan and Provider Enumeration System (NPPES), the List of Excluded Individuals/Entities (LEIE), the Excluded Parties List System (EPLS), and any such other databases as the Secretary may prescribe. (c) (1) Consult appropriate databases to confirm identity upon enrollment and reenrollment; and (2) Check the LEIE and EPLS no less frequently than monthly. It is management’s responsibility to design and implement internal controls to reasonably ensure compliance with laws and regulations and to ensure management’s objectives are achieved. During state fiscal year 2023, the Department disbursed approximately $28.4 billion in benefits for the Medicaid Cluster and $622.1 million for the Children’s Health Insurance Program (CHIP). The Department administers the Medicaid Information Technology System (MITS), which is an automated application used to determine if the services provided to eligible recipients were by an eligible provider and allowable prior to payment. The Department and its vendor also administer the Provider Network Management (PNM) module of the Ohio Medicaid Enterprise System (OMES), the system being developed to replace MITS. On October 1, 2022, the OMES PNM module replaced MITS as the system of record for provider enrollment and provider data management for all Ohio Medicaid providers. The MITS application and PNM module were designed to include automated verifications of provider licenses and updates through an interface with Ohio Department of Administrative Services (DAS) e-License website. However, the following exceptions were noted related to federal exclusion list matches: • MITS Monthly Database jobs, which include federal exclusion checks, were paused for the month of September 2022 during the cut-over from MITS to OMES PNM. After PNM went live on October 1, 2022, the Department and the vendor identified several system issues related to the converted license data structure that would have inappropriately impacted approximately 29,000 providers and prevented the PNM module from properly executing the federal exclusion check jobs for the months of October 2022 through April 2023. The jobs were fully re-instated in May 2023. When complete and accurate cross-checks against the Federal Exclusion databases are not performed, there is an increased risk unauthorized providers could bill for services and receive unallowable payments. Based on discussions with the Department, during September 2022 and October 2022 there was a blackout period for data conversion during the transition of MITS data to the PNM module which attributed to the issues noted. The Department’s PNM module was designed to include automated provider license verifications and updates through an interface with DAS’s e-License website; however, after going live, the Department and its vendor identified several system issues that would have inappropriately impacted many providers where the converted license data structure needed refinement and the PNM could not properly execute the e-License job. Additionally, the automated e-License verification job (that includes the update, exception, terminations, and batch confirmation reports) in the PNM module did not run as expected starting October 2022 through April 2023. We recommend the Department continue to coordinate with DAS and its vendor to help ensure the required federal exclusion database checks are performed properly and in a timely manner. In addition, the Department should ensure the federal exclusion database checks are properly documented and maintained. Management should periodically monitor these procedures to ensure they are operating effectively and as intended.

VARIOUS PROGRAMS – SUBRECIPIENT MONITORING Finding Number: 2023-018 State Agency Number: MHA-01 Assistance Listing Numbers and Titles: 93.667 – Social Services Block Grant (SSBG) 93.788 – Opioid STR 93.958 – Community Mental Health Services Block Grant (MHBG) 93.958 COVID-19 – MHBG Federal Award Identification Number / Year: 2201OHSOSR / 2022 (SSBG) 2301OHSOSR / 2023 (SSBG) H79TI081684 / 2020 (Opioid STR) H79TI083294 / 2021 (Opioid STR) H79TI085753 / 2022 (Opioid STR) B09SM083835 / 2021 (MHBG) B09SM085918 / 2021 (MHBG) B09SM085390 / 2021 (MHBG) B09SM084002 / 2021 (MHBG) B09SM086030 / 2022 (MHBG) Federal Agency: Department of Health and Human Services Compliance Requirement: Subrecipient Monitoring Repeat Finding from Prior Audit? Yes Prior Audit Finding Number: 2022-020 NONCOMPLIANCE AND MATERIAL WEAKNESS 45 C.F.R. §75.352 states, in part: All pass-through entities must: . . . (b) Evaluate each subrecipient's risk of noncompliance with Federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate subrecipient monitoring described in paragraphs (d) and (e) of this section, … (d) Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. Pass-through entity monitoring of the subrecipient must include: (1) Reviewing financial and performance reports required by the pass-through entity; (2) Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the Federal award provided to the subrecipient from the pass-through entity detected through audits, on-site reviews, and other means; and (3) Issuing a management decision for audit findings pertaining to the Federal award provided to the subrecipient from the pass-through entity as required by § 75.521. (e) Depending upon the pass-through entity's assessment of risk posed by the subrecipient (as described in paragraph (b) of this section), the following monitoring tools may be useful for the pass-through entity to ensure proper accountability and compliance with program requirements and achievement of performance goals: (1) Providing subrecipients with training and technical assistance on program-related matters; and (2) Performing on-site reviews of the subrecipient's program operations; (3) Arranging for agreed-upon-procedures engagements as described in § 75.425. Federal regulations require pass-through entities to maintain internal controls over federal programs that provide reasonable assurance they are in compliance with laws and regulations. In addition, sound internal control procedures require management to monitor these control procedures to verify they are designed and operating in a manner consistent with federal regulations and program objectives. To be effective, the performance of internal controls must be evidenced in some manner to document the control is in place and functioning as intended. During state fiscal year (SFY) 2023, the Department disbursed approximately $126.3 million to subrecipients of the SSBG, Opioid STR, and MHBG programs, as follows: See the Finding for chart/table The Department’s Community Monitoring Section (CMS) deploys a risk management monitoring technique for subrecipient monitoring to analyze and evaluate vulnerabilities of federal awards provided to the ADAMH boards. At the beginning of each fiscal year, CMS sends out questionnaires to all 50 ADAMH boards soliciting feedback regarding financial reporting, organizational turnover, number of contracted agencies, and whether any other monitoring (i.e., financial audits, peer review) has been completed. The Department then compiles the Carry Over and Unexpended Funds spreadsheet based on financial data obtained from the questionnaires, including any variances in financial data and unexpended federal funds. The CMS Manager then utilizes the Carry Over and Unexpended Funds spreadsheet to determine how to manage the State-wide risk and instructs CMS staff how to deploy its monitoring efforts for the SFY. Annually, CMS is to conduct Single Audit report reviews to ensure subrecipients, who have received at least $750,000 in federal funding for the fiscal year, have complied with the requirements for federal awards passed through the Department and make management decisions on any audit findings/corrective action plans within six months of the audit report date. The Department utilizes a database/Audit Review Tracking Spreadsheet to track data on subrecipients, such as: desk reviews, single audit reviews, subrecipient financial information, amounts subrecipients reported on their Schedule of Expenditures of Federal Awards, financial information from the State’s accounting system, and any other information about the subrecipient that would assist in effectively managing State-wide concerns on the federal awards passed through the Department. The Department reviews the Single Audits completed and the Corrective Action Plan (CAP), if applicable, for subrecipients with findings and issues a Management Decision letter to the subrecipient within six months of the audit report date. During the risk management process, CMS evaluates the rotation cycle, questionnaire results, and Board Risk Scores and identifies the Boards for which it will conduct the Stakeholder Assistance Review (SAR) procedures. The Department has designated the SAR process as an increased monitoring technique which is only applied to specific Boards designated as higher risk where the Department will conduct a physical on-site and/or virtual visit during the SFY. The SAR process is performed on a rotation basis to obtain approximately 33% or more coverage of all boards per Department policy. During SFY 2023, the Department performed risk management reviews, on-site reviews, and single audit reviews of the ADAMH boards; however, the following issues were identified: • The Department did not have procedures in place to monitor the Opioid STR and MHBG subrecipients, other than the ADAMH boards receiving subawards. As a result, the Department did not monitor 91 of 139 (65.5%) Opioid STR subrecipients which received $22.9 million, and 82 of 93 (88.2%) MHBG subrecipients which received $22.3 million during the audit period as required by 45 C.F.R. §75.352 (d). • The Department did not complete 12 of 17 (70.6%) planned SAR on-site/virtual visits during the audit period. • For one of four (25%) audit reports selected for testing, the Department did not provide the management decision letters to the subrecipients within six months of the report being accepted, as required by 45 C.F.R. §75.352 (d)(3). Without adequate procedures in place to monitor subrecipient compliance with federal statutes, laws and regulations, there is an increased risk subrecipients may misuse federal funds for unauthorized purposes. This could lead to fines, penalties, or repayment of program funds being imposed by the federal grantor agency. Based on discussions with management, the lack of subrecipient monitoring and documentation was an oversight caused by employee turnover and new management. We recommend the Department evaluate its current control procedures and processes over subrecipient monitoring and update them as necessary to reasonably ensure compliance with 45 C.F.R. §75.352. These procedures should include risk management monitoring, increased SAR desk reviews, and Single Audit reviews. Additionally, the Department should ensure an appropriate level of coverage is obtained for each federal program based on major program testing within the Single Audits. The Department should also put monitoring procedures in place over all subrecipients and not just the 50 ADAMH boards. Management should periodically monitor these procedures to ensure they are operating effectively and as intended.

VARIOUS PROGRAMS – SUBRECIPIENT MONITORING Finding Number: 2023-018 State Agency Number: MHA-01 Assistance Listing Numbers and Titles: 93.667 – Social Services Block Grant (SSBG) 93.788 – Opioid STR 93.958 – Block Grants for Community Mental Health Services (MHBG) 93.958 COVID-19 – MHBG 93.959 – Block Grants for Prevention and Treatment of Substance Abuse (SABG) 93.958 COVID-19 – SABG Federal Award Identification Number / Year: 2201OHSOSR / 2022 (SSBG) 2301OHSOSR / 2023 (SSBG) H79TI081684 / 2020 (Opioid STR) H79TI083294 / 2021 (Opioid STR) H79TI085753 / 2022 (Opioid STR) B09SM083835 / 2021 (MHBG) B09SM085918 / 2021 (MHBG) B09SM085390 / 2021 (MHBG) B09SM084002 / 2021 (MHBG) B09SM086030 / 2022 (MHBG) B08TI083961 / 2021 (SABG) B08TI083541 / 2021 (SABG) B08TI083470 / 2021 (SABG) B08TI084665/ 2022 (SABG) B08TI085827 / 2023 (SABG) Federal Agency: Department of Health and Human Services Compliance Requirement: Subrecipient Monitoring Repeat Finding from Prior Audit? Yes Prior Audit Finding Number: 2022-020 NONCOMPLIANCE AND MATERIAL WEAKNESS 45 C.F.R. §75.352 states, in part: All pass-through entities must: . . . (b) Evaluate each subrecipient's risk of noncompliance with Federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate subrecipient monitoring described in paragraphs (d) and (e) of this section, … (d) Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. Pass-through entity monitoring of the subrecipient must include: VARIOUS PROGRAMS – SUBRECIPIENT MONITORING (Continued) (1) Reviewing financial and performance reports required by the pass-through entity; (2) Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the Federal award provided to the subrecipient from the pass-through entity detected through audits, on-site reviews, and other means; and (3) Issuing a management decision for audit findings pertaining to the Federal award provided to the subrecipient from the pass-through entity as required by § 75.521. (e) Depending upon the pass-through entity's assessment of risk posed by the subrecipient (as described in paragraph (b) of this section), the following monitoring tools may be useful for the pass-through entity to ensure proper accountability and compliance with program requirements and achievement of performance goals: (1) Providing subrecipients with training and technical assistance on program-related matters; and (2) Performing on-site reviews of the subrecipient's program operations; (3) Arranging for agreed-upon-procedures engagements as described in § 75.425. Federal regulations require pass-through entities to maintain internal controls over federal programs that provide reasonable assurance they are in compliance with laws and regulations. In addition, sound internal control procedures require management to monitor these control procedures to verify they are designed and operating in a manner consistent with federal regulations and program objectives. To be effective, the performance of internal controls must be evidenced in some manner to document the control is in place and functioning as intended. During state fiscal year (SFY) 2023, the Department disbursed approximately $216.8 million to subrecipients of the SSBG, Opioid STR, MHBG, and SABG programs, as follows: Assistance Listing Number & Title Disbursements to Subrecipients Number of Subrecipients 93.667 –- SSBG $7,929,043 50* 93.788 – Opioid STR $85,347,598 139** 93.958 – MHBG $32,995,194 93*** 93.959 – SABG $90,569,859 131**** Combined Total: $216,841,694 *Includes 50 Alcohol, Drug Addiction, and Mental Health (ADAMH) boards ** Includes 48 of the 50 Alcohol, Drug Addiction, and Mental Health (ADAMH) boards ***Includes 11 of the 50 Alcohol, Drug Addiction, and Mental Health (ADAMH) boards ****Includes 9 of the 50 Alcohol, Drug Addiction, and Mental Health (ADAMH) boards The Department’s Community Monitoring Section (CMS) deploys a risk management monitoring technique for subrecipient monitoring to analyze and evaluate vulnerabilities of federal awards provided to the ADAMH boards. At the beginning of each fiscal year, CMS sends out questionnaires to all 50 ADAMH boards soliciting feedback regarding financial reporting, organizational turnover, number of contracted agencies, and whether any other monitoring (i.e., financial audits, peer review) has been completed. The Department then compiles the Carry Over and Unexpended Funds spreadsheet based on financial data obtained from the questionnaires, including any variances in financial data and unexpended federal funds. The CMS Manager then utilizes the Carry Over and Unexpended Funds spreadsheet to determine how to manage the State-wide risk and instructs CMS staff how to deploy its monitoring efforts for the SFY. Annually, CMS is to conduct Single Audit report reviews to ensure subrecipients, who have received at least $750,000 in federal funding for the fiscal year, have complied with the requirements for federal awards passed through the Department and make management decisions on any audit findings/corrective action plans within six months of the audit report date. The Department utilizes a database/Audit Review Tracking Spreadsheet to track data on subrecipients, such as: desk reviews, single audit reviews, subrecipient financial information, amounts subrecipients reported on their Schedule of Expenditures of Federal Awards, VARIOUS PROGRAMS – SUBRECIPIENT MONITORING (Continued) financial information from the State’s accounting system, and any other information about the subrecipient that would assist in effectively managing State-wide concerns on the federal awards passed through the Department. The Department reviews the Single Audits completed and the Corrective Action Plan (CAP), if applicable, for subrecipients with findings and issues a Management Decision letter to the subrecipient within six months of the audit report date. During the risk management process, CMS evaluates the rotation cycle, questionnaire results, and Board Risk Scores and identifies the Boards for which it will conduct the Stakeholder Assistance Review (SAR) procedures. The Department has designated the SAR process as an increased monitoring technique which is only applied to specific Boards designated as higher risk where the Department will conduct a physical on-site and/or virtual visit during the SFY. The SAR process is performed on a rotation basis to obtain approximately 33% or more coverage of all boards per Department policy. During SFY 2023, the Department performed risk management reviews, on-site reviews, and single audit reviews of the ADAMH boards; however, the following issues were identified: • The Department did not have procedures in place to monitor the Opioid STR, MHBG, and SABG subrecipients, other than the ADAMH boards receiving subawards. As a result, the Department did not monitor 91 of 139 (65.5%) Opioid STR subrecipients which received $22.9 million, 82 of 93 (88.2%) MHBG subrecipients which received $22.3 million, and 122 of 131 (93.1%) SABG subrecipients which received $41.5 million during the audit period as required by 45 C.F.R. §75.352 (d). • The Department did not complete 12 of 17 (70.6%) planned SAR on-site/virtual visits during the audit period. • For one of four (25%) audit reports selected for testing, the Department did not provide the management decision letters to the subrecipients within six months of the report being accepted, as required by 45 C.F.R. §75.352 (d)(3). Without adequate procedures in place to monitor subrecipient compliance with federal statutes, laws and regulations, there is an increased risk subrecipients may misuse federal funds for unauthorized purposes. This could lead to fines, penalties, or repayment of program funds being imposed by the federal grantor agency. Based on discussions with management, the lack of subrecipient monitoring and documentation was an oversight caused by employee turnover and new management. We recommend the Department evaluate its current control procedures and processes over subrecipient monitoring and update them as necessary to reasonably ensure compliance with 45 C.F.R. §75.352. These procedures should include risk management monitoring, increased SAR desk reviews, and Single Audit reviews. Additionally, the Department should ensure an appropriate level of coverage is obtained for each federal program based on major program testing within the Single Audits. The Department should also put monitoring procedures in place over all subrecipients and not just the 50 ADAMH boards. Management should periodically monitor these procedures to ensure they are operating effectively and as intended.

VARIOUS PROGRAMS – TRANSPARENCY ACT REPORTING Finding Number: 2023-019 State Agency Number: MHA-02 Assistance Listing Numbers and Titles: 93.667 – Social Services Block Grant (SSBG) 93.788 – Opioid STR 93.958 – Block Grants for Community Mental Health Services (MHBG) 93.958 COVID-19 – MHBG Federal Award Identification Number / Year: 2201OHSOSR / 2022 (SSBG) 2301OHSOSR / 2023 (SSBG) H79TI081684 / 2020 (Opioid STR) H79TI083294 / 2021 (Opioid STR) H79TI085753 / 2022 (Opioid STR) B09SM083835 / 2021 (MHBG) B09SM085918 / 2021 (MHBG) B09SM085390 / 2021 (MHBG) B09SM084002 / 2021 (MHBG) B09SM086030 / 2022 (MHBG) Federal Agency: Department of Health and Human Services Compliance Requirement: Reporting Repeat Finding from Prior Audit? Yes Prior Audit Finding Number: 2022-022 NONCOMPLIANCE AND MATERIAL WEAKNESS NOTE: Finding numbers 2023-008 and 2023-011 contain additional information which is integral to and should be read in conjunction with this finding. The Federal Funding Accountability and Transparency Act (Pub. L. No. 109-282, as amended by Section 6202 of Public Law 110-252, hereafter referred to as the “Transparency Act” that are codified in 2 C.F.R. Part 170) requires prime recipients of federal awards who make first-tier subawards to report the subaward on the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS) website maintained by the federal Office of Management and Budget. Under the requirements of 2 C.F.R. Part 170, recipients (i.e., direct recipients) of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more on the FSRS website. Prime recipients must report by the end of the month following the month in which the obligation is made. It is management’s responsibility to design and implement internal controls to reasonably ensure compliance with laws and regulations and to ensure management’s objectives are achieved. The State of Ohio is considered the prime recipient for federal funds applicable to Transparency Act reporting and the state agencies receiving these federal funds are expected to report the subawards obligated in accordance with the Transparency Act. During state fiscal year 2023, the Department obligated approximately $127.8 million for 427 subawards which exceeded $30,000 and were required to be reported on the FSRS website in accordance with the Transparency Act, under the following major programs. See the Finding for chart/table Monthly, the Department’s Fiscal Office generates the Transparency Act report from the Grants Funding Management System (GFMS) and reviews it for completeness and accuracy, then approves it in the GFMS system. The Transparency Act report is then manually entered or uploaded into the FSRS website. However, the Department’s internal controls were not operating effectively and as a result, the following were noted: • Two of 21 (9.5%) Opioid STR subawards and one of 13 (7.7%) MHBG subawards over $30,000 were not reported in an approved monthly FFATA report within GFMS. • For Opioid STR, based on an inter-agency agreement, the Department is responsible for drawing down federal funds and transferring these funds to the Ohio Department of Health (DOH) via an Intra-State Transfer Voucher for disbursement to its subrecipients. Obligations were established to provide subawards to DOH’s subrecipients; however, the Department had no control procedures in place during the audit period to ensure this subaward information was collected from DOH for submission into the FSRS website. • For SSBG, the Department receives a portion of the Title XX award from the Ohio Department of Job and Family Services (JFS) for disbursement to its subrecipients. Obligations were established by the Department to provide subawards to its subrecipients; however, the Department had no control procedures in place during the audit period to ensure this subaward information was collected and provided to JFS for submission into the FSRS website. Additionally, the following noncompliance were noted over the Department’s Transparency Act Reporting: See the Finding for chart/table A lack of effective internal controls over the preparation and review of reports increases the risk the reports submitted to the federal grantor agency are inaccurate and incomplete. By not complying with federal Transparency Act reporting requirements, the Department risks federal funding being reduced, taken away, or other sanctions imposed by the federal grantor agency. If the subawards are not reported accurately and timely within the FSRS website, the risk exists that those using the Transparency Act reports could be relying on inaccurate information. Based on discussions with management, these errors were caused by management and employee turnover and internal system issues to comply with the Transparency Act report format. Additionally, the Department was unaware of its responsibility with Transparency Act reporting requirements since the inter-agency agreement with DOH and the SSBG Title XX State Plan did not specify the Department’s responsibility. We recommend the Department collect and report on the FSRS website complete and accurate information, including from its partner agencies (e.g., DOH and JFS), regarding subawards made for all programs subject to the Transparency Act. We also recommend the Department evaluate its Transparency Act reporting control procedures and update them as necessary, including responsibilities between it and the partner agencies, to promote compliance with the Federal regulations, as well as accuracy and completeness of information submitted. These procedures should include a supervisory review of the report information before it is submitted on the FSRS website and be adequately documented and communicated to staff, as well as the partner agencies, to help ensure the subgrant awards are properly reported in compliance with the Transparency Act for the respective programs.

VARIOUS PROGRAMS – TRANSPARENCY ACT REPORTING Finding Number: 2023-019 State Agency Number: MHA-02 Assistance Listing Numbers and Titles: 93.667 – Social Services Block Grant (SSBG) 93.788 – Opioid STR 93.958 – Block Grants for Community Mental Health Services (MHBG) 93.958 COVID-19 – MHBG Federal Award Identification Number / Year: 2201OHSOSR / 2022 (SSBG) 2301OHSOSR / 2023 (SSBG) H79TI081684 / 2020 (Opioid STR) H79TI083294 / 2021 (Opioid STR) H79TI085753 / 2022 (Opioid STR) B09SM083835 / 2021 (MHBG) B09SM085918 / 2021 (MHBG) B09SM085390 / 2021 (MHBG) B09SM084002 / 2021 (MHBG) B09SM086030 / 2022 (MHBG) Federal Agency: Department of Health and Human Services Compliance Requirement: Reporting Repeat Finding from Prior Audit? Yes Prior Audit Finding Number: 2022-022 NONCOMPLIANCE AND MATERIAL WEAKNESS NOTE: Finding numbers 2023-008 and 2023-011 contain additional information which is integral to and should be read in conjunction with this finding. The Federal Funding Accountability and Transparency Act (Pub. L. No. 109-282, as amended by Section 6202 of Public Law 110-252, hereafter referred to as the “Transparency Act” that are codified in 2 C.F.R. Part 170) requires prime recipients of federal awards who make first-tier subawards to report the subaward on the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS) website maintained by the federal Office of Management and Budget. Under the requirements of 2 C.F.R. Part 170, recipients (i.e., direct recipients) of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more on the FSRS website. Prime recipients must report by the end of the month following the month in which the obligation is made. It is management’s responsibility to design and implement internal controls to reasonably ensure compliance with laws and regulations and to ensure management’s objectives are achieved. The State of Ohio is considered the prime recipient for federal funds applicable to Transparency Act reporting and the state agencies receiving these federal funds are expected to report the subawards obligated in accordance with the Transparency Act. During state fiscal year 2023, the Department obligated approximately $127.8 million for 427 subawards which exceeded $30,000 and were required to be reported on the FSRS website in accordance with the Transparency Act, under the following major programs. See the Finding for chart/table Monthly, the Department’s Fiscal Office generates the Transparency Act report from the Grants Funding Management System (GFMS) and reviews it for completeness and accuracy, then approves it in the GFMS system. The Transparency Act report is then manually entered or uploaded into the FSRS website. However, the Department’s internal controls were not operating effectively and as a result, the following were noted: • Two of 21 (9.5%) Opioid STR subawards and one of 13 (7.7%) MHBG subawards over $30,000 were not reported in an approved monthly FFATA report within GFMS. • For Opioid STR, based on an inter-agency agreement, the Department is responsible for drawing down federal funds and transferring these funds to the Ohio Department of Health (DOH) via an Intra-State Transfer Voucher for disbursement to its subrecipients. Obligations were established to provide subawards to DOH’s subrecipients; however, the Department had no control procedures in place during the audit period to ensure this subaward information was collected from DOH for submission into the FSRS website. • For SSBG, the Department receives a portion of the Title XX award from the Ohio Department of Job and Family Services (JFS) for disbursement to its subrecipients. Obligations were established by the Department to provide subawards to its subrecipients; however, the Department had no control procedures in place during the audit period to ensure this subaward information was collected and provided to JFS for submission into the FSRS website. Additionally, the following noncompliance were noted over the Department’s Transparency Act Reporting: See the Finding for chart/table A lack of effective internal controls over the preparation and review of reports increases the risk the reports submitted to the federal grantor agency are inaccurate and incomplete. By not complying with federal Transparency Act reporting requirements, the Department risks federal funding being reduced, taken away, or other sanctions imposed by the federal grantor agency. If the subawards are not reported accurately and timely within the FSRS website, the risk exists that those using the Transparency Act reports could be relying on inaccurate information. Based on discussions with management, these errors were caused by management and employee turnover and internal system issues to comply with the Transparency Act report format. Additionally, the Department was unaware of its responsibility with Transparency Act reporting requirements since the inter-agency agreement with DOH and the SSBG Title XX State Plan did not specify the Department’s responsibility. We recommend the Department collect and report on the FSRS website complete and accurate information, including from its partner agencies (e.g., DOH and JFS), regarding subawards made for all programs subject to the Transparency Act. We also recommend the Department evaluate its Transparency Act reporting control procedures and update them as necessary, including responsibilities between it and the partner agencies, to promote compliance with the Federal regulations, as well as accuracy and completeness of information submitted. These procedures should include a supervisory review of the report information before it is submitted on the FSRS website and be adequately documented and communicated to staff, as well as the partner agencies, to help ensure the subgrant awards are properly reported in compliance with the Transparency Act for the respective programs.

CORONAVIRUS STATE AND LOCAL FISCAL RECOVERY FUNDS – SUBRECIPIENT MONITORING Finding Number: 2023-020 State Agency Number: DPS-01 Assistance Listing Number and Title: 21.027 COVID-19 – Coronavirus State and Local Fiscal Recovery Funds (SLFRF) Federal Award Identification Number / Year: SLFRP0130 / 2021 Federal Agency: Department of Treasury Compliance Requirement: Subrecipient Monitoring Repeat Finding from Prior Audit? No NONCOMPLIANCE AND MATERIAL WEAKNESS 2 C.F.R. § 1000.10 gives regulatory effect to the Department of the Treasury for 2 C.F.R. § 200.332, which establishes requirements over subawards for pass-through entities and states, in part: All pass-through entities must: (a) Ensure that every subaward is clearly identified to the subrecipient as a subaward and includes the following information at the time of the subaward and if any of these data elements change, include the changes in subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward. Required information includes: (1) Federal Award Identification. . . . (xii) Assistance Listings number and Title; the pass-through entity must identify the dollar amount made available under each Federal award and the Assistance Listings Number at time of disbursement; It is management's responsibility to ensure subaward agreements appropriately identify all required subaward identification information and include the appropriate terms and conditions. During state fiscal year 2023, the Department entered into 496 grant agreements with subrecipients for the SLFRF program totaling approximately $175 million. The Subgrant Award Agreement for the Office of Criminal Justice (OCJS) division and the Grant Agreement for the Emergency Management Agency (EMA) division outline the applicable laws and regulations the subrecipient must follow to receive and maintain funding from SLFRF. However, the OCJS Subgrant Award Agreements, which represent 282 of 496 (56.9%) grant agreements for the program, did not include the Assistance Listing Number 21.027 for SLFRF as required by 2 C.F.R. § 200.332(a)(1). Without consistently identifying all required subaward information, subrecipients may not be aware of the federal program’s assistance listing number and/or federal compliance requirements. This could result in subrecipients incorrectly identifying the award on their Schedule of Expenditures of Federal Awards or other reports. Additionally, noncompliance by the Department with federal regulations could result in federal funds being reduced, taken away, or other sanctions imposed by the federal grantor agency. Based upon discussions with management, the Assistance Listing number was not included on Subgrant Award Agreements due to management oversight. We recommend the Department continue to evaluate and revise its subgrant award agreements to reasonably ensure all required subaward information per 2 C.F.R. § 200.332(a) is included within these agreements and communicated to all subrecipients. The Department should also continue in its efforts to communicate this information to subrecipients with grant agreements previously executed. The Department should monitor future subgrant award agreements to ensure all required information is identified in a consistent manner and the appropriate terms and conditions are included.

CORONAVIRUS STATE AND LOCAL FISCAL RECOVERY FUNDS – SUBRECIPIENT MONITORING Finding Number: 2023-020 State Agency Number: DPS-01 Assistance Listing Number and Title: 21.027 COVID-19 – Coronavirus State and Local Fiscal Recovery Funds (SLFRF) Federal Award Identification Number / Year: SLFRP0130 / 2021 Federal Agency: Department of Treasury Compliance Requirement: Subrecipient Monitoring Repeat Finding from Prior Audit? No NONCOMPLIANCE AND MATERIAL WEAKNESS 2 C.F.R. § 1000.10 gives regulatory effect to the Department of the Treasury for 2 C.F.R. § 200.332, which establishes requirements over subawards for pass-through entities and states, in part: All pass-through entities must: (a) Ensure that every subaward is clearly identified to the subrecipient as a subaward and includes the following information at the time of the subaward and if any of these data elements change, include the changes in subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward. Required information includes: (1) Federal Award Identification. . . . (xii) Assistance Listings number and Title; the pass-through entity must identify the dollar amount made available under each Federal award and the Assistance Listings Number at time of disbursement; It is management's responsibility to ensure subaward agreements appropriately identify all required subaward identification information and include the appropriate terms and conditions. During state fiscal year 2023, the Department entered into 496 grant agreements with subrecipients for the SLFRF program totaling approximately $175 million. The Subgrant Award Agreement for the Office of Criminal Justice (OCJS) division and the Grant Agreement for the Emergency Management Agency (EMA) division outline the applicable laws and regulations the subrecipient must follow to receive and maintain funding from SLFRF. However, the OCJS Subgrant Award Agreements, which represent 282 of 496 (56.9%) grant agreements for the program, did not include the Assistance Listing Number 21.027 for SLFRF as required by 2 C.F.R. § 200.332(a)(1). Without consistently identifying all required subaward information, subrecipients may not be aware of the federal program’s assistance listing number and/or federal compliance requirements. This could result in subrecipients incorrectly identifying the award on their Schedule of Expenditures of Federal Awards or other reports. Additionally, noncompliance by the Department with federal regulations could result in federal funds being reduced, taken away, or other sanctions imposed by the federal grantor agency. Based upon discussions with management, the Assistance Listing number was not included on Subgrant Award Agreements due to management oversight. We recommend the Department continue to evaluate and revise its subgrant award agreements to reasonably ensure all required subaward information per 2 C.F.R. § 200.332(a) is included within these agreements and communicated to all subrecipients. The Department should also continue in its efforts to communicate this information to subrecipients with grant agreements previously executed. The Department should monitor future subgrant award agreements to ensure all required information is identified in a consistent manner and the appropriate terms and conditions are included.

IT ? MEDICAID/CHIP/SNAP/TANF ? OHIO BENEFITS SYSTEM Finding Number: 2022-001 State Agency Number: DAS-01 Assistance Listing Numbers and Titles: 10.551/10.561 ? SNAP Cluster 93.558 ? Temporary Assistance for Needy Families (TANF) 93.767 ? Children?s Health Insurance Program (CHIP) 93.767 COVID-19 ? CHIP 93.775/93.777/93.778 ? Medicaid Cluster 93.775/93.777/93.778 COVID-19 ? Medicaid Cluster Federal Award Identification Number/Year: 202OH102S2514 / 2020 (SNAP Cluster) 202OH102S6018 / 2020 (SNAP Cluster) 212OH102S2514 / 2021 (SNAP Cluster) 212OH102S6018 / 2021 (SNAP Cluster) 222OH102S2514 / 2021 (SNAP Cluster) 222OH102S6018 / 2021 (SNAP Cluster) 1901OHTANF / 2019 (TANF) 2001OHTANF / 2020 (TANF) 2101OHTANF / 2021 (TANF) 2201OHTANF / 2021 (TANF) 2005OH5021 / 2020 (CHIP) 2105OH5021 / 2021 (CHIP) 2205OH5021 / 2022 (CHIP) 2005OH5MAP / 2020 (Medicaid) 2105OH5MAP / 2021 (Medicaid) 2205OH5MAP / 2022 (Medicaid) Federal Agencies: Department of Agriculture Department of Health and Human Services Compliance Requirements: Activities Allowed or Unallowed, Allowable Costs/Cost Principles, Eligibility, Special Tests & Provisions ? Income Eligibility Verification System Repeat Finding from Prior Audit? Yes Prior Audit Finding Number: 2021-002 MATERIAL WEAKNESS NOTE: Finding numbers 2022-013, 2022-017, 2022-018, and 2022-019 contain additional information which is integral to and should be read in conjunction with this finding. Applications/systems must be properly designed to achieve the business and IT goals of the organization. External factors effecting eligibility must be appropriately considered and properly evaluated to ensure eligibility for benefits is properly determined, and appropriate updates to eligibility are made when applicable. It is critical the appropriate monitoring controls are designed and implemented to reasonably ensure the organization has adequate controls to achieve management?s goals and objectives. During state fiscal year (SFY) 2022, the State of Ohio disbursed a combined total of $33.2 billion in public assistance payments related to the following programs: Assistance Listing Number & Title Benefits Paid Number of Recipients* 93.767 - CHIP $667,281,191 222,243 93.775/93.777/93.778 ? Medicaid Cluster $27,883,701,444 2,965,523 10.551/10.561 ? SNAP Cluster $4,465,389,555 1,502,137 93.558 ? TANF $203,674,740 73,104 Combined Total $ 33,220,046,930 4,763,007 *We did not separately identify recipients who could be covered by multiple programs The State of Ohio uses a multi-agency approach to administer these programs, as follows: overall compliance and administration of the Medicaid Cluster and CHIP falls under the Ohio Department of Medicaid (MCD), overall compliance and administration of the SNAP Cluster and TANF programs falls under the Ohio Department of Job & Family Services (ODJFS), and programming and administration of the State?s eligibility determination computer system, Ohio Benefits (OB), falls under the Ohio Department of Administrative Services (DAS). The OB system contains the eligibility and benefit information/determinations for these programs, including the Income Eligibility Verification System (IEVS) functionality which compares reported recipient income to income information maintained by outside data sources (SSA, Internal Revenue Service (IRS), etc.). The State also utilizes the 88 Ohio counties in the eligibility determination process to work with applicants, receive/enter eligibility documentation into the State?s system, and follow up on alerts issued by the system. Currently, individuals applying to receive public assistance benefits complete an application through one of several input locations including the Ohio Benefits Self-Service Portal, the Federally Funded Marketplace, Social Security, County Departments of Job & Family Services (CDJFS) offices; the Medicaid Consumer Hotline (the Hotline starts the application and sends to the CDJFS to complete); and paper applications that are sent to the CDJFS. When applying, the CDJFS collects and maintains any documentation provided by the individual either in a paper case file or in the OnBase Enterprise Documentation Management System (EDMS) maintained under contract by DAS. After collecting documentation, the county caseworker enters the individual?s information into the OB system which determines the initial eligibility benefit amount and assigns the benefit aid category, where applicable. This process is also used to perform eligibility redeterminations on an annual basis or when prompted through a system alert. The OB system is programmed with the State Plan recipient eligibility requirements to determine whether the recipient is eligible to receive the related program benefits based on the information entered by the recipient or caseworker and also assigns a benefit aid category. Once the determination is made, the OB system uploads the eligibility information to the MCD or ODJFS payment system for processing. The OB system is designed to issue alerts to county caseworkers for a variety of items which require review, evaluation, follow-up, and a determination about the impact on the related case and/or program benefits. However, we noted the following weaknesses in the design and monitoring of the OB system: ? Alerts ? During SFY 2022, more than 15.5 million alerts were issued for all public assistance programs according to DAS records (more than 3.4 million IEVS alerts and 12.1 million non-IEVS alerts). Ongoing enhancements to the Ohio Benefits alerts process were made in coordination with the personnel from DAS, MCD, and ODJFS throughout the audit period. These enhancements addressed design weaknesses to work on solutions for filtering duplicate alerts, including those across multiple programs. However, the volume of incoming IRS alerts/matches issued remained high: these alerts affect a change in recipient income and could possibly have an impact on eligibility or the benefit amount. These design weaknesses created a large volume of information being sent to the counties, resulting in an increased workload and ineffective application of the alert process. To remedy this volume of alerts, DAS has prioritized delivery of two additional enhancements targeted to be delivered in early SFY 2023 which are expected to decrease the overall backlog and reduce the incoming new alerts. ? Contract and Monitoring ? Although operating protocols were available defining DAS? responsibilities, a signed interagency agreement has not been finalized to define the roles and responsibilities of each agency and naming DAS as the administrator for OB. ? Data Governance ? No data governance structure was in place to ensure reliability over the data for management. Therefore, it was not clear how program objectives were being met/monitored and how program compliance was being achieved. If the State?s eligibility determination system, Ohio Benefits, is not designed to properly identify changes to recipient information and generate relevant alerts when those changes could impact a recipient?s eligibility, the risk of inaccurate or unallowable benefits being paid to, or on behalf of, recipients is greatly increased. These weaknesses could allow undue subjective decisions, jeopardize accurate eligibility processing, and/or result in improper payments or federal reimbursements. Overpayments or payments to or on behalf of ineligible recipients may subject the State to penalties or sanctions which may jeopardize future funding and limit its ability to fulfill program requirements to provide benefits to those in need. Additionally, without signed agreements with related agencies there is an increased risk responsibilities of each party may not be clearly defined, creating delays in critical processing and jeopardizing the achievement of overall goals. Also, without a data governance structure in place, there is an increased risk that management may rely on data that is of poor quality and/or unreliable. Based on discussions with management, the Ohio Benefits filtering logic was not working as intended upon receipt of the interface file from the IRS creating duplicate alerts; therefore, sending a high volume of alerts to county caseworkers. Management indicated the Ohio Benefits Program Team met with county caseworkers and CDJFS representatives in the Autumn of 2022 to specifically define and design a solution to reduce matches (and therefore alerts) to make IRS IEVS matches quicker and easier to process. The planned delivery towards these concerns with Release 4.6.1 is set for April 2023. Management also indicated the interagency agreements were drafted in June 2022 and are currently under final legal review at all three agencies. In addition, due to time constraints and other higher-level priorities, a data governance structure had not been formalized for the Ohio Benefits Program data. An Ohio Benefits Data Governance Team was formed and began meeting in September 2022 and is working towards formalizing their data governance structure and identifying goals and objectives. We recommend DAS continue to work collectively with the related state agencies to implement/update robust processes, procedures, and system controls to address the weaknesses associated with the eligibility/IEVS process within the OB system. These changes/updates should include, but not be limited to: ? Continuing to redesign the alert process to be more effective and efficient. This could include a more centralized evaluation of alert activity and/or better use of automated tools to analyze and prioritize items requiring follow-up. This would allow related state agency level personnel to become more experienced and adept at identifying and investigating anomalies and help focus the resources of both related state agency and county personnel. ? Identifying and coordinating program changes to address the system design weaknesses identified above. This should include working collaboratively with the related state agencies to prioritize program changes which could directly impact the eligibility determinations or benefit amounts to ensure they are corrected in a timely manner to prevent and detect further improper payments. ? Ensuring interagency agreements are formalized, contain all parties of the agreements, and fully and clearly define the roles, responsibilities, and expectations related to each party, including completion of required risk assessments and evaluations, and any other specific tasks designed to achieve program compliance. ? Implementing a data governance structure designed to ensure data quality and reliability for management, the grantor agencies, and other users of this information. This structure should ensure data subject experts from each related agency are included to help ensure the quality of data requests before external and internal users place reliance on the data, issues are addressed with a clear escalation path, and accountability and alignment between the related agencies is established.

EMERGENCY SOLUTIONS GRANTS PROGRAM ? OBLIGATION REQUIREMENTS Finding Number: 2022-002 State Agency Number: DEV-01 Assistance Listing Number and Title: 14.231 Emergency Solutions Grants Program Federal Award Identification Number / Year: E-21-DC-39-0001 / 2021 Federal Agency: Department of Housing and Urban Development Compliance Requirement: Special Tests and Provisions - Obligation, Expenditure and Payment Requirements Repeat Finding from Prior Audit? No NONCOMPLIANCE AND MATERIAL WEAKNESS 24 C.F.R. Part 576 ? 203 (a) relates to obligation requirements for the Emergency Solutions Grants Program (ESGP) and states, in part: Obligation of funds. (1) Funds allocated to States. (i) Within 60 days from the date that HUD [U.S. Department of Housing and Urban Development] signs the grant agreement with the State (or grant amendment for reallocated funds), the recipient must obligate the entire grant, except the amount for its administrative costs. This requirement is met by a subgrant agreement with, or a letter of award requiring payment from the grant to, a subrecipient. . . . It is management?s responsibility to design and implement internal controls to reasonably ensure compliance with laws and regulations and to ensure management?s objectives are achieved. During the audit period, the Department was awarded approximately $6.2 million in ESGP funding for the 2021 federal program year. ESGP is funded on a biennial basis, with new awards typically granted in odd-numbered years. The Department?s allocation and award of program funds to subrecipients involves the creation of an annual Consolidated Plan submitted to HUD, a subrecipient pre-application eligibility review, final allocation of program funds, and approval of the finalized subgrant agreement. However, four of four (100%) ESGP subgrant agreements entered into during the audit period that were selected for testing were obligated late. The number of days late ranged from 237 to 257, with an average of 245. Without procedures in place to ensure timely obligation of funds in accordance with federal requirements, the Department could face a reduction or elimination of funding, or other penalties or sanctions imposed by the federal grantor agency. Based on discussions with management, there have been difficulties complying with this requirement due to the short length of time given to obligate funds without impacting the overall experience of subrecipients or overall compliance with other program requirements. Management indicated they are in ongoing communication with HUD to resolve the matter. We recommend the Department review and evaluate its current ESGP subgrant award process for redundancies or areas where time savings can be implemented. The Department should also identify areas of the process that could be completed prior to the federal grantor agency awarding the funds. Management should also periodically monitor these processes and procedures to ensure they are operating effectively and meeting their objectives.

CDBG ? REPORTING Finding Number: 2022-003 State Agency Number: DEV-02 Assistance Listing Number and Title: 14.228 ? Community Development Block Grants/State?s Program and Non-Entitlement Grants in Hawaii (CDBG) Federal Award Identification Number / Year: B-16-DC-39-0001 / 2016 B-17-DC-39-0001 / 2017 B-18-DC-39-0001 / 2018 B-19-DC-39-0001 / 2019 B-20-DC-39-0001 / 2020 Federal Agency: Department of Housing and Urban Development Compliance Requirement: Reporting Repeat Finding from Prior Audit? No NONCOMPLIANCE AND MATERIAL WEAKNESS 24 C.F.R. Part 91 ? 520 states, in part: (a) General. Each jurisdiction that has an approved consolidated plan shall annually review and report, in a form prescribed by HUD [U.S. Department of Housing and Urban Development], on the progress it has made in carrying out its strategic plan and its action plan. The performance report must include a description of the resources made available, the investment of available resources, the geographic distribution and location of investments, the families and persons assisted (including the racial and ethnic status of persons assisted), actions taken to affirmatively further fair housing, and other actions indicated in the strategic plan and the action plan? ? (d) CDBG. For CDBG recipients, the report shall include a description of the use of CDBG funds during the program year and an assessment by the jurisdiction of the relationship of that use to the priorities and specific objectives identified in the plan, giving special attention to the highest priority activities that were identified? To provide guidance on the prescribed performance report format, HUD issued Notice CPD-21-11 which outlines the format of the Consolidated Annual Performance and Evaluation Report (CAPER), including the PR28 Financial Summary Report. Information captured in the report includes sources of CDBG funds and vouchers made against those sources for all open annual State CDBG grants. It is management?s responsibility to implement procedures to reasonably ensure the federal reports they submit are accurate, complete, and in compliance with the program requirements. It is imperative that management monitor these procedures, as well as maintain the underlying data and documentation used to support the information contained within the reports. The Department compiles the CAPER?s PR28 Financial Summary Report, using financial data from the Department?s OCEAN system which is used to track and maintain information on subgrant activity, including information on amounts drawn from HUD?s Integrated Disbursement and Information System (IDIS) against active Federal grants. Once prepared, the report is reviewed by the Deputy Chief of the Department?s Office of Community Development and submitted to HUD. However, the Department could not provide the supporting documentation used to compile the CAPER and PR28 reports submitted during the audit period. As an alternative method to ensure accuracy of the amounts reported for annual State CDBG grants in the PR28 report, we compared them to information obtained from the State?s accounting system, the Ohio Administrative Knowledge System. The following variances were noted: Grant Year FAIN Amounts Drawn per PR28 Report Amounts Drawn per OAKS Variance 2016 B-16-DC-39-0001 $ 41,063,331 $ 41,151,241 $ 87,910 0.21% 2017 B-17-DC-39-0001 $ 39,629,560 $ 39,803,352 $ 173,792 0.44% 2018 B-18-DC-39-0001 $ 44,508,253 $ 43,100,790 $ (1,407,463) -3.26% 2019 B-19-DC-39-0001 $ 36,138,582 $ 35,589,654 $ (548,928) -1.54% 2020 B-20-DC-39-0001 $ 23,968,274 $ 21,828,742 $ (2,139,532) -15.18% Inadequate internal control procedures governing the retention of information used to prepare federal reports increases the risk of inaccurate reporting to the federal grantor agency. Inaccurate and incomplete reporting could subject the Department to fines, penalties, or a reduction of federal funding. Based on discussions with management, the original supporting documentation could not be located due to turnover at the employee position responsible for preparing the report. Additionally, the OCEAN system does not allow the Department to re-run the reports used as of a historical date. We recommend the Department evaluate and update its existing procedures regarding record retention surrounding federal reports, if necessary, to provide reasonable assurance the data being reported for the CDBG program is accurate and properly supported. We further recommend the Department consider updating the OCEAN system to allow for producing historical reports, as well as consider using the OAKS or IDIS financial data to compile the report and/or to help ensure completeness of the data from OCEAN prior to submitting the report to the federal grantor agency. Management should periodically review and monitor these procedures to ensure they are operating effectively and as intended.

CDBG AND LIHEAP ? TRANSPARENCY ACT REPORTING Finding Number: 2022-004 State Agency Number: DEV-03 Assistance Listing Number and Title: 14.228 Community Development Block Grants/State?s Program and Non-Entitlement Grants in Hawaii (CDBG) 93.568 Low-Income Home Energy Assistance Program (LIHEAP) Federal Award Identification Number / Year: B-21-DC-39-0001 / 2021 (CDBG) 2101OHLIEA / 2021 (LIHEAP) Federal Agencies: Department of Housing and Urban Development Department of Health and Human Services Compliance Requirement: Reporting Repeat Finding from Prior Audit? Yes Prior Audit Finding Number: 2021-005 NONCOMPLIANCE AND MATERIAL WEAKNESS The Federal Funding Accountability and Transparency Act (Pub. L. No. 109-282, as amended by Section 6202 of Public Law 110-252, hereafter referred as the ?Transparency Act? that are codified in 2 C.F.R. Part 170) requires prime recipients of federal awards who make first-tier subawards to report the subaward on the Federal Funding Accountability and Transparency Subaward Reporting System (FSRS) website maintained by the federal Office of Management and Budget. Under the requirements of 2 C.F.R. Part 170, recipients (i.e., direct recipients) of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more on the FSRS website. Prime recipients must report by the end of the month following the month in which the obligation is made. It is management?s responsibility to design and implement internal controls to reasonably ensure compliance with laws and regulations and to ensure management?s objectives are achieved. During state fiscal year 2022, the Department disbursed approximately $89 million for 236 subawards which exceeded $30,000 and were required to be reported on the FSRS website in accordance with the Transparency Act, under the following major programs: Assistance Listing Number Assistance Listing Title Number of Subawards Amount Disbursed 14.228 CDBG 83 $27,193,724 93.568 LIHEAP 153 $61,742,923 The Department?s Finance Division managed Transparency Act reporting for all applicable programs, overseen by the Grant Strategy Manager. A tracking spreadsheet is maintained with all grants required to be reported or updated on the FSRS website with the key data elements required by the Transparency Act. The information within this spreadsheet is compiled from reports generated by the OCEAN system which the Department uses to track and maintain information on subgrant activity. Information within OCEAN is compiled by the grants personnel responsible for each federal program at the Department as well as through reporting via web interface by the subgrantee. However, there is no supervisory review of the Transparency Act reports prior to submission on the FSRS website. Further, the control procedures were not operating effectively and as a result, the following errors were noted for CDBG and LIHEAP: CDBG Transactions Tested Subaward not reported Report not timely Subaward amount incorrect Subaward missing key elements 9 3 9 3 3 Dollar Amount of Tested Transactions Subaward not reported Report not timely Subaward amount incorrect Subaward missing key elements $3,016,000 $470,000 $3,016,000 $470,000 $470,000 LIHEAP Transactions Tested Subaward not reported Report not timely Subaward amount incorrect Subaward missing key elements 15 10 15 10 10 Dollar Amount of Tested Transactions Subaward not reported Report not timely Subaward amount incorrect Subaward missing key elements $6,311,919 $ 4,728,604 $6,311,919 $4,728,604 $ 4,728,604 A lack of adequate internal controls over the preparation and review of reports increases the risk the reports submitted to the federal grantor agency are inaccurate and incomplete. In addition, by not complying with federal Transparency Act reporting requirements, the Department risks federal funding being reduced, taken away, or other sanctions imposed by the federal grantor agency. If the subawards are not reported accurately and timely within FSRS, the risk exists that those using the Transparency Act Reports could be relying on inaccurate information. Based on discussions with management, the errors were due to beginning implementation of the reporting process late in the audit period. Additionally, the Department experienced difficulty in identifying all subawards made amongst the different offices responsible for administering federal awards, as well as obtaining all subaward information required to be reported under the Transparency Act. We recommend the Department collect and report timely on the FSRS website complete and accurate information regarding subawards subject to the Transparency Act. We also recommend the Department continue implementation of its Transparency Act reporting process, including the process by which subawards are identified. Management should consider incorporating the input of the applicable offices within the Department to improve the process for identifying subawards and the key data elements for reporting, as well as the timeliness of reporting within the FSRS system. Management should periodically review these procedures to ensure they promote compliance with federal regulations and are operating as intended.

LIHEAP ? CASH MANAGEMENT Finding Number: 2022-005 State Agency Number: DEV-04 Assistance Listing Program Number and Title: 93.568 Low-Income Home Energy Assistance Program 93.568 COVID-19 Low-Income Home Energy Assistance Program Federal Award Identification Number / Year: 1901OHLIEA / 2019 2001OHLIEA / 2020 2001OHLIE4 / 2020 2001OHE5C3 / 2020 2101OHLIEA / 2021 2101OHLIE4 / 2021 2101OHE5C6 / 2021 2101OHLWC5 / 2021 2101OHLWC5 / 2021 Federal Agency: Department of Health and Human Services Compliance Requirement: Cash Management Repeat Finding from Prior Audit? Yes Prior Audit Finding Number: 2021-003 NONCOMPLIANCE AND MATERIAL WEAKNESS 31 C.F.R. Part 205 ? 11 states, in part: (a) A State and a Federal Program Agency must minimize the time elapsing between the transfer of funds from the United States Treasury and the State's payout of funds for Federal assistance program purposes, whether the transfer occurs before or after the payout of funds. (b) A State and a Federal Program Agency must limit the amount of funds transferred to the minimum required to meet a State's actual and immediate cash needs. . . . To define these allowable timeframes, the State of Ohio and the U.S. Department of the Treasury entered into a Cash Management Improvement Act (CMIA) Agreement which requires the Department to utilize the Modified Pre-Issuance Methodology when requesting federal funds for the Low-Income Home Energy Assistance Program (LIHEAP). Section 6.2.4 of the agreement regarding the Modified Pre-Issuance Methodology states, in part: . . . The State shall request funds such that they are deposited in a State account not more than eight business days prior to the day the State makes a disbursement. . . The amount of the request shall be the amount the State expects to disburse. . . Furthermore, an entity?s system of internal controls consists of the policies and procedures established by management to provide reasonable assurance that it complies with applicable rules and regulations and those specific operational objectives are achieved. These policies establish the authorization level for financial and operational transactions to be executed and are meant to accomplish management's goals and professional and statutory requirements. During state fiscal year 2022, the Department drew down approximately $305.6 million in federal funding for LIHEAP. The Department utilizes the CMIA Agreement, as well as internal policies and procedures as a guide for completing federal draws. The Department compiles a worksheet of all payment requests for administrative and program costs associated with providing LIHEAP assistance in order to determine the amount of federal funds to be drawn. This evaluation includes year-to-date disbursements, year-to-date revenues, and any refunds received and/or pending. However, for seven of 13 (53.8%) federal draws selected for testing, the Department's worksheet did not contain sufficient information to allow disbursements to be tied to a specific draw. As a result, it was not possible to determine if these draws were disbursed timely in accordance with the CMIA Agreement (within eight business days). Management implemented changes to the federal draw process in February 2022 to tie specific disbursements to the related federal draw. As a result, the other six draws tested were after the implementation date and contained the required payment requests documentation so they could be tested for compliance with the CMIA Agreement. Without procedures in place which allow for ensuring timely disbursement of funds in accordance with federal requirements and the CMIA Agreement, interest penalties may be incurred by the State of Ohio. This could also subject the Department to sanctions or other penalties by the federal grantor agency. Based on discussions with management, they had not previously considered developing a process that would allow them to match federal disbursements to the related federal draw prior to fiscal year 2021. We recommend the Department periodically review and update its federal draw procedures to ensure they promote compliance with applicable cash management guidance. These procedures should include an adequate review by management to ensure they are properly documented and operating as intended.

EDUCATION STABILIZATION FUND ? SUBRECIPIENT MONITORING Finding Number: 2022-006 State Agency Number: EDU-01 Assistance Listing Number and Title: 84.425 COVID-19 ? Education Stabilization Fund Federal Award Identification Number / Year: S425D200035 / 2020 Federal Agency: Department of Education Compliance Requirement: Subrecipient Monitoring Repeat Finding from Prior Audit? No NONCOMPLIANCE AND MATERIAL WEAKNESS 2 C.F.R. ? 200.332 outlines pass-through entity responsibilities and states, in part, that all pass-through entities must: . . . (d) Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. Pass-through entity monitoring of the subrecipient must include: ? (2) Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the Federal award provided to the subrecipient from the pass-through entity detected through audits, on-site reviews, and written confirmation from the subrecipient, highlighting the status of actions planned or taken to address Single Audit findings related to the particular subaward. . . . The Department's Office of Federal Programs is responsible for monitoring subrecipients of the Education Stabilization Fund (ESF), including the subprogram, Elementary and Secondary School Emergency Relief (ESSER) Fund. The Office of Federal Programs monitors subrecipient compliance with ESSER program requirements through self-surveys, desk reviews, or on-site reviews based on various risk factors. If noncompliance is identified, the Department requests and reviews the corrective action plan created by the subrecipient. The Office of Federal Programs then performs a follow-up desk review to ensure the subrecipient successfully implemented their corrective action plan. During state fiscal year (SFY) 2022, the Office of Federal Programs identified four noncompliance issues for the ESF ? ESSER program that required corrective action plans. However, for one of two (50%) noncompliance issues selected for testing, the Office of Federal Programs did not obtain a corrective action plan, nor did they perform a follow-up desk review to ensure a corrective action plan was implemented timely and properly. Failure to follow up with subrecipients on noncompliance issues identified through the monitoring process could lead to further noncompliance with federal program regulations, as well as improper use of funding. Based on discussions with management, when the Office of Federal Programs separated the ESSER compliance monitoring out of the Department?s consolidated grants monitoring system into its own individual process at the beginning of SFY 2022, this noncompliance issue which was identified and included in the previous system was missed due to oversight. The Department?s Office of Federal Programs should strengthen existing processes and procedures to ensure that all subrecipients with detected noncompliance issues are properly accounted for in the monitoring records/system. The Department should take measures to ensure each subrecipient with noncompliance issues properly submits a corrective action plan. The Department should then perform a follow-up review to verify the subrecipient has taken timely and appropriate action to address the noncompliance issues identified.

TITLE I AND ESF ? TRANSPARENCY ACT REPORTING Finding Number: 2022-007 State Agency Number: EDU-02 Assistance Listing Numbers and Titles: 84.010 Title I Grants to Local Educational Agencies (Title I) 84.425 COVID19 ? Education Stabilization Fund (ESF) Federal Award Identification Number / Year: S010A210035 / 2021 (Title I) S425D210035 / 2021 (ESF) S425U210035 / 2021 (ESF) Federal Agency: Department of Education Compliance Requirement: Reporting Repeat Finding from Prior Audit? Yes Prior Audit Finding Number: 2021-007 NONCOMPLIANCE AND MATERIAL WEAKNESS (ESF) MATERIAL WEAKNESS (TITLE I) The Federal Funding Accountability and Transparency Act (Pub. L. No. 109-282, as amended by Section 6202 of Public Law 110-252, hereafter referred as the ?Transparency Act? that are codified in 2 C.F.R. Part 170) requires prime recipients of federal awards who make first-tier subawards to report the subaward on the Federal Funding Accountability and Transparency Subaward Reporting System (FSRS) website maintained by the federal Office of Management and Budget. Under the requirements of 2 C.F.R. Part 170, recipients (i.e., direct recipients) of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more on the FSRS website. Prime recipients must report by the end of the month following the month in which the obligation is made. It is management?s responsibility to design and implement internal controls to reasonably ensure compliance with laws and regulations and to ensure management?s objectives are achieved. During state fiscal year (SFY) 2022, the Department disbursed approximately $2.3 billion for 2,656 subawards which were required to be reported on the FSRS website in accordance with the Transparency Act, under the following major programs. Assistance Listing Number Assistance Listing Title Number of Subawards Amount Disbursed 84.010 Title I Grants to Local Educational Agencies 926 $599,386,863 84.425 Education Stabilization Fund 1,730 $1,679,497,863 The Data Administration Manager runs the SAS Enterprise Guide program on the first of the month to capture the prior month?s allocations, exports the data to an Excel master file, and performs a self-review of the data using the Department?s Comprehensive Continuous Improvement Plan (CCIP) system. Once completed, the Excel master file is sent to the Senior Financial Analyst, who separates the files by Federal Award Identification Number (FAIN) and then uploads the data into the FSRS website for processing. Once the report is uploaded into FSRS, the Senior Financial Analyst runs an error report, manually corrects all errors from the report, and resubmits the data into FSRS. However, the following weaknesses in the process were noted: - There was no supervisory level review of the subaward information entered into the FSRS website to ensure compliance with reporting requirements and accuracy of the reports for Title I and ESF. - The Department does not reconcile the subaward information entered into the FSRS website to available independent sources (such as the USASpending.gov site, an official data source for federal spending) to ensure the reports are complete and accurate. - The Department established formalized policies and procedures during the audit period related to Transparency Act reporting, however they were not implemented until FY 2023. As a result of these weaknesses, the following errors were noted for the Education Stabilization Fund (ESF): Transactions Tested Subaward not reported Report not timely Subaward amount incorrect Subaward missing key elements 60 0 19 0 0 Dollar Amount of Tested Transactions Subaward not reported Report not timely Subaward amount incorrect Subaward missing key elements $661,489,723 $0 $220,306,705 $0 $0 ESF includes 23 subprograms that were awarded by the U.S. Department of Education throughout the COVID-19 pandemic for different purposes, including the Elementary and Secondary School Emergency Relief Fund (ESSER) which was awarded in two different allotments (known as ESSER I and II). The Department indicated that it did not submit ESSER II subawards with an obligation date prior to July 1, 2021 within the required deadlines as all ESSER II subawards were reported on August 31, 2021. We analyzed all ESSER II subawards reported during SFY 2022 and noted that 571 of 1,730 ESF subawards subject to FFATA reporting (33%), totaling $1,255,667,439, with an obligation date prior to July 1, 2021 were not submitted timely in the FSRS website during SFY 2022. A lack of adequate internal controls over the preparation and review of reports increases the risk the reports submitted to the federal grantor agency are inaccurate and incomplete. By not complying with federal Transparency Act reporting requirements, the Department risks federal funding being reduced, taken away, or other sanctions imposed by the federal grantor agency. If the subawards are not reported accurately and timely within FSRS, the risk exists that those using the Transparency Reports could be relying on inaccurate information. Based on discussions with management, they have been working on the policies and procedures, training a new employee to compile the report, and implementing review processes, but they were not able to implement them during the audit period. As a result, there were errors made due to the lack of a supervisory review of the report compilation prior to submission as well as oversight during the compilation process. We recommend the Department evaluate its Transparency Act reporting control procedures and update them as necessary to ensure they promote compliance with the Federal regulations, as well as accuracy and completeness of information submitted. These procedures should include, but not be limited to: - A supervisory review of the report information before it is submitted on the FSRS website. - A reconciliation of the report information to what is reported on USAspending.gov. We further recommend the Department periodically evaluate and update its policies and procedures for the Transparency Act reporting process to ensure they are reflective of the process and are consistent with management?s objectives.

EDUCATION STABILIZATION FUND ? ANNUAL REPORT Finding Number: 2022-008 State Agency Number: EDU-03 Assistance Listing Number and Title: 84.425 COVID-19 ? Education Stabilization Fund Federal Award Identification Number / Year: S425D200035 / 2020 S425D210035 / 2021 S425U210035 / 2021 Federal Agency: Department of Education Compliance Requirement: Reporting Repeat Finding from Prior Audit? No NONCOMPLIANCE AND MATERIAL WEAKNESS The U.S. Department of Education?s (USED) Office of Elementary and Secondary Education?s website states: All grantees are required to report on Elementary and Secondary School Emergency Relief (ESSER) funds received under the Coronavirus Aid, Relief, and Economic Security (CARES) Act, the Coronavirus Response and Relief Supplemental Appropriations Act, 2021 (CRRSA Act), and the American Rescue Plan (ARP Act). Grantees must submit an annual report describing how the State and subrecipients used the awarded funds during the performance period. Part B(9) of the Certification and Agreement for Funding under the Education Stabilization Fund Program Elementary and Secondary School Emergency Relief Fund (ESSER Fund) between the Department and USED states, in part: ?The Secretary may require additional reporting in the future, which may include: the methodology LEAs [Local Education Agencies] will use to provide services or assistance to students and staff in both public and non-public schools, the uses of funds by the LEAs or other entities and demonstration of their compliance with Section 18003(d) of the CARES Act ... Further, the 2022 U.S. Office of Management and Budget?s Compliance Supplement states, in part: ESSER. . .grantees must submit an annual performance report (OMB No. 1810-0749?) with data on expenditures, planned expenditures, subrecipients, and uses of funds, including for mandatory reservations. Per guidance received from USED, the Department was required to submit the annual performance report for the Education Stabilization Fund?s ESSER I, II, and III subprograms between May 31 ? July 1, 2022. The Department submitted the report on July 1, 2022; however, USED noted several errors in the Department?s report and allowed the Department to submit an amended report between August 22 ? September 9, 2022. The Department submitted the amended version on September 8, 2022. Both the original and amended versions of the annual performance report covered the period of October 1, 2020 through June 30, 2021 for ESSER I and the period of July 1, 2020 through June 30, 2021 for ESSER II and ARP ESSER (ESSER III). The Department worked with the Management Council of the Ohio Education Computer Network to create a data portal for each school district to report their ESSER activity. The Department then used this data to compile the annual performance report and upload it into the Data Collection Tool, the application USED established to collect the data. However, while the Department had control procedures in place, they were not sufficient to ensure the completeness and accuracy of the information included in the annual report. In addition, the Department was unable to provide documentation to support the amounts reported. As a result, the total expenditures reported for 23 of 25 school districts selected for testing were not calculated/reported correctly when compared to amounts from the Ohio Administrative Knowledge System (OAKS) Voucher Payment Report, which was the only potential source available for testing. The total expenditures for each ESSER program and the respective variances were as follows: Program # of Schools Tested / # With Errors Total Expenditures per Annual Report Total Expenditures per OAKS Variance ESSER I 8 / 8 $43,313,688 $42,615,001 $698,687 ESSER II 9 / 7 $26,292,636 $13,004,131 $13,288,505 ARP ESSER (III) 8 / 8 $5,390,777 $0 $5,390,777 Totals 25 / 23 $74,997,101 $55,119,132 $19,377,969 Without proper procedures in place to ensure the amounts included in the report are complete and accurate, there is an increased risk that amounts reported to the federal grantor agency are incorrect. Inaccurate reporting could subject the Department to fines or other sanctions imposed by the federal grantor agency. Based on discussions with management, changes to the program requirements throughout the period made it difficult for the Department and the school districts to provide accurate information. In addition, not all school districts understood what time period the annual report was to cover which led to inconsistent data being reported in the portal. We recommend the Department implement policies and procedures to ensure that all amounts reported on the annual report are complete and accurate. These procedures should include formally notifying the school districts what period the data should come from, ensuring the data pulled from the portal is complete and accurate prior to compiling it in the annual report, and reconciling the amounts included in the annual report to information provided by the school districts. We further recommend the Department develop procedures on how to handle adjustments the school districts make to the data.

UNEMPLOYMENT INSURANCE ? DEATH FILE AND INCARCERATION CROSS-MATCHES Finding Number: 2022-009 State Agency Number: JFS-01 Assistance Listing Number and Title: 17.225 ? Unemployment Insurance 17.225 COVID-19 ? Unemployment Insurance Federal Award Identification Number / Year: UI-32619-19-55-A-39 / 2019 UI-34078-20-55-A-39 / 2020 UI-35668-21-55-A-39 / 2021 UI-37243-22-55-A-39 / 2022 Federal Agency: Department of Labor Compliance Requirements: Activities Allowed or Unallowed, Allowable Costs/Costs Principles, Eligibility Repeat Finding from Prior Audit? Yes Prior Audit Finding Number: 2021-011 QUESTIONED COSTS AND SIGNIFICANT DEFICIENCY NOTE: Finding numbers 2022-010 and 2022-012 detail questioned costs, noncompliance, and weaknesses in internal control related to the regular and pandemic Unemployment Insurance programs regarding fraud issues and overpayments. These findings are integral to and should be read in conjunction with this finding. 2 C.F.R. ? 2900.4 gives regulatory effect to the Department of Labor for 2 C.F.R. ? 200.1 which states, in part: . . . Improper Payment means: (1) Any payment that should not have been made or that was made in an incorrect amount under statutory, contractual, administrative, or other legally applicable requirements. (i) Incorrect amounts are overpayments or underpayments that are made to eligible recipients (including inappropriate denials of payment or service, any payment that does not account for credit for applicable discounts, payments that are for an incorrect amount, and duplicate payments). An improper payment also includes any payment that was made to an ineligible recipient or for an ineligible good or service, or payments for goods or services not received (except for such payments authorized by law). ? The Department of Labor?s Unemployment Insurance Program Letter (UIPL) No. 23-20 provides additional guidance to states regarding program integrity for the regular UI program and for the UI programs authorized by the CARES Act, enacted on March 27, 2020. UIPL 23-20, (4)(b) Program integrity functions for the regular UI programs and CARES Act programs states, in part: . . . The following BPC [Benefit Payment Control] activities are mandatory for states to implement for the regular UI programs on an ongoing basis. States must implement these functions for the PEUC [Pandemic Emergency Unemployment Compensation] and PUA [Pandemic Unemployment Assistance] programs in the same manner as for the regular UI programs. ? National Directory of New Hires Cross-match (UIPL Nos. 13-19 and 19-11). UIPL 13-19 provides detailed, recommended operating procedures for crossmatching with state and national directories of new hire data; ? Quarterly Wage Records Cross-match (20 CFR ? 603.23); and ? Systematic Alien Verification for Entitlement (SAVE) (Section 1137(d) of the Social Security Act (SSA) (42 U.S.C. ?1320b-7). The Department [of Labor] strongly recommends the following additional BPC activities as part of a state?s effective BPC operation for the regular UI programs, PUA, and PEUC: ? State Directory of New Hires Cross-match; ? Social Security Administration (SSA) Cross-match; ? Interstate Benefits (IB) Cross-match; ? State Identification Inquiry (SID) and IB8606 enhancements made to the Interstate Connection (ICON) network cross match to prevent concurrent claim filing in multiple states; ? State Information Data Exchange System (SIDES) (Training and Employment Notice No. 12-16); ? Identity Verification; ? Incarceration Cross-match; and ? UI Integrity Center?s Integrity Data Hub (IDH) tools including the Suspicious Actor Repository (SAR), Suspicious E-Mail Domains, Multi-State Cross-Match (MSCM), Foreign Internet Protocol (IP) Address Detection, and Fraud Alert application. It is management?s responsibility to reasonably ensure control procedures are in place and operating effectively to prevent benefits from being paid to individuals who do not meet the eligibility requirements for the UI program. During state fiscal year (SFY) 2022, the Department disbursed more than $1.69 billion in Unemployment benefits. Approximately $476.7 million of the total disbursed related to pandemic Unemployment benefit payments issued through the uFACTS system and $1.21 billion of the total disbursed related to regular Unemployment benefit payments issued through the Ohio Job Insurance (OJI) system. The Department implemented the BPC cross-matches for the pandemic Unemployment benefit payments in uFACTS, as required by UIPL 23-30, in February 2021 for the Innovate Ohio matches (e.g, Death, Inmate, Nursing Home, and State Employee) and May 2021 for the SSA cross-matches. In addition, the Department implemented the cross-matches for SSA and Incarceration in OJI in May 2021. In response to the COVID-19 pandemic, the Department implemented Lexis Nexis (uFACTS) and Experian (OJI) ID verification tools in late March/early April 2021; both of which factor in death when performing ID verification protocols. The Department receives death data from the Ohio Department of Health and incarceration data from the Ohio Department of Rehabilitation and Correction on a weekly basis. Cross-matches with this data are performed using the Department?s online dashboard based on default settings. The results of these cross-matches are displayed on the dashboard, which the Department?s Benefit Payment Control section staff are tasked with reviewing. However, a point in time results file that can be saved or archived for future review is not generated. Information contained in the dashboard is dynamic and is updated constantly as new data is received. No documentation was available to evidence a review process or any actions taken as a result of the dashboard cross-matches. An analysis of Unemployment benefits paid during SFY 2022 compared to data files received from the Ohio Department of Health and the Ohio Department of Rehabilitation and Correction identified $2,169,454 in benefits paid to individuals who were either deceased or incarcerated prior to the benefit week ending date associated with the benefit payments, as detailed below. Deceased Prior to Benefit Week Ending Date: ? 258 weekly claims transactions relating to 47 individual claimants, totaling $75,313 from the uFACTS system. ? 114 weekly claims transactions relating to 27 individual claimants, totaling $38,924 from the OJI system. Incarcerated Prior to Benefit Week Ending Date: The incarceration file utilized in this analysis was for the period of 3/1/2020 through 2/28/21; we were unable to obtain an incarceration file for SFY 2022 containing inmate social security numbers, a data element critical to the performance of our analysis. Therefore, the file utilized did not include individuals incarcerated, or take into account those who received early release after 2/28/21. Our analysis compared the OJI and uFACTS claims paid during SFY 2022 to the incarceration file. This comparison identified Unemployment benefits paid to individuals during SFY 2022 where the benefit week ending date was after their incarceration date and before their expected release date. These results did not exclude partial eligibility where the date of death or incarceration occurred in the benefit week. ? 5,717 weekly claims transactions relating to 303 individual claimants, totaling $1,992,919 from the uFACTS system. ? 239 weekly claims transactions relating to 16 individual claimants, totaling $62,298 from the OJI system. As such, we will question all benefit payments made to individuals who were either deceased or incarcerated prior to the benefit week ending date, totaling $2,169,454. Anomalies in the date and name fields contained in the OJI and uFACTS files provided by the Department, the social security number field being limited to the last four digits in the death file provided by the Ohio Department of Health, the unavailability of an updated incarceration file from the Ohio Department of Rehabilitation and Correction, and variables in the date fields contained in the incarceration file utilized limited our ability to place a high level of reliance on the completeness and accuracy of the above mentioned results. However, these results indicate the controls included in the system are not working effectively, resulting in unallowable payments to ineligible recipients. Without effective internal control procedures and cross-matching against reliable death records or incarcerated data prior to payment, there is an increased risk that inaccurate or unallowable benefit payments will be made. Overpayments to ineligible claimants may subject the Department to penalties or sanctions from the federal grantor agency which may jeopardize future funding and limit its ability to fulfill program requirements to provide benefits to those in need. We recommend the Department evaluate and strengthen current cross-matching internal control procedures, including those related to deceased and incarcerated individuals, to help identify potential ineligible individuals prior to making payments. These internal controls should formally define the frequency of review, the expected output/results file, and a process to investigate, document, track, and maintain documentation related to any actions taken as a result of the cross-match. Working with the Ohio Department of Health and the Ohio Department of Rehabilitation and Correction will be required to obtain reliable death and incarceration records. We further recommend the Department perform procedures to identify improper payments already made to deceased and incarcerated individuals and seek recovery, reimbursement, or offset future benefits, where necessary.

UNEMPLOYMENT INSURANCE ? PANDEMIC UNEMPLOYMENT ASSISTANCE AND FEDERAL PANDEMIC UNEMPLOYMENT COMPENSATION Finding Number: 2022-010 State Agency Number: JFS-02 Assistance Listing Number and Title: 17.225 COVID-19 ? Unemployment Insurance Federal Award Identification Number / Year: UI-32619-19-55-A-39 / 2019 UI-34078-20-55-A-39 / 2020 UI-35668-21-55-A-39 / 2021 UI-37243-22-55-A-39 / 2022 Federal Agency: Department of Labor Compliance Requirements: Activities Allowed or Unallowed, Allowable Costs/Costs Principles, Eligibility Repeat Finding from Prior Audit? Yes Prior Audit Finding Number: 2021-009 QUESTIONED COSTS, NONCOMPLIANCE, AND MATERIAL WEAKNESS NOTE: Finding numbers 2022-009 and 2022-012 detail questioned costs, noncompliance, and weaknesses in internal control related to the regular and pandemic Unemployment Insurance programs regarding fraud issues and overpayments. These findings are integral to and should be read in conjunction with this finding. 15 U.S.C. ? 9021 pertaining to PUA, states, in part: (a) Definitions (3) Covered Individual The term ?covered individual? ? (A) means an individual who ? (i) is not eligible for regular compensation or extended benefits under State or Federal law or pandemic emergency unemployment compensation under section 9025 of this title, including an individual who has exhausted all rights to regular unemployment or extended benefits under State or Federal law or pandemic emergency unemployment compensation under section 9025 of this title; ? . . . (c) Applicability (1) In general Except as provided in paragraph (2), the assistance authorized under subsection (b) shall be available to a covered individual? (A) for weeks of unemployment, partial unemployment, or inability to work caused by COVID?19 ? (i) beginning on or after January 27, 2020; and (ii) ending on or before September 6, 2021; and (B) subject to subparagraph (A)(ii), as long as the covered individual?s unemployment, partial unemployment, or inability to work caused by COVID?19 continues. (2) Limitation on duration of assistance The total number of weeks for which a covered individual may receive assistance under this section shall not exceed 79 weeks and such total shall include any week for which the covered individual received regular compensation or extended benefits under any Federal or State law, except that if after March 27, 2020, the duration of extended benefits is extended, the 79-week period described in this paragraph shall be extended by the number of weeks that is equal to the number of weeks by which the extended benefits were extended. . . . (d) Amount of Assistance . . . (A) (i) the weekly benefit amount authorized under the unemployment compensation law of the State where the covered individual was employed, except that the amount may not be less than the minimum weekly benefit amount described in section 625.6 of title 20, Code of Federal Regulations, or any successor thereto; and (ii) ending on or before September 6, 2021; and (ii) the amount of Federal Pandemic Unemployment Compensation [FPUC] under section 9023 of this title; ? . . . (h) Relationship between pandemic unemployment assistance and disaster unemployment assistance [DUA] Except otherwise provided in this section or to the extent there is a conflict between this section and section?625 of title 20, Code of Federal Regulations, such section?625 shall apply to this section as if: (1) the term ?COVID?19 public health emergency? were substituted for the term ?major disaster? each place it appears in such section?625; and (2) the term ?pandemic? were substituted for the term ?disaster? each place it appears in such section? 625. . . . 15 U.S.C. ? 9023(3) pertaining to FPUC states, in part: (A) In general The amount specified in this paragraph is the following amount: (i) For weeks of unemployment beginning after the date on which an agreement is entered into under this section and ending on or before July 31, 2020, $600. (ii) For weeks of unemployment beginning after December 26, 2020 (or, if later, the date on which such agreement is entered into), and ending on or before September 6, 2021, $300. . . . 20 C.F.R. ? 625.6, pertaining to the weekly amount states, in part: . . . (e) . . . An immediate determination of a weekly amount shall also be made where, in conjunction with the filing of an initial application for DUA, the individual submits documentation substantiating employment or self-employment and wages earned or paid for such employment or self-employment, or, in the absence of documentation, where any State agency records of employment or self-employment and wages earned or paid for such employment or self-employment, justify the determination of a weekly amount. . . . (1) In the case of a weekly amount determined in accordance with paragraph (e) of this section, based only on the individual's statement of earnings, the individual shall furnish documentation to substantiate the employment or self-employment or wages earned from or paid for such employment or self-employment or documentation to support that the individual was to commence employment or self-employment on or after the date the major disaster began. In either case, documentation shall be submitted within 21 calendar days of the filing of the initial application for DUA. (2) Any individual who fails to submit documentation to substantiate employment or self-employment or the planned commencement of employment or self-employment in accordance with paragraph (e)(1) of this section, shall be determined ineligible for the payment of DUA for any week of unemployment due to the disaster. Any weeks for which DUA was already paid on the application prior to the date of the determination of ineligibility under this paragraph (e)(2) are overpaid and a determination shall be issued in accordance with ? 625.14(a). In addition, the State agency shall consider whether the individual is subject to a disqualification for fraud in accordance with the provisions set forth in ? 625.14(i). . . . The federal government established rules, regulations, and requirements related to eligibility, benefit amounts and timing, monitoring responsibilities, etc. regarding the expanded Unemployment benefits related to the pandemic. It is management?s responsibility to implement controls, processes, and procedures to provide reasonable assurance over the reliability of financial reporting, effectiveness and efficiency of operations, and compliance with these rules, regulations, and requirements. The COVID-19 Pandemic presented the Department with many challenges and obstacles including a sharp increase in the volume of unemployment claims, the expansion of regular unemployment benefits by the federal government, and the lack of manpower and technology resources. The Department?s legacy unemployment system, Ohio Job Insurance (OJI), has been in place since 2004. The Department indicated that, due to OJI?s age and functionality, it was unable to handle the increased volume of claimants brought on by the pandemic. Therefore, the Department contracted with a service organization for processing of pandemic unemployment benefits and maintaining key functions of the benefit claims processing, which were customized to fit Ohio?s needs (effective May 14, 2020). This outside system, the Unemployment Framework for Automated Claim & Tax Services (uFACTS) system, was used for certain pandemic benefits only and maintained key functions of the benefit claims processing for this activity. Pandemic Unemployment benefits for new claims ended as of September 2021; however, the uFACTS system remains operational so the Department can continue to process the backlog of claims filed before the deadline and adjudicate pending claims flagged for further review. During state fiscal year 2022, the Department disbursed more than $1.69 billion in Unemployment benefits from both OJI and uFACTS. Approximately $476.7 million and $323.8 million related to PUA and FPUC benefits, respectively. The Department also reported to the U.S. Department of Labor outstanding Unemployment Insurance overpayments totaling $2.77 billion as of June 30, 2022. Of these total overpayments, $598.2 million was identified as fraud and $2.17 billion as non-fraud relating to regular unemployment and federal pandemic Unemployment benefits. Approximately $955 million (44%) of the non-fraud overpayments and $221.5 million (37%) of the fraud overpayments were processed through uFACTS. Eligibility for PUA and FPUC was determined within OJI or uFACTS based upon requirements outlined in state and/or federal laws. PUA provided up to a max of 79 weeks of benefits to many who historically have not qualified for unemployment benefits, such as self-employed workers, 1099 tax filers, part-time workers, and those who lack sufficient work history. FPUC provided additional benefits of $600 and/or $300 per week to individuals that qualified for regular unemployment or PUA benefits. Weekly, claimants confirmed their unemployment status and completed the COVID-19 self-attestation questionnaire within uFACTS or OJI. If the claimant?s benefit payment was flagged, an adjudicator performed an additional review and requested fact-finding information for either monetary or nonmonetary issues. The claimant continued to receive weekly benefit payments until the adjudicator investigated the issue and confirmed the claimant?s ineligible status. If an issue was suspected of fraud, the issue was routed to the Department?s Benefit Payment Control section to be investigated, adjudicated and, if applicable, an overpayment flag was created in the related system. The Department?s policy, which is based on U.S. Department of Labor guidance, is to adjudicate possible fraud cases within 21 days or 90 days, depending on the circumstances of the case. Although the Department implemented several additional controls during state fiscal year 2022 related to the pandemic unemployment benefits, the timing of these changes and/or application of the controls did not prevent or detect the following noncompliance errors, resulting in questioned costs totaling $86,076 ($55,836 for PUA and $30,240 for FPUC): ? For one of 60 (1.7%) regular Unemployment benefit payments selected for testing, the claimant was paid FPUC benefits of $300 a week for several weeks of benefits which were already paid in state fiscal year 2021. As a result, we will question all duplicate FPUC payments made to this claimant during the audit period, totaling $4,800. ? For eight of nine (88.9%) regular Unemployment benefit claims identified in an OJI system data match as potentially exceeding the maximum allowable amount per week, the claimants were paid $300 in FPUC benefits twice during the same benefit week. As a result, we will question costs for all FPUC payments over the allowable amount to these claimants during the audit period, totaling $17,640. ? Two of two (100%) PUA claims identified in a uFACTS system data match exceeded the maximum allowable number of weeks (79): one by four weeks and the other by two weeks. As a result, we will question the PUA payments exceeding the maximum allowable number of weeks, totaling $1,656. ? For eight of 60 (13.3%) PUA / FPUC payments selected for testing, the claimant was not eligible to receive benefits for the weeks claimed, was overpaid, or was underpaid, as follows: ? Two claimants were paid weekly benefit amounts exceeding the calculated weekly benefit amount. The Department determined one claimant was eligible for weekly benefits of $480 and the other $582; however, neither claimant's employment verification showed monetary eligibility for more than the minimum weekly benefit amount of $189. As a result, we will question all PUA payments made to these claimants exceeding the minimum weekly benefit amount of $189 during the audit period, totaling $31,650. ? One claimant quit their job for a non-qualifying COVID-19 separation reason and was ineligible for benefits. The regular Unemployment claim was appropriately denied in OJI, but the Department later approved the same separation as a PUA / FPUC claim. The Department determined the claim to be fraudulent in May 2022. As a result, we will question all PUA and FPUC payments made to this claimant during the audit period, totaling $7,182 and $7,800, respectively. ? One claimant was employed full-time the entire claim period and therefore ineligible for benefits. The Department appropriately denied the regular Unemployment claim in OJI but later approved the same separation as a PUA claim. As a result, we will question all PUA payments made to this claimant during the audit period, totaling $11,568. ? For two claims, the Department requested the claimant provide employment verification and the claimant did not respond in 90 days, as required by the Consolidated Appropriations Act. The claimant continued to file Unemployment claims after the 90-day deadline and the Department continued to pay benefits to the claimants until the adjudication date, occurring 28 days after the due date for one claim and 79 days for the other. As a result, we will question all PUA payments made to these claimants during the audit period between the due date for employment verification and the adjudication date, totaling $2,457. ? One claimant was improperly paid PUA benefits for weeks they were eligible for regular Unemployment. As a result, we will question all PUA benefit payments made to this claimant during the audit period for the weeks they were eligible for regular Unemployment, totaling $1,323. ? One claimant was paid a weekly benefit amount less than the calculated weekly benefit amount. The Department determined the claimant was eligible for weekly PUA benefits of $322; however, the employment verification used in the monetary determination showed the claimant was entitled to weekly benefits of $403. As a result, the claimant was underpaid a total of $2,628 PUA benefits during the audit period. Without effective internal controls for the eligibility determination and benefit payment processes, there is an increased risk benefit payments will be inaccurate or unallowable. The risk is increased if the systems contain significant flaws or eligibility redeterminations are not made timely or accurately. Overpayments to ineligible claimants may subject the Department to penalties or sanctions which may jeopardize future funding and limit its ability to fulfill program requirements to provide benefits to those in need. Based on discussions with management, these errors were due to oversight and the significant workload increase because of the impact the pandemic had on the program. We recommend Department management: ? Evaluate and strengthen current internal control procedures over the Unemployment Insurance program to assure claimants are eligible and receive the correct weekly benefits. This should include evaluating the cause of the errors identified above and updating controls as necessary. ? Periodically monitor the established controls to determine if they are working effectively and as intended. ? Perform periodic reviews of the claimant files to reasonably ensure the information is properly maintained and accurately entered into the related systems. ? Evaluate overpayments and/or payments to ineligible claimants and offset future benefits or seek reimbursement, where necessary.

SNAP CLUSTER ? INELIGIBLE RECIPIENT Finding Number: 2022-011 State Agency Number: JFS-03 Assistance Listing Number and Title: 10.551/10.561 ? SNAP Cluster Federal Award Identification Number / Year: 202OH102S2514 / 2020 202OH102S6018 / 2020 212OH102S2514 / 2021 212OH102S6018 / 2021 222OH102S2514 / 2022 222OH102S6018 / 2022 Federal Agency: Department of Agriculture Compliance Requirement: Eligibility Repeat Finding from Prior Audit? No QUESTIONED COSTS 7 C.F.R. ?272.10(b)(1)(i), pertaining to the Supplemental Nutrition Assistance Program (SNAP) Cluster, states in part, that a State?s system should: Determine eligibility and calculate benefits or validate the eligibility worker?s calculations by processing and storing all casefile information necessary for the eligibility determination and benefit computation (including but not limited to all household members? names, addresses, dates of birth, social security numbers, individual household members? earned and unearned income by source, deductions, resources and household size) ? Ohio Admin. Code (OAC) 5101:4-4-31(H) states: . . . When should actual income be used instead of converted income? When a full month's income is anticipated and income is received on a weekly or biweekly basis, the county agency shall determine monthly income by multiplying weekly amounts by 4.3 and biweekly amounts by 2.15. In one-month certifications, income on less than a monthly basis may be computed by using the actual income that is to be received. When income that was received on a weekly or biweekly basis has stopped, actual income (not converted) is used. As the lead agency responsible for administering the SNAP Cluster federal program for the State of Ohio, the Department is responsible for overall program compliance which includes ensuring only eligible individuals receive assistance and documentation maintained to support eligibility determinations is accurate, complete, and properly recorded in the Ohio Benefits (OB) system. It is the Department?s responsibility to implement sufficient controls, systems, processes, and procedures to reasonably ensure compliance with the SNAP Cluster rules and regulations and only eligible recipients receive benefits. It is also the Department's responsibility to have appropriate oversight and monitoring procedures in place to ensure these controls, systems, processes and procedures are operating as intended and to comply with program guidelines and requirements. During state fiscal year 2022, the Department disbursed approximately $4.5 billion in federal assistance to eligible recipients from the SNAP Cluster program based on information provided by the 88 County Departments of Job and Family Services (CDJFS). The CDJFS caseworkers are responsible for obtaining the required eligibility information and entering it into OB in order for the application to be processed and the eligibility determination to be made. However, for one of 60 (1.67%) SNAP Cluster case files selected for testing at 10 CDJFS, totaling $592, the CDJFS (Montgomery) did not properly enter the income frequency into OB based on supporting documentation provided by the recipient. The caseworker entered the income frequency as `one-time?; however, it should have been `bi-weekly?. Therefore, the income was not converted correctly in accordance with OAC 5101:4-4-31 which resulted in an understatement of income and overcalculation of benefits. As such, we will question all benefits issued to the recipient totaling $3,629 (projected to an amount greater than $25,000). By not properly entering correct recipient income information into OB, inaccurate eligibility determinations could be made or recipient benefit issuance amounts could be miscalculated. If the Department does not consistently review the required documentation on file and in OB, the Department may not be able to fully support or ensure payments were made only to, or on behalf of, eligible recipients, and that the Department complied with all federal rules and regulations. This could result in additional questioned costs, a reduction in federal funding, or sanctions imposed by the federal grantor agency. Based on discussions with Department and CDJFS management, the information not accurately entered into OB was due to oversight by the caseworker. We recommend the Department review existing controls and/or update policies and procedures at both the State and CDJFS to ensure the recipient information in OB is accurate. These procedures should include periodic reviews of the case files to reasonably ensure the applicant/eligibility information is accurately entered into the system. The Department should communicate to CDJFS management and staff the importance of these policies and procedures and implement or update existing monitoring controls to ensure these procedures are carried out as intended. Lastly, the Department should investigate the recipient specifically identified in this finding to ensure any necessary repayments are made or additional actions are taken.

UNEMPLOYMENT INSURANCE ? FRAUD ISSUES AND OVERPAYMENTS Finding Number: 2022-012 State Agency Number: JFS-04 Assistance Listing Number and Title: 17.225 ? Unemployment Insurance 17.225 COVID-19 ? Unemployment Insurance Federal Award Identification Number / Year: UI-34078-20-55-A-39 / 2020 UI-35668-21-55-A-39 / 2021 UI-37243-22-55-A-39 / 2022 Federal Agency: Department of Labor Compliance Requirement: Special Tests and Provisions ? UI Program Integrity ? Overpayments Repeat Finding from Prior Audit? Yes Prior Audit Finding Number: 2021-012 NONCOMPLIANCE AND MATERIAL WEAKNESS NOTE: Finding numbers 2022-009 and 2022-010 detail questioned costs, noncompliance, and weaknesses in internal control related to the regular and pandemic Unemployment Insurance programs regarding fraud issues and overpayments. These findings are integral to and should be read in conjunction with this finding. The U.S. Department of Labor?s (DOL) Unemployment Program Insurance Letter (UIPL) No. 23-20 provides additional guidance to states regarding program integrity for the regular UI program and for the UI programs authorized by the Coronavirus Aid, Relief, and Economic Security (CARES) Act enacted on March 27, 2020. UIPL 23-20, (4)(b) Program integrity functions for the regular UI programs and CARES Act programs, states, in part: ? The following BPC [Benefit Payment Control] activities are mandatory for states to implement for the regular UI programs on an ongoing basis. States must implement these functions for the Pandemic Emergency Unemployment Compensation (PEUC) and PUA [Pandemic Unemployment Assistance] programs in the same manner as for the regular UI programs. ? National Directory of New Hires Cross-match (UIPL Nos. 13-19 and 19-11). UIPL 13-19 provides detailed, recommended operating procedures for cross-matching with state and national directories of new hire data; ? Quarterly Wage Records Cross-match (20 CFR Section 603.23); and ? Systematic Alien Verification for Entitlement (SAVE) (Section 1137(d) of the Social Security Act (SSA) (42 U.S.C. Section1320b-7). The Department strongly recommends the following additional BPC activities as part of a state?s effective BPC operation for the regular UI programs, PUA and PEUC: ? State Directory of New Hires Cross-match; ? Social Security Administration (SSA) Cross-match; ? Interstate Benefits (IB) Cross-match; ? State Identification Inquiry (SID) and IB8606 enhancements made to the Interstate Connection (ICON) network cross match to prevent concurrent claim filing in multiple states; ? State Information Data Exchange System (SIDES); ? Identity Verification; ? Incarceration Cross-match; and, ? UI Integrity Center?s Integrity Data Hub (IDH) tools including Suspicious Actor Repository (SAR), Suspicious E-Mail Domains, Multi-State Cross-Match (MSCM), Foreign Internet Protocol (IP) Address Detection, and Fraud Alert application. 20 C.F.R. ? 625.14 pertaining to overpayments and disqualifications for fraud states, in part: . . . (h) Fraud Detection and prevention. Provisions in the procedures of each State with respect to detection and prevention of fraudulent overpayments of DUA [Disaster Unemployment Assistance] shall be, as a minimum, commensurate with the procedures adopted by the State with respect to regular compensation and consistent with the Secretary's ?Standard for Fraud and Overpayment Detection,? . . . UIPL No. 2-12, Change 1 provides additional guidance to states regarding program integrity for the regular UI program and amendments made by the Trade Adjustment Assistance Extension Act of 2011 (TAAEA) and states, in part: a. Require states to impose a monetary penalty (an amount not less than 15 percent of the erroneous payment) on claimants whose fraudulent acts resulted in overpayments; b. Prohibit states from providing relief from charges to an employer?s UC [Unemployment Compensation] account when a UC overpayment results from an employer (or an employer?s agent) failing to respond timely or adequately to a request for information by the state agency (i.e., employer or agent at fault), and, at minimum, the employer (or its agent) has established a pattern of failing to respond to such requests; and . . . Ohio Rev. Code ? 4141.35 states, in part: (A) If the director of job and family services finds that any fraudulent misrepresentation has been made by an applicant for or a recipient of benefits with the object of obtaining benefits to which the applicant or recipient was not entitled, and in addition to any other penalty or forfeiture under this chapter, then the director: (1) Shall within four years after the end of the benefit year in which the fraudulent misrepresentation was made reject or cancel such person's entire weekly claim for benefits that was fraudulently claimed, or the person's entire benefit rights if the misrepresentation was in connection with the filing of the claimant's application for determination of benefit rights; (2) Shall by order declare that, for each application for benefit rights and for each weekly claim canceled, such person shall be ineligible for two otherwise valid weekly claims for benefits, claimed within six years subsequent to the discovery of such misrepresentation; (3) By order shall require that the total amount of benefits rejected or canceled under division (A)(1) of this section be repaid to the director before such person may become eligible for further benefits, and shall withhold such unpaid sums from future benefit payments accruing and otherwise payable to such claimant. . . . (B) If the director finds that an applicant for benefits has been credited with a waiting period or paid benefits to which the applicant was not entitled for reasons other than fraudulent misrepresentation, the director shall: (1)(a) Within six months after the determination under which the claimant was credited with that waiting period or paid benefits becomes final pursuant to section 4141.28 of the Revised Code, or within three years after the end of the benefit year in which such benefits were claimed, whichever is later, by order cancel such waiting period and require that such benefits be repaid to the director or be withheld from any benefits to which such applicant is or may become entitled before any additional benefits are paid, provided that the repayment or withholding shall not be required where the overpayment is the result of the director's correcting a prior decision due to a typographical or clerical error in the director's prior decision, or an error in an employer's report under division (G) of section 4141.28 of the Revised Code. . . . Any overpayments made to the individual that have not previously been recovered under an unemployment benefit program of the United States may be recovered in accordance with section 303(g) of the "Social Security Act" and sections 3304(a)(4) and 3306(f) of the "Federal Unemployment Tax Act," 53 Stat. 183 (1939), 26 U.S.C.A. 3301 to 3311. . . . Ohio Rev. Code ? 131.02(A) states, in part: . . . if the amount is not paid within forty-five days after payment is due, the officer, employee, or agent shall certify the amount due to the attorney general, in the form and manner prescribed by the attorney general, and notify the director of budget and management thereof. . . . . UIPL No. 20-21 provides States instructions for assessing fraud penalties and processing overpayment waivers under the CARES Act, as amended. States must establish eligibility criteria for PUA, Federal Pandemic Unemployment Compensation (FPUC), Mixed Earners Unemployment Compensation (MEUC), and PEUC. In general, States are permitted to waive repayment if the overpayment identified was not the claimant's fault and the payment would be contrary to equity and good conscience. In addition, UIPL 20-21 states, in part: Application of a minimum 15 percent monetary penalty. Within the context of the CARES Act, states must apply a minimum 15 percent monetary penalty to an individual?s overpayment when the state determines that such an overpayment was made to an individual due to fraud. Fraud includes instances where an individual knowingly has made, or caused to be made by another, a false statement or representation of a material fact, or knowingly has failed, or caused another to fail, to disclose a material fact. This fraud penalty is applicable to PUA, FPUC, MEUC, PEUC, and the first week of regular UC that is reimbursed in accordance with Section 2105 of the CARES Act? States must apply the fraud monetary penalty for FPUC, MEUC, PEUC, and the first week of regular UC that is reimbursed in accordance with Section 2105 of the CARES Act for all fraud overpayments established on or after the date of publication for this UIPL [May 5, 2021]. It is management?s responsibility to design and implement internal control procedures to ensure compliance with UI program requirements outlined in the federal rules, regulations, and guidance, as well as state laws that govern the program. During state fiscal year (SFY) 2022, the Department disbursed approximately $1.69 billion in UI benefits processed through the Ohio Job Insurance (OJI) and uFACTS systems for the regular Unemployment and pandemic Unemployment programs. The OJI and uFACTS systems automatically generate the cross-match reports as required per UIPL No. 23-20; however, due to the COVID-19 pandemic, the Department had a significant backlog of potential overpayment issues during the audit period causing significant delays in processing time. An issue is created when the system cannot determine the impact of the benefit claim or is created based off of cross-matches. Issues suspected of fraud are forwarded to the Department?s Bureau of Payment Control to be investigated and then adjudicated. An Adjudicator reviews information, known as fact-finding, to make a determination on the benefit claim within 21-days per the Department?s Unemployment Compensation Policy Guide which is based on /a CORE Measure established by the DOL related to timeliness of the nonmonetary determinations for States. Once a determination is made, a Determination Notice or Notice of Overpayment is sent to the claimant. Due to the COVID-19 pandemic, the Department experienced a significant increase in the number of weekly unemployment benefit claims issued through the OJI and uFACTS systems (2,982,414 and 2,260,024, respectively during the year) which had a direct impact on the increase of fraud issues detected. The Department adjudicated 18,314 fraudulent claims for OJI and 293,781 fraudulent claims for uFACTS during SFY 2022. However, the process and/or requirements were not consistently followed, as noted below: ? Of the 25 OJI adjudicated fraud issues selected for testing: - 22 (88%) Notice of Determination/Notice of Overpayments were not issued within 21-days. Days late between the issue determination date and the Notice of Determination/Notice of Overpayment, ranged from 10 to 639 days, for an average of 232 days late. Three of these claims also had payments issued for the claim more than 21 days after the issue determination date. - 12 (48%) were not detected/flagged timely (30 days based on auditor?s judgement) from the benefit week ending date. Days late between the benefit week ending date and the date of issue, ranged from four to 487 days, for an average of 215 days late. - Nine (36%) were not sent the fact-finding questionnaire timely (seven days from the issue determination date based on auditor?s judgement). Days late between the issue determination date and the fact-finding ranged from 20 to 494 days, for an average of 158 days late. ? Of the 25 uFACTS adjudicated fraud issues selected for testing: - 16 (64%) Notice of Determination/Notice of Overpayments were not issued within 21-days. Days late between the issue determination date and the Notice of Determination/Notice of Overpayment ranged from 64 to 379 days, for an average of 196 days late. - 14 (56%) were not detected/flagged timely (30 days based on auditor?s judgement) from the benefit week ending date. Days late between the benefit week ending date and the date of issue ranged from 89 to 578 days, for an average of 334 days late. - Two (8%) were not sent the fact-finding questionnaire timely (seven days from the issue determination date based on auditor?s judgment). Days late between the issue determination date and the fact-finding were three and eight days, for an average of six days late. - Two (8%) did not have a stop payment completed timely (seven days from the issue determination date based on auditor's judgment). Days late between the issue determination date and the last paid claim were 180 and 366 days, for an average of 273 days late. Once an issue has been adjudicated, the Department?s Bureau of Payment Control is responsible for determining the claimant?s benefit overpayment and issues a Notice of Overpayment. Overpayments are benefits paid to individuals who are not legally entitled to receive these benefits. Losses through embezzlement or by theft, other than through the benefit payment process, are not counted as overpayments. Overpayments are reported to the DOL in the quarter and/or month in which they occur, which is once adjudication is complete. A fraud overpayment occurs when the material facts related to a determination or payment of a claim are found during the adjudication process to be knowingly misrepresented or concealed (i.e., willful misrepresentation) by the claimant in order to obtain benefits to which the individual is not legally entitled. A non-fraud overpayment occurs when the state agency determines, through adjudication, the overpayment is not due to willful misrepresentations. Non-fraud overpayments result from reversals, state agency errors, employer errors, and claimant errors. The Department reported approximately $598.2 million in fraudulent outstanding overpayments and $2.17 billion in non-fraudulent outstanding overpayments processed through OJI and uFACTS to the DOL as of June 30, 2022. If overpayments are based on fraud, the OJI and uFACTS systems are to automatically include a 15% penalty, as required by UPIL No. 20-21. The Department then notifies the claimant of the monetary penalties, attempts to collect the penalties, and deposits the penalties collected into the State?s Unemployment Trust Fund. Although the Department appropriately assessed a 15% monetary penalty for PUA and FPUC claims processed through uFACTS during SFY 2022, the Department did not assess the 15% monetary penalty for any FPUC overpayments processed through the OJI system. The Department attempts to collect overpayments by sending an appealable overpayment determination to the claimant. If repayment is not received within 45 days after the payment is due, the amount is certified to the Ohio Attorney General for collection pursuant to Ohio Rev. Code ?131.02. The federal government gave discretion to states to waive the need for a repayment of pandemic funding related to non-fraud overpayments, but claimants must request the waiver from the Department to avoid repayment. During SFY 2022, the Department processed 111,697 overpayment waiver requests and waived repayment of approximately $172.6 million based on approved claimant requests or other waivers. During SFY 2022, the Department certified the fraud and non-fraud overpayments processed through OJI to the Ohio Attorney General for collection; however, the Department only certified 1,000 overpayments processed through uFACTS, totaling $59,526, to the Ohio Attorney General for collection based on its manual process. The Department determined the manual process was too labor intensive and stopped certifying uFACTS overpayments to the Ohio Attorney General for collection until an automated process was developed and implemented in October 2022, after the end of the audit period. Additionally, the Department has flagged approximately $1.08 billion in potential overpayments for the regular Unemployment and the pandemic Unemployment programs as of June 30, 2022. Despite being flagged as potential overpayments, a final determination as to whether these are overpayments and/or fraudulent cannot be made until these claims are fully adjudicated. Without proper controls to ensure the timely identification of fraud issues and the adjudication of fraudulent and non-fraudulent issues and overpayment determinations (if applicable), the Department increases the risk of inaccurate or incomplete financial and/or programmatic activity being reported to the federal grantor agency. Furthermore, the Department is limiting the amount of funding available for program activities by not certifying and pursuing collection of the Unemployment benefit overpayments for the pandemic Unemployment programs, as well as by not properly assessing the monetary penalty to fraudulent FPUC claims processed through OJI. Based on discussions with management, these errors are due to the amount of time and effort necessary to adjudicate fraud and process the high volume of backlog of claims and potential overpayments, time necessary to implement system improvements, and oversight. We recommend the Department continue to evaluate, strengthen, and monitor internal controls and procedures related to UI fraud and overpayments to ensure they are working as management intended, including, but not limited to: ? Periodic management reviews of the cross-match documentation to ensure the matches are being performed timely and as intended. If the information necessary to complete the cross-matches is obtained from an outside party, the Department should work with the entity to ensure the information is obtained timely. Additionally, the Department should continue to prioritize issues based on the aging of issues created by the cross-matches, monitor the issue backlog, ensure issues are being addressed timely, and the Notices of Determination are issued in a timely manner. ? Periodic management reviews over the timing of the fact-finding questionnaires generated by the OJI and/or uFACTS systems once an issue has been created. ? Periodic management reviews over the certification of OJI and uFACTS overpayments to the Ohio Attorney General and subsequent collections. ? System enhancements within OJI to ensure the monetary fraud overpayment penalty amounts are being applied to each applicable overpayment. Management should monitor the system enhancements to ensure they are being captured, properly applied, and appropriately collected.

SNAP CLUSTER AND TANF ? IEVS ALERTS Finding Number: 2022-013 State Agency Number: JFS-05 Assistance Listing Numbers and Titles: 10.551/10.561 ? SNAP Cluster 93.558 ? Temporary Assistance for Needy Families (TANF) Federal Award Identification Number / Year: 202OH102S2514 / 2020 (SNAP Cluster) 202OH102S6018 / 2020 (SNAP Cluster) 212OH102S2514 / 2021 (SNAP Cluster) 212OH102S6018 / 2021 (SNAP Cluster) 222OH102S2514 / 2022 (SNAP Cluster) 222OH102S6018 / 2022 (SNAP Cluster) 2001OHTANF / 2020 (TANF) 2101OHTANF / 2021 (TANF) 2201OHTANF / 2022 (TANF) Federal Agencies: Department of Agriculture Department of Health and Human Services Compliance Requirements: Eligibility, Special Tests and Provisions ? Income Eligibility Verification System Repeat Finding from Prior Audit? Yes Prior Audit Finding Number: 2021-013 NONCOMPLIANCE AND MATERIAL WEAKNESS NOTE: Finding numbers 2022-001, and 2022-017 contain additional information which is integral to and should be read in conjunction with this finding. 7 C.F.R. ? 272.8(c), states the following regarding the Supplemental Nutrition Assistance Program (SNAP) Cluster: (1) State agency action on information items about recipient households shall include: (i) Review of the information and comparison of it to case record information; (ii) For all new or previously unverified information received, contact with the households and/or collateral contacts to resolve discrepancies as specified in ???273.2(f)(4)(iv) and 273.2 (f)(9)(iii) and (f)(9)(iv); and (iii) If discrepancies warrant reducing benefits or terminating eligibility, notices of adverse action. (2) State agencies must initiate and pursue the actions on recipient households specified in paragraph (c)(1) of this section so that the actions are completed within 45 days of receipt of the information items. Actions may be completed later than 45 days from the receipt of information if: (A) The only reason that the actions cannot be completed is the nonreceipt of verification requested from collateral contacts; and (B) The actions are completed as specified in ? 273.12 of this chapter when verification from a collateral contact is received or in conjunction with the next case action when such verification is not received, whichever is earlier. (3) When the actions specified in paragraph (c)(1) of this section substantiate an over issuance, State agencies must establish and take actions on claims as specified in ??273.18 of this chapter. (4) State agencies must use appropriate procedures to monitor the timeliness requirements in paragraph (c)(2) of this section. 45 C.F.R. ? 205.56(a)(1)(iv) states the following regarding the Temporary Assistance for Needy Families (TANF) program: For individuals who are recipients when the information is received or for whom a decision could not be made prior to authorization of benefits, the State agency shall within forty-five (45) days of its receipt, initiate a notice of case action or an entry in the case record that no case action is necessary, except that: Completion of action may be delayed beyond forty-five (45) days on no more than twenty (20) percent of the information items targeted for follow-up, if: (A) The reason that the action cannot be completed within forty-five (45) days is the nonreceipt of requested third-party verification; and (B) Action is completed promptly, when third party verification is received or at the next time eligibility is redetermined, whichever is earlier. If action is completed when eligibility is redetermined and third party verification has not been received, the State agency shall make its decision based on information provided by the recipient and any other information in its possession. It is management?s responsibility to implement controls, processes, and procedures to ensure compliance with these regulations. When automated systems are utilized to perform certain functions related to this compliance, management must ensure the system is properly designed and operating effectively. The Ohio Benefits system is utilized for processing eligibility for the SNAP Cluster and TANF programs with total expenditures to recipients of approximately $4.5 billion and $204 million, respectively, in state fiscal year (SFY) 2022. The Ohio Benefits system, administered by the Ohio Department of Administrative Services (DAS) for various public assistance programs, includes an Income Eligibility Verification System (IEVS) which compares income, as reported by the recipients, to information maintained by outside sources. Information that does not agree is communicated in the form of an Ohio Benefits system alert, which is forwarded to the appropriate county for investigation and resolution. Each alert has a defined due date, which is unique based on the priority level and other policy and process related factors. During SFY 2022, more than 15.5 million alerts were issued (3.4 million IEVS alerts and 12.1 million non-IEVS alerts) for all public assistance programs that utilize Ohio Benefits, including the SNAP Cluster and TANF programs. Alerts can be generated by Ohio Benefits via interface outputs/updates, batch outputs or other triggers within the system. Ongoing enhancements to the Ohio Benefits alerts process were made in coordination with personnel from the Department, the Ohio Department of Medicaid, and DAS throughout the audit period. These enhancements addressed design weaknesses to work on solutions for filtering duplicate alerts, including those across multiple programs. However, the volume of incoming Internal Revenue Service (IRS) alerts issued remained slightly higher: these alerts affect a change in recipient income and could possibly have an impact on eligibility or the benefit amount. These design weaknesses created a large volume of information being sent to the counties, resulting in an increased workload and ineffective application of the alert process. In addition, the Department conducts Fraud Triad Reviews, which in part, includes a review of 1) IEVS processing timeliness, 2) proper verifications, 3) proper disposition coding and 4) random supervisory reviews. County agencies who fall short in their IEVS processing, such as no verifications or incorrect compliance coding, are required to take corrective action which is monitored by the Department?s Fraud Control Section. County supervisors are instructed to conduct random reviews of the cases with an IEVS alert to ensure verifications are obtained and disposition codes are correct and monitor the JFSR 4005, IEVS Monthly Summary Report to track the completion of IEVS alerts. Also, the JFSR 4005, IEVS Monthly Summary Report, continues to be monitored by the Department?s Fraud Control staff to better recognize those county agencies who require additional training and technical assistance; however, no evidence is documented or maintained. The Department also continues to conduct statewide trainings and individual trainings for counties to assist them in working IEVS alerts; however, system enhancements have not fully addressed the issue of excessive alerts. Additionally, these trainings are typically optional and/or attended by a representative of the county who is expected to relay the information to others. Therefore, the Department did not have effective controls or procedures in place to review and monitor the IEVS alerts generated and processed by the Ohio Benefits system to ensure they were being completed by the counties in accordance with the requirements and timeframes established in 7 C.F.R. ? 272.8, and 45 C.F.R. ? 205.56. Furthermore, an Ohio Benefits report showed 349,020 of the 556,539 (63%) IEVS alerts sent to the counties during the audit period were not cleared within 45 days as required. The alerts were cleared between one and 416 days beyond the 45-day requirement, for an average of 189 days late. Failure to correct system design weaknesses, perform monitoring activities, mandate training for county caseworkers, and complete IEVS alerts within the established timeframes increases the risk benefits given to ineligible recipients or for inappropriate amounts will not be identified timely. This condition could adversely affect the Department?s ability to comply with IEVS requirements for these federal programs which could result in federal sanctions or penalties. Based on discussions with management, the Ohio Benefits filtering logic was not working as intended upon receipt of the interface file from the IRS creating duplicate alerts; therefore, sending a high volume of alerts to county caseworkers. In addition to staffing issues at the counties, this high volume of alerts created an unmanageable number of alerts to be worked timely. Throughout the audit period, several enhancements were made to the Ohio Benefits system that continue to reduce the number of alerts sent to county caseworkers. Management indicated they continue to monitor the system and enhancements to ensure they meet the desired impact, as well as reach out to county and state personnel to offer technical assistance. While training is offered and made available to county personnel, management indicated the Department?s county administered approach creates challenges to making training mandatory. We recommend Department management continue to work collectively with the related state agencies to implement/update robust processes, procedures, and system controls to address the weaknesses associated with the IEVS process within the Ohio Benefits system. These changes/updates should include, but not be limited to: ? Continuing to perform periodic and timely reviews at the Department level to monitor the status and completion of IEVS alerts; these reviews should be evidenced and documented. Such procedures should also include required monitoring by each County IEVS Coordinator or other supervisory personnel (through the eligibility system), which should be explicitly identified in the sub-grant agreements with the counties and include appropriate ramifications for noncompliance with the stated requirements. ? Including a more centralized evaluation of alert activity and/or better use of automated tools to vet and prioritize items requiring follow-up at the county level. This would allow Department level personnel to become more experienced and adept at identifying and investigating anomalies and help focus the resources of both Department and county personnel. ? Continuing to monitor the IEVS alert processing procedures guide for the alerts issued by the Ohio Benefits system to ensure alerts are properly documented within the system, worked within the proper timeframes, and proper verification documentation is obtained and maintained by the counties for resolved alerts. ? Identifying and coordinating Ohio Benefits program changes to address the system design weaknesses identified above. This should include working collaboratively with DAS to prioritize program changes which could directly impact the eligibility determinations or benefit amounts to ensure they are corrected in a timely manner to prevent and detect further improper payments. In addition, the Department should evaluate these enhancements to assist DAS in determining if the desired outcome was achieved. ? Continuing to conduct and evaluate statewide and individual IEVS training for county caseworkers to ensure they have the knowledge to properly document and resolve IEVS alerts generated by the Ohio Benefits system. These trainings should be mandatory for all county personnel involved in the alerts process. We also recommend Department management continue to monitor the status of system enhancements and roll-out of resources to the appropriate personnel to ensure they are implemented timely and as planned.

WIOA CLUSTER AND FOSTER CARE ? FEDERAL REPORTING Finding Number: 2022-014 State Agency Number: JFS-06 Assistance Listing Number and Title: 17.258/17.259/17.278 ? WIOA Cluster 93.568 ? Foster Care Title IV-E Federal Award Identification Number / Year: AA36339DQ0 / 2021 (WIOA Cluster) 2101OHFOST / 2021 (Foster Care) Federal Agencies: Department of Labor Department of Health and Human Services Compliance Requirement: Reporting Repeat Finding from Prior Audit? No NONCOMPLIANCE AND MATERIAL WEAKNESS 45 C.F.R. ? 75.302 contains the Department of Health and Human Services uniform administrative requirements for grants to state and local governments relating to financial administration and standards for financial management systems. Specifically, 45 C.F.R. ? 75.302 states, in part: (a) Each state must expend and account for the Federal award in accordance with state laws and procedures for expending and accounting for the state?s own funds. In addition, the state?s and the other non-Federal entity?s financial management systems, including records documenting compliance with Federal statutes, regulations, and the terms and conditions of the Federal award, must be sufficient to permit the preparation of reports required by general and program-specific terms and conditions; and the tracing of funds to a level of expenditures adequate to establish that such funds have been used according to the Federal statutes, regulations, and the terms and conditions of the Federal award. (b) The financial management system of each non-Federal entity must provide for the following (see also Sections 75.361, .362, .363, .364, and .365): . . . (2) Accurate, current, and complete disclosure of the financial results of each Federal award or program in accordance with the reporting requirements set forth in Section 75.341 and .342? (3) Records that identify adequately the source and application of funds for federally-funded activities. These records must contain information pertaining to Federal awards, authorizations, obligations, unobligated balances, assets, expenditures, income and interest and be supported by source documentation. . . . The Department of Labor implemented similar uniform administrative requirements in 29 C.F.R. ? 97.20 which states, in part: (a) A State must expand and account for grant funds in accordance with State laws and procedures for expending and accounting for its own funds. Fiscal control and accounting procedures of the State, as well as its subgrantees and cost-type contractors, must be sufficient to - (1) Permit preparation of reports required by this part and the statutes authorizing the grant, and (2) Permit the tracing of funds to a level of expenditures adequate to establish that such funds have not been used in violation of the restrictions and prohibitions of applicable statutes. (b) The financial management systems of other grantees and sub grantees must meet the following standards: (1) Financial reporting. Accurate, current, and complete disclosure of the financial results of financially assisted activities must be made in accordance with the financial reporting requirements of the grant or subgrant. (2) Accounting records. Grantees and sub grantees must maintain records which adequately identify the source and application of funds provided for financially-assisted activities. These records must contain information pertaining to grant or subgrant awards and authorizations, obligations, unobligated balances, assets, liabilities, outlays or expenditures, and income. . . . It is management?s responsibility to implement control policies and procedures to reasonably ensure the federal reports they submit are accurate, complete, and in compliance with program requirements. It is imperative that management be able to provide the underlying data and related program documentation required to prepare and support these reports. The Department?s Bureau of Grants Management and Federal Reporting Services (the Bureau) is responsible for the preparation of various federal financial expenditure reports, including the quarterly Foster Care CB-496 and quarterly WIOA Cluster ETA-9130 reports. The Bureau runs reports from various computer systems, transfers this information to the applicable federal reports, and submits them for a two-level review process prior to submitting them to the federal grantor agency. However, the Bureau?s review of federal reports was not adequate and/or operating effectively. As a result, the following errors were identified in the reports tested during state fiscal year 2022: ? For one of two (50%) quarterly Foster Care CB-496 reports selected for testing (quarter ending September 30, 2021): o The Bureau overstated Line 10a - Current Quarter Claims, Title IV-E Foster Care Candidate Administrative Costs - Case Planning and Management by $2,183 and the federal share for the line by $1,091. The Bureau included an amount that was already properly reported in another line. o The Bureau overstated Line 16a - Demonstration Project Costs by $63,500 and the federal share for the line by $31,750. The Bureau improperly reported the total claim amount as the federal share amount. o The Bureau incorrectly reported a decreasing prior quarter adjustment in Line 5 ? In-Placement Administrative Costs ? Case Planning and Management instead of Line 6 ? In-Placement Administrative Costs ? Eligibility Determinations. This caused line 5 to be understated by $171 and the federal share for the line to be understated by $85. As a result, Line 6 was overstated by the same amounts. ? For one of 15 (6.7%) quarterly WIOA Cluster ETA-9130 reports selected for testing (Statewide Rapid Response for quarter ending March 31, 2022): o The Bureau reported Line 10g - Federal Share of Unliquidated Obligations as $59,668; however, supporting documentation showed the amount to be $44,755, for an overstatement of $14,913. A lack of adequate internal controls over federal reporting increases the risk that reports submitted to the federal grantor agency are inaccurate. If the underlying data for the submitted reports cannot be readily verified, the Department and the federal government may not be reasonably assured the information is accurate and complete. Reporting inaccurate or incomplete information could subject the Department to federal sanctions, limiting the amount of funding for program activities. Based on discussions with management, these errors were due to oversight. We recommend the Department evaluate current procedures and implement additional policies and procedures as necessary to provide reasonable assurance the data being reported for all federal programs is reasonable and accurate and agrees to supporting documentation. The Department should ensure all reports (and any necessary corrections to reports) are reviewed and approved by the appropriate level of management.

VARIOUS PROGRAMS ? TRANSPARENCY ACT REPORTING Finding Number: 2022-015 State Agency Number: JFS-07 Assistance Listing Number and Title: 17.258/17.259/17.278 ? WIOA Cluster 93.558 ? Temporary Assistance for Needy Families (TANF) 93.558 COVID-19 ? TANF 93.658 ? Foster Care Title IV-E (FC) 93.659 ? Adoption Assistance (AA) 93.667 ? Social Services Block Grant (SSBG) Federal Award Identification Number / Year: AA363392155A39 / 2021 (WIOA Cluster) 2001OHTANF / 2020 (TANF) 2201OHTANF / 2022 (TANF) 2101OHFOST / 2021 (FC) 2101OHADPT / 2021 (AA) 2101OHSOSR / 2021 (SSBG) 2201OHSOSR / 2022 (SSBG) Federal Agencies: Department of Labor Department of Health and Human Services Compliance Requirement: Reporting Repeat Finding from Prior Audit? Yes Prior Audit Finding Number: 2021-015 NONCOMPLIANCE AND MATERIAL WEAKNESS The Federal Funding Accountability and Transparency Act (Pub. L. No. 109-282, as amended by Section 6202 of Public Law 110-252, hereafter referred as the ?Transparency Act? that are codified in 2 C.F.R. Part 170) requires prime recipients of federal awards who make first-tier subawards to report the subaward on the Federal Funding Accountability and Transparency Subaward Reporting System (FSRS) website maintained by the federal Office of Management and Budget. Under the requirements of 2 C.F.R. Part 170, recipients (i.e., direct recipients) of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more on the FSRS website. Prime recipients must report by the end of the month following the month in which the obligation is made. It is management?s responsibility to design and implement internal controls to reasonably ensure compliance with laws and regulations and to ensure management?s objectives are achieved. During state fiscal year 2022, the Department obligated approximately $475.5 million for 1,038 subawards which exceeded $30,000 and were required to be reported on the FSRS website in accordance with the Transparency Act, under the following major programs. Assistance Listing Number Assistance Listing Title Number of Subawards Amount Obligated 17.258/17.259/17.278 WIOA Cluster 80 $49,733,463 93.558 TANF 529 $291,384,082 93.658 Foster Care-Title IV-E 81 $63,417,735 93.659 Adoption Assistance 59 $11,592,409 93.667 Social Services Block Grant 289 $59,436,738 For county subaward reporting, the Office of County Finance and Technical Assistance coordinated the filing of the reports for the subsidy payments processed through the County Finance Information System Web (CFIS), which makes up approximately 90% of the subaward reporting. The Senior Fiscal Analyst runs a report in Ohio Administrative Knowledge System (OAKS) Business Intelligence (BI) that lists all the grant distributions from the previous month, compares the report to the CFIS system, and then enters the information into the FSRS website. For contracts and state subaward reporting, the Office of Contracts and Acquisitions runs a report from OAKS BI that lists all contracts and acquisitions the Department entered in the prior month. The Senior Financial Analyst then reviews the listing and contacts the various program areas to determine the information to be reported on the FSRS website. Supervisory meetings are held weekly to ensure the accuracy of the information reported. However, the Department?s internal controls were not operating effectively. As a result, the following errors were noted: WIOA Cluster Transactions Tested Subaward not reported Report not timely Subaward amount incorrect Subaward missing key elements 9 0 2 0 0 Dollar Amount of Tested Transactions Subaward not reported Report not timely Subaward amount incorrect Subaward missing key elements $1,642,493 $0 $938,321 $0 $0 TANF Transactions Tested Subaward not reported Report not timely Subaward amount incorrect Subaward missing key elements 25 2 5 3 2 Dollar Amount of Tested Transactions Subaward not reported Report not timely Subaward amount incorrect Subaward missing key elements $18,178,420 $650,000 $11,380,124 $675,000 $650,000 Foster Care ? Title IV-E Transactions Tested Subaward not reported Report not timely Subaward amount incorrect Subaward missing key elements 9 4 7 7 4 Dollar Amount of Tested Transactions Subaward not reported Report not timely Subaward amount incorrect Subaward missing key elements $2,648,572 $2,122,288 $2,608,864 $2,590,413 $2,122,288 Adoption Assistance Transactions Tested Subaward not reported Report not timely Subaward amount incorrect Subaward missing key elements 8 0 1 0 0 Dollar Amount of Tested Transactions Subaward not reported Report not timely Subaward amount incorrect Subaward missing key elements $466,253 $0 $146,489 $0 $0 Social Services Block Grant Transactions Tested Subaward not reported Report not timely Subaward amount incorrect Subaward missing key elements 25 0 4 2 0 Dollar Amount of Tested Transactions Subaward not reported Report not timely Subaward amount incorrect Subaward missing key elements $8,148,426 $0 $431,539 $4,309 $0 A lack of effective internal controls over the preparation and review of reports increases the risk the reports submitted to the federal grantor agency are inaccurate and incomplete. In addition, by not complying with federal Transparency Act reporting requirements, the Department risks federal funding being reduced, taken away, or other sanctions imposed by the federal grantor agency. If the subawards are not reported accurately and timely within FSRS, the risk exists that those using the Transparency Act reports could be relying on inaccurate information. Based on discussions with management, these issues were caused by oversight and information not being compiled timely for submission. We recommend the Department collect and report timely on the FSRS website complete and accurate information regarding subawards for all programs subject to the Transparency Act. We also recommend the Department evaluate its Transparency Act reporting control procedures and update them as necessary to ensure they promote compliance with the Federal regulations, as well as accuracy and completeness of information submitted. Auditor of State Conclusion: The response to this finding included in the State of Ohio Corrective Action Plan indicated they disagreed with the portion of errors related to county subrecipients and required an Auditor of State Conclusion. The County errors identified relate to the Foster Care program (two subawards not reported/reported untimely) and the SSBG and TANF programs (two and three subawards reported untimely, respectively). For the non-reported subawards, per 2 C.F.R. ? 25.300, a recipient may not make a subaward to a subrecipient unless that subrecipient has obtained and provided to the recipient a unique entity identifier. Furthermore, the client did not provide supporting documentation to show the award information was entered into FSRS at a later time. For the late subawards, the submission information contained within FSRS showed the information was not submitted/reported by the client in a timely manner and the client could not provide any additional supporting documentation to validate the reporting information was entered by the established due date. Therefore, the finding will remain as stated above.

TANF ? REPORTING Finding Number: 2022-016 State Agency Number: JFS-08 Assistance Listing Number and Title: 93.558 ? Temporary Assistance for Needy Families (TANF) Federal Award Identification Number / Year: 1901OHTANF / 2019 2001OHTANF / 2020 2101OHTANF / 2021 2201OHTANF / 2022 Federal Agency: Department of Health and Human Services Compliance Requirements: Reporting, Special Tests and Provisions Repeat Finding from Prior Audit? No NONCOMPLIANCE AND MATERIAL WEAKNESS 45 C.F.R. ? 265.3 (b) states, in part: The TANF Data Report consists of four sections. Two sections contain disaggregated data elements and two sections contain aggregated data elements. (1) Disaggregated Data on Families Receiving TANF Assistance?Section one. Each State must file disaggregated information on families receiving TANF assistance. This section specifies identifying and demographic data such as the individual's Social Security Number and information such as the amount of assistance received, educational level, employment status, work participation activities, citizenship status, and earned and unearned income. The data must be provided for both adults and children. ? 45 C.F.R. ? 261.62 states, in part: (a) To ensure accuracy in the reporting of work activities by work-eligible individuals on the TANF Data Report, each State must: . . . (2) Establish and employ procedures for determining how to count and verify reported hours of work; (4) Establish and employ internal controls to ensure compliance with the procedures; and (5) Submit to the Secretary for approval the State's Work Verification Plan ? (b) A State's Work Verification Plan must include the following: . . . (1) For each countable work activity: (i) A description demonstrating how the activity meets the relevant definition at ??261.2; (ii) A description of how the State determines the number of countable hours of participation; and (iii) A description of the documentation it uses to monitor participation and ensure that the actual hours of participation are reported; (3) A description of how the State ensures that, for each work-eligible individual, it: (iii) Accurately reports the hours to the Department; (5) A description of the internal controls that the State has implemented to ensure a consistent measurement of the work participation rates, including the quality assurance processes and sampling specifications it uses to monitor adherence to the established work verification procedures by State staff, local staff, and contractors. . . . It is management?s responsibility to reasonably ensure the federal reports they submit are accurate, complete, and in compliance with program requirements. It is imperative that management be able to provide the underlying data and related documentation required to prepare and support these reports. During the audit period, the Department disbursed approximately $203.7 million in TANF benefits. The Department must meet or exceed its minimum annual work participation rates, as documented, and submitted through the ACF-199 TANF Data Report (TDR). The Department partners with the Ohio Department of Administrative Services (DAS), in coordination with an IT vendor, who is responsible for compiling all information provided from the Ohio Benefits (OB) eligibility system and delivering the TDR to the U.S. Department of Health and Human Services ? Administration for Children and Families (ACF). The OB system has controls in place that ensure all required data elements are completed and that only pre-determined acceptable data can be entered into the data fields. The Work Participation Rate Determination batch uses the OB rules engine to determine whether work eligible individuals active on TANF programs have met their work requirements for the month being processed. Monthly, TANF data (case record information on individuals and families) is extracted from OB and compiled into a TANF Data Universe file. Quarterly, DAS extracts data to complete the TDR using a sample of the TANF Data Universe file and submits the sample data electronically to ACF. Prior to submission of the report, the Department?s TANF Federal Reporting Team reviews the sample data to ensure completeness and accuracy. This is a system analysis process, where program code is reviewed and corrections are implemented. However, for one of 20 (5%) case files selected for testing, incorrect OB logic was applied which added 8 holiday hours to each day the individual worked that month. Without the incorrectly added holiday hours, the case did not have enough hours to meet work participation requirements for the Job Search and Job Readiness Assistance (JS/JR) hours; therefore, the hours should have been reported as Other Work Activities (OWA). The TDR identified 30 hours JS/JR and 5 hours OWA but should have identified 0 hours and 16 hours, respectively. As a result, the JS/JR data line was overstated by 30 hours and the OWA line was understated by 11 hours. If the OB business rules for calculating work participation rates are not working as intended, the Department and the federal government may not be reasonably assured the information is accurate and complete. Reporting inaccurate or incomplete information could subject the Department to sanctions imposed by the federal grantor agency, limiting the amount of funding for program activities. Based on discussions with management, the OB system logic was improperly applying holiday hours to work participation activities due to errors in the coding/business rules. We recommend the Department evaluate current procedures and implement additional policies and procedures as necessary to provide reasonable assurance the data being reported in the TDR is reasonable, accurate, and agrees to supporting documentation. Additionally, we recommend the Department work collaboratively with DAS to: ? Review the data compiling and reporting processes and make any changes or adjustments as necessary. ? Update and/or implement program logic to ensure the calculations for work participation activities when compiling the TDR are in accordance with the federal regulations. ? Evaluate and make any necessary adjustments to the TDR based on this incorrect logic and resubmit to ACF as appropriate.

SNAP CLUSTER AND TANF ? ELIGIBILITY SYSTEM Finding Number: 2022-017 State Agency Number: JFS-09 Assistance Listing Numbers and Titles: 10.551/10.561 ? SNAP Cluster 93.558 ? Temporary Assistance for Needy Families (TANF) Federal Award Identification Number / Year: 202OH102S2514 / 2020 (SNAP Cluster) 202OH102S6018 / 2020 (SNAP Cluster) 212OH102S2514 / 2021 (SNAP Cluster) 212OH102S6018 / 2021 (SNAP Cluster) 222OH102S2514 / 2021 (SNAP Cluster) 222OH102S6018 / 2021 (SNAP Cluster) 1901OHTANF / 2019 (TANF) 2001OHTANF / 2020 (TANF) 2101OHTANF / 2021 (TANF) 2201OHTANF / 2022 (TANF) Federal Agencies: Department of Agriculture Department of Health and Human Services Compliance Requirement: Eligibility Repeat Finding from Prior Audit? Yes Prior Audit Finding Number: 2021-018 MATERIAL WEAKNESS NOTE: Finding numbers 2022-001 and 2022-013 contain additional information which is integral to and should be read in conjunction with this finding. 7 C.F.R. ? 272.10(b)(1)(i), pertaining to the SNAP Cluster, states in part, that a State?s system should: Determine eligibility and calculate benefits or validate the eligibility worker?s calculations by processing and storing all casefile information necessary for the eligibility determination and benefit computation (including but not limited to all household members? names, addresses, dates of birth, social security numbers, individual household members? earned and unearned income by source, deductions, resources and household size) ? 45 C.F.R. ? 206.10(a), pertaining to public assistance programs, including TANF, states in part: ? (8) Each decision regarding eligibility or ineligibility will be supported by facts in the applicant?s or recipient?s case record? ? (12) The State agency shall establish and maintain methods by which it shall be kept currently informed about local agencies' adherence to the State plan provisions and to the State agency's procedural requirements for determining eligibility, and it shall take corrective action when necessary. As the lead agency responsible for administering the SNAP Cluster and TANF federal grant awards for the State of Ohio, the Department is responsible for providing reasonable assurance only eligible individuals receive assistance and documentation maintained is accurate, complete, and properly recorded in the Ohio Benefits system to ensure appropriate eligibility determinations. It is the Department?s responsibility to implement sufficient controls, systems, processes, and procedures to reasonably ensure compliance with the rules and regulations associated with these programs and only eligible recipients receive benefits. The Department is also responsible for overall program compliance and must have appropriate oversight and monitoring procedures in place to ensure those they rely on are operating in accordance with all expectations, guidelines, and requirements related to their tasks. During state fiscal year (SFY) 2022, the Department disbursed a combined total of nearly $4.7 billion in public assistance payments, to recipients processed through the Ohio Benefits system related to the following programs: Assistance Listing Number & Title Benefits Paid # of Recipients * 10.551/10.561 ? SNAP Cluster $ 4,465,389,555 1,502,137 93.558 ? TANF $ 203,674,740 73,104 Combined Total $ 4,669,064,295 1,575,241 * We did not separately identify recipients who could be covered under both programs These programs are administered using a multi-agency approach, as follows: overall compliance and administration of the SNAP Cluster and TANF programs fall under the Department, and programming and administration of the State?s eligibility determination computer system, Ohio Benefits, falls under the Ohio Department of Administrative Services (DAS). The Ohio Benefits system contains the eligibility and benefit information/determinations for these programs, including the Income Eligibility Verification System (IEVS) functionality which compares reported recipient income to income information maintained by outside data sources (Social Security Administration, Internal Revenue Service (IRS), etc.). The Department also utilizes the 88 Ohio counties in the eligibility determination process to work with applicants, receive/enter eligibility documentation into the Ohio Benefits system, and follow up on alerts issued by the system. Currently, individuals applying to receive public assistance benefits complete an application through various methods. The County Departments of Job & Family Services (CDJFS) collect and maintain any documentation provided by the individual either in a paper case file or in the OnBase Enterprise Documentation Management System (EDMS) maintained under contract by DAS and utilized by the Department. After collecting documentation, the county caseworker enters the individual?s information into the Ohio Benefits system which determines the initial eligibility benefit amount and assigns the benefit aid category, where applicable. This process is also used to perform eligibility redeterminations on an annual basis or when prompted through a system alert. Once the determination is made, the Ohio Benefits system uploads the eligibility information to the Department?s payment system for processing. The Ohio Benefits system is designed to issue alerts to county caseworkers for a variety of items which require review, evaluation, follow-up, and a determination about the impact on the related case and/or program benefits. However, we noted the following weaknesses/defects in the eligibility process: ? Alerts ? During SFY 2022, more than 15.5 million alerts were issued related to all public assistance programs that utilize Ohio Benefits, including the SNAP Cluster and TANF programs according to DAS records (3.4 million IEVS alerts and 12.1 million non-IEVS alerts). Ongoing enhancements to the Ohio Benefits alerts process were made in coordination with personnel from the Department, the Ohio Department of Medicaid, and DAS throughout the audit period. These enhancements addressed design weaknesses to work on solutions for filtering duplicate alerts, including those across multiple programs. However, the volume of incoming IRS alerts/matches issued remained high: these alerts affect a change in recipient income and could possibly have an impact on eligibility or the benefit amount. These design weaknesses created a large volume of information being sent to the counties, resulting in an increased workload and ineffective application of the alert process. In addition, the Department conducts Fraud Triad Reviews, which in part, includes a review of 1) IEVS processing timeliness, 2) proper verifications, 3) proper disposition coding and 4) random supervisory reviews. County agencies who fall short in their IEVS processing, such as no verifications or incorrect compliance coding, are required to take corrective action which is monitored by the Department?s Fraud Control Section. County supervisors are instructed to conduct random reviews of the cases with an IEVS alert to ensure verifications are obtained and disposition codes are correct, as well as monitor the JFSR 4005, IEVS Monthly Summary Report to track the completion of IEVS alerts: these random reviews are looked at during the Fraud Triad Reviews. Also, the Department?s Fraud Control staff monitors the JFSR 4005, IEVS Monthly Summary Report to better recognize those county agencies which require additional training and technical assistance; however, no evidence of this monitoring is documented or maintained. ? Caseworker Reliance/Training ? The current process relies heavily on the knowledge and judgement of county caseworkers in the eligibility process. The Department continues to conduct statewide trainings and individual trainings for counties to assist them in working IEVS alerts; however, system enhancements have not fully addressed the issue of excessive alerts. Additionally, these trainings are typically optional and/or attended by a representative of the county who is expected to relay the information to others. We also noted the following weaknesses/issues related to the Ohio Benefits system in Finding Number 2022-001 for DAS. ? Contract and Monitoring ? Although operating protocols were available defining DAS? responsibilities, a signed interagency agreement has not been finalized to define the roles and responsibilities of each agency and naming DAS as the administrator for Ohio Benefits. ? Data Governance ? No data governance structure was in place to ensure reliability over the data for management. Therefore, it was not clear how program objectives were being met/monitored and how program compliance was being achieved. Failure to correct system weaknesses and system alerts creates an increased risk that benefits paid to or on behalf of recipients will be inaccurate or unallowable. This risk is substantially increased if the State?s eligibility determination system, Ohio Benefits, is not designed to properly identify changes to recipient information and generate relevant alerts when those changes could impact a recipient?s eligibility. These weaknesses could allow undue subjective decisions, jeopardize accurate eligibility processing, and/or result in improper payments or federal reimbursements. Overpayments or payments to or on behalf of ineligible recipients may subject the Department to penalties or sanctions which may jeopardize future funding and limit its ability to fulfill program requirements to provide benefits to those in need. Based on discussions with management, the Ohio Benefits filtering logic was not working as intended upon receipt of the interface file from the IRS creating duplicate alerts; therefore, sending a high volume of alerts to county caseworkers. In addition to staffing issues at the counties, this high volume of alerts created an unmanageable number of alerts to be worked timely. Throughout the audit period, several enhancements were made to the Ohio Benefits system that reduced the number of alerts sent to county caseworkers and a solution to reduce the IRS matches/alerts is scheduled for release in April 2023. Management indicated they continue to monitor the system and enhancements to ensure they meet the desired impact, as well as reach out to county and state personnel to offer technical assistance. While training is offered and made available to county personnel, management indicated the Department?s state supervised, county administered approach creates challenges to making training mandatory. We recommend Department management continue to work collectively with the related state agencies to implement/update robust processes, procedures, and system programming to address the weaknesses in the overall eligibility process, including those associated with the Ohio Benefits system. These changes/updates should include, but not be limited to: ? Continuing to redesign the alert process to be more effective and efficient. This could include a more centralized evaluation of alert activity and/or better use of automated tools to analyze and prioritize items requiring follow-up. This would allow Department level personnel to become more experienced and adept at identifying and investigating anomalies and help focus the resources of both Department and county personnel. ? Continuing to perform periodic and timely reviews of the JFSR 4005, IEVS Monthly Summary Report to monitor the status and completion of IEVS alerts; these reviews should be evidenced and documented. The Department should also continue to perform monitoring reviews which should include verification that each County IEVS Coordinator, or other supervisory personnel, is conducting random reviews of the IEVS alerts (through the eligibility system) to determine the appropriate disposition of the alert and that it was worked timely. These random reviews should be explicitly identified in the sub-grant agreements with the counties and include appropriate ramifications for noncompliance with the stated requirements. ? Requiring mandatory training for all CDJFS employees who are entering the assistance group information into Ohio Benefits to help ensure proper and complete information is being collected, entered, and verified prior to an individual?s eligibility determination being made. The Department should continue to provide this training initially to ensure all users are knowledgeable of the process, procedures, and impacts of the work they do. As changes occur to the rules/regulations, system, or process, detailed training should be required of all users on those changes. ? Identifying and coordinating Ohio Benefits program changes to address the system design weaknesses identified above. This should include working collaboratively with DAS to prioritize program changes which could directly impact the eligibility determinations or benefit amounts to ensure they are corrected in a timely manner to prevent and detect further improper payments. In addition, the Department should evaluate these enhancements to assist DAS in determining if the desired outcome was achieved. ? Ensuring interagency agreements are formalized, contain all parties of the agreements, and fully and clearly define the roles, responsibilities, and expectations related to each party, including completion of required risk assessments and evaluations, and any other specific tasks designed to achieve program compliance. ? Implementing a data governance structure designed to ensure data quality and reliability for management, the grantor agencies, and other users of this information. This structure should include data subject experts from each related agency to help ensure quality of data requests before external and internal users place reliance on the data, issues are addressed with a clear escalation path, and accountability and alignment between the related agencies is established.

MEDICAID/CHIP ? ELIGIBILITY Finding Number: 2022-018 State Agency Number: MCD-01 Assistance Listing Numbers and Titles: 93.767 ? Children?s Health Insurance Program (CHIP) 93.767 COVID 19 ? CHIP 93.775/93.777/93.778 ? Medicaid Cluster 93.775/93.777/93.778 COVID 19 ? Medicaid Cluster Federal Award Identification Number / Year: 2105OH5021 / 2021 (CHIP) 2205OH5021 / 2022 (CHIP) 2105OH5MAP / 2021 (Medicaid) 2205OH5MAP / 2022 (Medicaid) Federal Agency: Department of Health and Human Services Compliance Requirements: Activities Allowed or Unallowed, Allowable Costs/Cost Principles, Eligibility Repeat Finding from Prior Audit? Yes Prior Audit Finding Number: 2021-019 QUESTIONED COSTS, NONCOMPLIANCE, AND MATERIAL WEAKNESS NOTE: Finding numbers 2022-001 and 2022-019 contain additional information which is integral to and should be read in conjunction with this finding. 42 C.F.R. ? 435.10, State Plan requirements, pertaining to the Medicaid Cluster states, in part A State plan must--- (a) Provide that the requirements of this part are met; and (b) Specify the groups to whom Medicaid is provided, as specified in subparts B, C, and D of this part, and the conditions of eligibility for individuals in those groups. . . 42 C.F.R. ? 435.914, Case documentation, pertaining to the Medicaid Cluster states, in part: (a) The agency must include in each applicant's case record facts to support the agency's decision on his application. . . 42 C.F.R. ? 433.400, pertaining to continued enrollment during the public health emergency states, in part: . . . (b) Definitions Validly enrolled means that the beneficiary was enrolled in Medicaid based on a determination of eligibility. A beneficiary is not validly enrolled if the agency determines the eligibility was erroneously granted at the most recent determination, redetermination, or renewal of eligibility (if such last determination was completed prior to March 18, 2020) because of agency error or fraud. . . or abuse . . . (c) General Requirements (2) Except as provided in paragraph (d) of this section, for all beneficiaries validly enrolled for benefits . . as of or after March 18, 2020, the state must maintain the beneficiary?s enrollment . . . through the end of the month in which the public health emergency for COVID-19 ends. (i)(A) For beneficiaries whose Medicaid coverage meets the definition of MEC (Minimum Essential Coverage) . . . as of or after March 18, 2020, the state must continue to provide Medicaid coverage that meets the definition of MEC . . . (d) Exceptions (1) . . . a state may terminate a beneficiary?s Medicaid enrollment prior to the first day of the month after the public health emergency for COVID-19 ends in the following circumstances: (i) The beneficiary or beneficiary?s representative requests a voluntary termination of eligibility; (ii) The beneficiary ceases to be a resident of the state; or (iii) The beneficiary dies 42 U.S.C. ? 1397bb (b), pertaining to the Children?s Health Insurance Program (CHIP) states, in part: (1) Eligibility Standards (A) The plan shall include a description of the standards used to determine the eligibility of targeted low-income children for child health assistance under the plan. . . Ohio Admin. Code 5160-26-02.1 states, in part: . . . (B) The Ohio department of Medicaid (ODM) will terminate a member from enrollment in a managed care organization for any of the following reasons: . . . (3) The member dies, in which case MCO enrollment ends on the date of death (C) All of the following apply when enrollment is terminated for any of the reasons set forth in paragraph (B) of this rule: . . . (5) ODM shall recover from the MCO any capitation paid for retroactive enrollment termination occurring as a result of paragraph (B) of this rule. The Medicaid and CHIP State Plan outlines the specific eligibility conditions and standards within Sections 2.2 ? Coverage and Conditions of Eligibility and 2.6 A ? Financial Eligibility, Eligibility Conditions and Requirements for Medicaid and Section 4 ? Eligibility Standards and Methodology for CHIP. During the Public Health Emergency (PHE), the Department issued several Medicaid Eligibility Procedure Letters (MEPLs) to Medicaid personnel, including county caseworkers, on how to address the federal rule changes put into place during the PHE. One such MEPL gave guidance on acceptable and nonacceptable transitions of benefit aid categories to maintain MEC, as described in 42 C.F.R. ? 433.400. It is management?s responsibility to implement policies and procedures to provide reasonable assurance they have complied with these requirements. As the lead agency responsible for administering the CHIP and Medicaid federal grant awards for the State of Ohio, the Department is responsible for providing reasonable assurance only eligible individuals receive assistance and documentation maintained is accurate, complete, and properly recorded in the Ohio Benefits system to ensure appropriate eligibility determinations. It is also the Department?s responsibility to implement sufficient controls, systems, processes, and procedures to reasonably ensure compliance with the rules and regulations associated with these programs and only eligible recipients receive benefits. The Department is responsible for overall program compliance and must have appropriate oversight and monitoring procedures in place to ensure those they rely on are operating in accordance with all expectations, guidelines, and requirements related to their tasks. During state fiscal year (SFY) 2022, the Department disbursed a combined total of $28.5 billion in public assistance payments to recipients processed through the Ohio Benefits system related to the following programs: Assistance Listing Number & Title Benefits Paid # of Recipients* 93.767 - CHIP $667,281,191 222,243 93.7775/93.777/93.778 ? Medicaid Cluster $27,883,701,444 2,965,523 Combined Total $28,550,982,635 3,187,766 *We did not separately identify recipients who could be covered under both programs. These programs are administered using a multi-agency approach, as follows: overall compliance and administration of CHIP and the Medicaid Cluster fall under the Department, and programming and administration of the State?s eligibility determination computer system, Ohio Benefits, falls under the Ohio Department of Administrative Services (DAS). The Ohio Benefits system contains the eligibility and benefit information/determinations for these programs, including the Income Eligibility Verification System (IEVS) functionality which compares reported recipient income to income information maintained by outside data sources (Social Security Administration (SSA), Internal Revenue Services (IRS), etc.). The Department also, through a Memorandum of Understanding with the Ohio Department of Job & Family Services (JFS), utilizes the 88 Ohio counties in the eligibility determination process to work with applicants, receive/enter eligibility documentation into the Ohio Benefits system, and follow up on alerts issued by the system. SYSTEM/CONTROL ISSUES Currently, individuals applying to receive public assistance benefits complete an application through various methods. The County Departments of Job & Family Services (CDJFS) collect and maintain any documentation provided by the individual either in a paper case file or in the OnBase Enterprise Documentation Management System (EDMS) maintained under contract by DAS and utilized by the Department. After collecting documentation, the county caseworker enters the individual?s information into the Ohio Benefits system which determines the initial eligibility benefit amount and assigns the benefit aid category, where applicable. This process is also used to perform eligibility redeterminations on an annual basis or when prompted through a system alert. Once the determination is made, the Ohio Benefits system uploads the eligibility information to the Department?s payment system, Medicaid Information Technology System (MITS), to process the payment. The Ohio Benefits system is designed to issue alerts to county caseworkers for a variety of items which require review, evaluation, follow-up, and a determination about the impact on the related case and/or program benefits. However, we noted the following weaknesses/defects in the eligibility process: ? Alerts ?During SFY 2022, more than 15.5 million alerts were issued related to all public assistance programs that utilize Ohio Benefits, including the CHIP and Medicaid Cluster programs, according to DAS records (3.4 million IEVS alerts and 12.1 million non-IEVS alerts). Ongoing enhancements to the Ohio Benefits alerts process were made in coordination with personnel from the Department, JFS, and DAS throughout the audit period. These enhancements addressed design weaknesses to work on solutions for filtering duplicate alerts, including those across multiple programs. However, the volume of incoming IRS alerts/matches issued remained high: these alerts affect a change in recipient income and could possibly have an impact on eligibility or the benefit amount. These design weaknesses created a large volume of information being sent to the counties, resulting in an increased workload and ineffective application of the alert process. ? Caseworker Reliance/Training - The current process relies heavily on the knowledge and judgement of county caseworkers in the eligibility process. While statewide trainings and individual trainings for counties to assist them in working IEVS alerts continues, system enhancements have not fully addressed the issue of excessive alerts. Additionally, these trainings are typically optional and/or attended by a representative of the county who is expected to relay the information to others. We also noted the following weaknesses/issues related to the Ohio Benefits system in Finding Number 2022-001 for DAS. ? Contract and Monitoring ? Although operating protocols were available defining DAS? responsibilities, a signed interagency agreement has not been finalized to define the roles and responsibilities of each agency and naming DAS as the administrator for Ohio Benefits. ? Data Governance ? No data governance structure was in place to ensure reliability over the data for management. Therefore, it was not clear how program objectives were being met/monitored and how program compliance was being achieved. NONCOMPLIANCE ISSUES The following noncompliance was noted related to eligibility for the Medicaid and CHIP programs, which included questioned costs for Medicaid totaling $34,781 and CHIP totaling $410,211: ? Three of 80 (3.8%) Medicaid recipients and eight of 80 (10%) CHIP recipients selected for testing were not eligible to receive benefits on the date services were performed as they were not validly enrolled beneficiaries based on information in Ohio Benefits, the State?s official eligibility determination system. Therefore, these items will result in questioned costs for all claims paid for services provided for these individuals during the time they were ineligible, totaling $34,781 for Medicaid and $410,211 for CHIP. The items noted included issues such as: o The recipient failed to timely report an increase in income and/or new employment. o The caseworker failed to timely update Ohio Benefits with an increase in income. o U.S. Citizenship was not properly verified. o The recipient was covered by other health insurance. o The recipient was not a resident of Ohio at the time benefits were paid. o Assets were not properly accounted by the caseworker when determining eligibility. ? Three of 80 (3.8%) Medicaid recipients and eight of 80 (10%) CHIP recipients selected for testing were not placed in the correct benefit aid category. All the Medicaid and CHIP recipients were included in the preceding bullet as being deemed ineligible. ADDITIONAL QUESTIONED COSTS: In January 2022, the Auditor of State?s Medicaid Contract Audit (MCA) section released a Public Interest Report regarding Improper Capitation Payments to managed care providers covering SFY 2018 through SFY 2020 for the Medicaid program. The objectives were to identify duplicate payments for recipients, payments for individuals not eligible for managed care due to their incarceration, and payments for recipients in the months following their death. Utilizing the results from the MCA report, we performed additional procedures, specifically focused on duplicate recipient payments and payments made after a recipient?s death, to see if these issues continued during our audit period and if additional payments were made on behalf of these individuals during SFY 2022 from the Medicaid and CHIP programs. We noted the following: ? The Department made 605 payments, totaling $304,610, on behalf of 97 Medicaid recipients where a Social Security Number was associated with multiple recipient IDs within MITS. This amount includes both the allowable payments and the unallowable duplicate payments and represents the entire payment for the recipient, not only the federal share of the payment. We selected 25 of the 97 Medicaid recipients for further testing to determine if the Department took appropriate action to identify and recover the duplicate payments. Five of 25 (20%) Medicaid recipients tested did not appear to include any recovery efforts related to the duplicate payment made on their behalf, totaling $4,082. However, without reviewing the support within each individual case file, we were unable to identify exactly how much was improperly paid. Due to this fact, these errors were not the result of a representative sample of the population, the errors were not projected to the population. As a result, we will question costs for these payments, totaling $4,082 for the Medicaid program. ? Per Ohio Admin. Code ? 5160-26-02.1, the Department will terminate a member?s enrollment in manage care upon the date of death. The Department shall recover from the Managed Care Organization any capitation payments paid for retroactive enrollment termination. The Department can become aware of a recipient?s death through various means. The managed care provider agreement requires the Managed Care Organization to notify the Department when it becomes aware of a recipient?s death. The recipient?s death may also be reported to the County caseworkers by a family member, other adults on the same case, caregivers, or facilities. The Ohio Benefits system is designed to generate alerts to notify the County caseworkers of a deceased match. The Department has 10 calendar days to process a re-determination when a change has been reported that could affect a recipient?s ongoing eligibility. When the Department has been notified of a potential death of a recipient, the recipient is to be removed from managed care and placed in fee for service until confirmation of the death is received. The Department made 651 payments, totaling $617,207, on behalf of 88 deceased individuals receiving Medicaid benefits. We selected 25 of the 88 deceased individuals for further testing to determine if the Department took appropriate action to identify and recover the payments. Nine of 25 (36%) Medicaid recipients tested had an unallowable capitation payment made on behalf of these deceased individuals which was not recovered by the Department, resulting in questioned costs, totaling $142,445. We also noted the following regarding these nine recipients: o Capitation payments were made on behalf of eight recipients for all 12 months of the audit period. o The caseworker obtained the necessary verification for one recipient?s death and ran the Eligibility Determination Benefit Calculator in May 2020 to discontinue Medicaid benefits. However, capitation payments were made on behalf of this recipient for six months of the audit period. o The system indicated caseworkers sent death inquiries to family members, caretakers, and/or facilities in December 2021 to verify the date of death for five recipients (date of deaths ranged from November 2018 ? April 2020). However, no responses were received, and no further follow-up actions were taken. o The Department started the recoupment process for one of the recipients; the questioned costs above include only the outstanding amount. The items noted above under Noncompliance and Additional Questioned Costs resulted in questioned costs for both the Medicaid Cluster and CHIP, as summarized in the table below: Summary of Questioned Costs by Category Medicaid Cluster CHIP Ineligible Recipients $34,781 $410,211 Duplicate Managed Care Payments 4,082 0 Managed Care Payments for Deceased Individuals 142,445 0 Total Questioned Costs: $181,308 $410,211 Without proper controls for entering, processing, and maintaining recipient information and correcting system alerts and weaknesses, there is an increased risk that benefits paid to or on behalf of recipients will be inaccurate or unallowable. This risk is substantially increased if the State?s eligibility determination system, Ohio Benefits, is not designed to properly identify changes to recipient information and generate relevant alerts when those changes could impact a recipient?s eligibility. These weaknesses could allow undue subjective decisions, jeopardize accurate eligibility processing, and/or result in improper payments or federal reimbursements. Overpayments or payments to or on behalf of ineligible recipients may subject the Department to penalties or sanctions which may jeopardize future funding and limit its ability to fulfill program requirements to provide benefits to those in need. Based on discussions with management, oversight and systemic issues led to the issues identified. Additionally, the Ohio Benefits filtering logic was not working as intended upon receipt of the interface file from the IRS creating duplicate alerts; therefore, sending a high volume of alerts to county caseworkers. In addition to staffing issues at the counties, this high volume of alerts created an unmanageable number of alerts to be worked timely. Throughout the audit period, several enhancements were made to the Ohio Benefits system that reduced the number of alerts sent to county caseworkers and a solution to reduce the IRS matches/alerts is scheduled for release in April 2023. RECOMMENDATIONS We recommend the Department evaluate and seek reimbursement for all claims that were incorrectly paid. We also recommend management continue to work collectively with the related state agencies to implement/update robust processes, procedures, and system programming to address the weaknesses in the overall eligibility process, including those associated with the Ohio Benefits system. These changes/updates should include, but not be limited to: ? Continuing to redesign the alert process to be more effective and efficient. This could include a more centralized evaluation of alert activity and/or better use of automated tools to vet and prioritize items requiring follow-up. This would allow Department level personnel to become more experienced and adept at identifying and investigating anomalies and help focus the resources of both Department and county personnel. ? Requiring mandatory training for all CDJFS employees who are entering the assistance group information into Ohio Benefits to help ensure proper and complete information is being collected, entered, and verified prior to an individual?s eligibility determination being made. This training should continue to be provided initially to ensure all users are knowledgeable of the process, procedures, and impacts of the work they do. As changes occur to the rules/regulations, system, or process, detailed training should be required of all users on those changes. ? Regularly evaluating selected benefit payments for all programs to verify the recipient?s eligibility, verify the recipient information entered into Ohio Benefits by the CDJFS is accurate and the information is being maintained to support the State?s eligibility decision, and ensure initial eligibility determinations and redeterminations are completed timely. Any problems noted should be promptly corrected to reduce the risk of benefit payments being made to or on behalf of ineligible individuals and additional training provided to the State and/or county employees affected. ? Identifying and coordinating Ohio Benefits program changes to address the system design weaknesses identified above. This should include working collaboratively with DAS to prioritize program changes which could directly impact the eligibility determinations or benefit amounts to ensure they are corrected in a timely manner to prevent and detect further improper payments. In addition, the Department should evaluate these enhancements to assist DAS in determining if the desired outcome was achieved. ? Ensuring interagency agreements are formalized, contain all parties of the agreements, and fully and clearly define the roles, responsibilities, and expectations related to each party, including completion of required risk assessments and evaluations, and any other specific tasks designed to achieve program compliance. ? Implementing a data governance structure designed to ensure data quality and reliability for management, the grantor agencies, and other users of this information. This structure should include data subject experts from each related agency to help ensure quality of data requests before external and internal users rely on the data, issues are addressed with a clear escalation path, and accountability and alignment between the related agencies is established. ? Evaluating current processes for identifying duplicate recipient IDs and deceased individuals and updating Ohio Benefits and MITS in a timely manner. Controls should be implemented to ensure caseworkers are following up on the Social Security Administration, Ohio Department of Health, or other death indicators in a timely manner. This should include developing a process for confirming an individual?s death if the family member, caretaker, or facility is not responding to the caseworkers and ensuring the recipient is disenrolled from the managed care plan and converted to fee for services until date of death is confirmed.

MEDICAID/CHIP ? IEVS ALERTS Finding Number: 2022-019 State Agency Number: MCD-02 Assistance Listing Numbers and Titles: 93.767 ? Children?s Health Insurance Program (CHIP) 93.767 COVID-19 ? CHIP 93.775/93.777/93.778 ? Medicaid Cluster 93.775/93.777/93.778 COVID-19 ? Medicaid Cluster Federal Award Identification Number / Year: 2105OH5021 / 2021 (CHIP) 2205OH5021 / 2022 (CHIP) 2105OH5MAP / 2021 (Medicaid) 2205OH5MAP / 2022 (Medicaid) Federal Agency: Department of Health and Human Services Compliance Requirement: Eligibility Repeat Finding from Prior Audit? Yes Prior Audit Finding Number: 2021-020 NONCOMPLIANCE AND MATERIAL WEAKNESS NOTE: Finding numbers 2022-001 and 2022-018 contain additional information which is integral to and should be read in conjunction with this finding. 42 C.F.R. ? 435.945 states, in part, the following regarding the Medicaid Cluster program: (a) Except where the law requires other procedures . . . the agency may accept attestation of information needed to determine the eligibility of an individual for Medicaid . . . without requiring further information (including documentation) from the individual. (b) The agency must request and use information relevant to verifying an individual's eligibility for Medicaid in accordance with ? 435.948 through 435.956 . . . 42 C.F.R. ? 457.380, states, in part, the following regarding the Children?s Health Insurance Program (CHIP): (a) General requirements. Except where law requires other procedures . . . the State may accept attestation of information needed to determine the eligibility of an individual for CHIP. . . without requiring further information (including documentation) from the individual. (b) Status as a citizen, national or a non-citizen. (1) Except for newborns identified in ? 435.406(a)(1)(iii)(E) of this chapter, who are exempt from any requirement to verify citizenship, the agency must? . . . (ii) Provide a reasonable opportunity period to verify such status in accordance with ? 435.956(a)(5) and (b) of this chapter and provide benefits during such reasonable opportunity period to individuals determined to be otherwise eligible for CHIP. Furthermore, 42 U.S.C. ? 1320b?7(a) Requirements of State eligibility systems states, in part: In order to meet the requirements of this section, a State must have in effect an income and eligibility verification system which meets the requirements of subsection (d) and under which? (1) the State shall require, as a condition of eligibility for benefits under any program listed in subsection (b), that each applicant for or recipient of benefits under that program furnish to the State his social security account number (or numbers, if he has more than one such number), and the State shall utilize such account numbers in the administration of that program so as to enable the association of the records pertaining to the applicant or recipient with his account number; (2) wage information from agencies administering State unemployment compensation laws available pursuant to section 3304(a)(16) of the Internal Revenue Code of 1986, wage information reported pursuant to paragraph (3) of this subsection, and wage, income, and other information from the Social Security Administration and the Internal Revenue Service available pursuant to section 6103(l)(7) of such Code, shall be requested and utilized to the extent that such information may be useful in verifying eligibility for, and the amount of, benefits available under any program listed in subsection (b), as determined by the Secretary of Health and Human Services . . . . . . (4) the State agencies administering the programs . . . adhere to standardized formats and procedures . . . under which ? (A) the agencies will exchange with each other information in their possession which may be of use in establishing or verifying eligibility or benefit amounts under any other such program . . . (C) the use of such information shall be targeted to those uses which are most likely to be productive in identifying and preventing ineligibility and incorrect payments. . . In order to comply with 42 C.F.R. ? 435.945 and 42 U.S.C. ? 1320b-7, the State of Ohio codified specific rules related to its Income Eligibility Verification System (IEVS) in the Ohio Administrative Code. Ohio Admin. Code 5160:1-1-04 states, in part: (A) This rule describes the requirements in section 1137 of the Social Security Act and in section 42 C.F.R. 435.945. . ., requiring state agencies administering certain federally funded, state administered public assistance programs, to establish procedures for obtaining, using and verifying information relevant to determinations of eligibility. The Ohio department of medicaid shall obtain and share income and benefit information with the following sources: (1) The social security administration (SSA). (2) The internal revenue service (IRS). (3) The state wage information collection agency (SWICA). (4) The agencies administering the State unemployment compensation (UC) laws. . . . (C) Administrative agency responsibilities. Within forty-five days of receipt of the information, the administrative agency shall initiate, pursue, and complete the actions specified. . .: . . . (3) Review and compare against the case record all information received from the IEVS data matches to determine whether the information affects the individual's eligibility, in accordance with 42 C.F.R. 435.948. (4) Obtain additional information or documentation from the individual, if needed, to determine eligibility and initiate appropriate action in accordance with 42 C.F.R. 435.952(c). (5) . . . The administrative agency shall verify information. . . (6) Update case information and redetermine eligibility when the verification received is discrepant from information currently listed in the electronic eligibility system. It is management?s responsibility to implement controls, processes, and procedures to ensure compliance with these regulations. When automated systems are utilized to perform certain functions related to this compliance, management must ensure the system is properly designed and operating effectively. During state fiscal year (SFY) 2022, the Department disbursed approximately $27.8 billion and $667.2 million on behalf of recipients who were determined eligible for the Medicaid Cluster and CHIP programs, respectively. The Ohio Benefits (OB) system, administered by the Ohio Department of Administrative Services (DAS), determines eligibility for the Medicaid Cluster and CHIP programs. The OB system also includes the IEVS functionality which compares income, as reported by recipients, to income information maintained by outside sources (i.e. Social Security Administration (SSA), Internal Revenue Service (IRS), etc.). Income information that does not agree to the OB amount is communicated as an IEVS alert and forwarded to the appropriate county for investigation and resolution. Each alert has a defined due date, which is unique based on the priority level and other policy and process related factors. During SFY 2022, more than 15.5 million alerts were issued (3.4 million IEVS alerts and 12.1 million non-IEVS alerts) for all public assistance programs that utilize OB, including the Medicaid and CHIP programs. Alerts can be generated by Ohio Benefits via interface outputs/updates, batch outputs or other triggers within the system. Ongoing enhancements to the OB alerts process were made in coordination with personnel from the Department, the Ohio Department of Job and Family Services (JFS), and DAS throughout the audit period. These enhancements addressed design weaknesses to work on solutions for filtering duplicate alerts, including those across multiple programs. However, the volume of incoming IRS alerts issued remained slightly higher: these alerts affect a change in recipient income and could possibly have an impact on eligibility or the benefit amount. These design weaknesses created a large volume of information being sent to the counties, resulting in an increased workload and ineffective application of the alert process. In addition, the Department relies heavily on JFS to coordinate with and provide training to the counties; however, these trainings were not required to be attended by all county caseworkers. See findings 2022-001 and 2022-018 for more detailed information regarding the OB weaknesses and defects, as well as the training control weaknesses. Furthermore, an OB data file containing IEVS alerts showed 1,268,042 of 2,169,386 (58.5%) IEVS alerts sent to the counties during the audit period were not cleared within 45 days, as required. The alerts were cleared between one and 416 days beyond the 45-day requirement, with an average of 209 days late. Failure to correct system design weaknesses, perform monitoring activities, mandate training for county caseworkers, and complete IEVS alerts within the established timeframe increases the risk benefits given to ineligible recipients or for inappropriate amounts will not be identified timely. This condition could adversely affect the Department?s ability to comply with IEVS requirements for these federal programs which could result in federal sanctions or penalties. Based on discussions with management, the high volume of alert generation likely caused the timeliness issues. Management indicated they continue to work with JFS and DAS to enhance the statewide eligibility system to reduce the high volume of alerts. We recommend the Department continue to work collectively with the related state agencies to implement/update robust processes, procedures, and system controls to address the weaknesses associated with the IEVS process within the Ohio Benefits system. These changes/updates should include, but not be limited to: ? Including a more centralized evaluation of alert activity and/or better use of automated tools to vet and prioritize items requiring follow-up at the county level. This would allow Department level personnel to become more experienced and adept at identifying and investigating anomalies and help focus the resources of both Department and county personnel. ? Monitoring the IEVS alert processing procedures guide for the alerts issued by the Ohio Benefits system to ensure alerts are properly documented within the system, worked within the proper time frames, and proper verification documentation is obtained and maintained by the counties for resolved alerts. ? Determining if the IEVS training for county caseworkers is working as intended to ensure they have the knowledge to properly document and resolve IEVS alerts generated by the Ohio Benefits system and making any necessary updates/changes. ? Identifying and coordinating Ohio Benefits program changes to address the system design weaknesses identified above. This should include working collaboratively with DAS to prioritize program changes which could directly impact the eligibility determinations or benefit amounts to ensure they are corrected in a timely manner to prevent and detect further improper payments. In addition, the Department should evaluate these enhancements to assist DAS in determining if the desired outcome was achieved. We also recommend the Department continue to monitor the status of system enhancements and roll-out of resources to the appropriate personnel to ensure they are implemented timely and as planned.

VARIOUS PROGRAMS ? SUBRECIPIENT MONITORING Finding Number: 2022-020 State Agency Number: MHA-01 Assistance Listing Numbers and Titles: 93.667 ?- Social Services Block Grant (SSBG) 93.788 ? Opioid STR 93.958 ? Community Mental Health Services Block Grant (MHBG) 93.958 COVID-19 ? MHBG Federal Award Identification Number / Year: 2101OHSOSR / 2021 (SSBG) 2201OHSOSR / 2022 (SSBG) H79TI081684 / 2020 (Opioid STR) H79TI083294 / 2021 (Opioid STR) B09SM082623 / 2021 (MHBG) B09SM083835 / 2021 (MHBG) B09SM085918 / 2021 (MHBG) B09SM085390 / 2021 (MHBG) B09SM084002 / 2021 (MHBG) Federal Agency: Department of Health and Human Services Compliance Requirement: Subrecipient Monitoring Repeat Finding from Prior Audit? Yes Prior Audit Finding Number: 2021-022 NONCOMPLIANCE AND MATERIAL WEAKNESS 45 C.F.R. ?75.352 states, in part: All pass-through entities must: . . . (b) Evaluate each subrecipient's risk of noncompliance with Federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate subrecipient monitoring described in paragraphs (d) and (e) of this section? (d) Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. Pass-through entity monitoring of the subrecipient must include: (1) Reviewing financial and performance reports required by the pass-through entity; (2) Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the Federal award provided to the subrecipient from the pass-through entity detected through audits, on-site reviews, and other means; and (3) Issuing a management decision for audit findings pertaining to the Federal award provided to the subrecipient from the pass-through entity as required by ? 75.521. (e) Depending upon the pass-through entity's assessment of risk posed by the subrecipient (as described in paragraph (b) of this section), the following monitoring tools may be useful for the pass-through entity to ensure proper accountability and compliance with program requirements and achievement of performance goals: (1) Providing subrecipients with training and technical assistance on program-related matters; (2) Performing on-site reviews of the subrecipient's program operations; and (3) Arranging for agreed-upon-procedures engagements as described in ? 75.425. Federal regulations require pass-through entities to maintain internal controls over federal programs that provide reasonable assurance they are in compliance with laws and regulations. In addition, sound internal control procedures require management to monitor these control procedures to verify they are designed and operating in a manner consistent with federal regulations and program objectives. To be effective, the performance of internal controls must be evidenced in some manner to document the control is in place and functioning as intended. During state fiscal year (SFY) 2022, the Department disbursed approximately $122.8 million to subrecipients of the SSBG, Opioid STR, and MHBG programs, as follows: Assistance Listing Number & Title Disbursements to Subrecipients Number of Subrecipients 93.667 ?- SSBG $6,741,813 50* 93.788 ? Opioid STR $87,873,804 189* 93.958 ? MHBG $28,199,223 134* Combined Total: $122,814,840 ? Includes 50 Alcohol, Drug Addiction, and Mental Health (ADAMH) boards The Department?s Community Monitoring Section (CMS) deploys a risk management monitoring technique for subrecipient monitoring to analyze and evaluate vulnerabilities of federal awards provided to the ADAMH boards. At the beginning of each fiscal year, CMS sends out questionnaires to all 50 ADAMH boards soliciting feedback regarding financial reporting, organizational turnover, number of contracted agencies, and whether any other monitoring (i.e., financial audits, peer review) has been completed. The Department then compiles the Consolidated Unexpended Funds spreadsheet based on financial data obtained from the questionnaires, including any variances in financial data and unexpended federal funds. The CMS Manager then utilizes the Consolidated Unexpended Funds spreadsheet to determine how to manage the State-wide risk and instructs CMS staff how to deploy its monitoring efforts for the SFY. Annually, CMS is to conduct Single Audit report reviews to ensure subrecipients, who have received at least $750,000 in federal funding for the fiscal year, have complied with the requirements for federal awards passed through the Department and make management decisions on any audit findings/corrective action plans within six months of the audit report date. The Department utilizes a database/Audit Review Tracking Spreadsheet to track data on subrecipients, such as: desk reviews, single audit reviews, subrecipient financial information, amounts subrecipients reported on their Schedule of Expenditures of Federal Awards, financial information from the State?s accounting system, and any other information about the subrecipient that would assist in effectively managing State-wide concerns on the federal awards passed through the Department. The Department reviews the Single Audits completed and the Corrective Action Plan (CAP), if applicable, for subrecipients with findings and issues a Management Decision letter to the subrecipient within six months of the audit report date. During the risk management process, CMS evaluates the rotation cycle, questionnaire results, and Board Risk Scores and identifies the Boards for which it will conduct the Stakeholder Assistance Review (SAR) procedures. The Department has designated the SAR process as an increased monitoring technique which is only applied to specific Boards designated as higher risk where the Department will conduct a physical on-site and/or virtual visit during the SFY. The SAR process is performed on a rotation basis to obtain approximately 33% or more coverage of all boards per Department policy. During SFY 2022, the Department performed risk management reviews, on-site reviews, and single audit reviews of the ADAMH boards; however, the following issues were identified: ? The Department did not have procedures in place to monitor Opioid STR and MHBG subrecipients, other than the 50 ADAMH boards. As a result, the Department did not monitor 139 of 189 (73.5%) Opioid STR subrecipients which received $94.1 million, and 84 of 134 (62.7%) MHBG subrecipients which received $23.4 million during the audit period as required by 45 C.F.R. ?75.352 (d). ? For three of three (100%) audit reports selected for testing, the Department did not complete or provide the management decision letters to the subrecipients. As such, the Department did not issue a management decision (within six months of the report being accepted), as required by 45 C.F.R. ?75.352 (d)(3). ? The Department did not complete 16 of 17 (94.1%) planned SAR on-site/virtual visits during the audit period. Without adequate procedures in place to monitor subrecipient compliance with federal statutes, laws and regulations, there is an increased risk subrecipients may misuse federal funds for unauthorized purposes. This could lead to fines, penalties, or repayment of program funds being imposed by the federal grantor agency. Based on discussions with management, the lack of subrecipient monitoring and documentation was caused by employee turnover, new management, and oversight. We recommend the Department evaluate its current control procedures and processes over subrecipient monitoring and update them as necessary to reasonably ensure compliance with 45 C.F.R. ?75.352. These procedures should include risk management monitoring, increased and SAR desk reviews, and Single Audit reviews. Additionally, the Department should ensure an appropriate level of coverage is obtained for each federal program based on major program testing within the Single Audits. The Department should also put monitoring procedures in place over all subrecipients and not just the 50 ADAMH boards. Management should periodically monitor these procedures to ensure they are operating effectively and as intended.

OPIOID STR & MHBG ? CASH MANAGEMENT Finding Number: 2022-021 State Agency Number: MHA-02 Assistance Listing Number and Title: 93.788 ? Opioid STR 93.958 ? Community Mental Health Services Block Grant (MHBG) Federal Award Identification Number / Year: H79TI081684 / 2020 (Opioid STR) H79TI083294 / 2021 (Opioid STR) B09SM082623 / 2021 (MHBG) Federal Agency: Department of Health and Human Services Compliance Requirement: Cash Management Repeat Finding from Prior Audit? No NONCOMPLIANCE AND MATERIAL WEAKNESS U.S. Treasury regulations, 31 C.F.R. Part 205, which implemented the Cash Management Improvement Act of 1990 (CMIA), require state recipients enter into agreements that prescribe specific methods of drawing down Federal funds (funding techniques) for selected large programs. The Opioid STR and MHBG programs were not included in the state fiscal year 2022 CMIA Agreement; therefore, 31 C.F.R. ? 205.33(a) sets guidelines which states, in part: A State must minimize the time between the drawdown of Federal funds from the Federal government and their disbursement for Federal program purposes. A Federal Program Agency must limit a funds transfer to a State to the minimum amounts needed by the State and must time the disbursement to be in accord with the actual, immediate cash requirements of the State in carrying out a Federal assistance program or project. The timing and amount of funds transfers must be as close as is administratively feasible to a State's actual cash outlay for direct program costs and the proportionate share of any allowable indirect costs? The Department draws federal funds for the Opioid STR and MHBG programs similarly to those which follow the Modified Pre-Issuance funding technique and considers eight business days a reasonable amount of time to disburse the drawn federal funds for program expenses. It is management?s responsibility to implement control policies and procedures to reasonably ensure draws of federal funds are for immediate cash needs, processed accurately, and disbursed timely in accordance with applicable laws and regulations. During state fiscal year 2022, the Department drew down approximately $112.8 million and $32.9 million in federal funding for the Opioid STR and MHBG programs, respectively. Once voucher payments are approved in the Ohio Administrative Knowledge System (OAKS) and the Payment Management System (PMS), the Department draws the Opioid STR and MHBG funds electronically from PMS to cover the amount of the vouchers, as the account is to maintain a zero cash balance. Before drawing down funds, the Senior Financial Analyst prepares a Cash Request noting the amount to be drawn and OAKS coding. The Cash Request is then forwarded to a different Senior Financial Analyst who draws the funds down in PMS and sends the support documentation back to the original analyst for creation of the revenue receipt in OAKS. The revenue receipt is then submitted to the Community Funding Operations Manager and Ohio Treasurer of State?s Office for approval. Once approved, the Department makes a payment in the form of an electronic funds transfer or check. However, the Department's controls did not prevent noncompliance with the cash management timeliness requirements as follows: ? Of 17 Opioid STR disbursements tested from 17 draws, the Department did not disburse two payments (11.8%) within eight business days of the receipt of federal funds, as required by 31 C.F.R. ? 205.33(a). The Department disbursed the funds three days after the required disbursement date. ? Of three MHBG disbursements tested from three draws, the Department did not disburse one payment (33.3%) within eight business days of receipt of federal funds, as required by 31 C.F.R. ? 205.33(a). The Department disbursed the funds three days after the required disbursement date. Not having effective controls over the timely disbursement of federal funds could lead to the Department not limiting draws to immediate cash needs and not expending funds timely. This could result in noncompliance with 31 C.F.R. ? 205.33(a) and could subject the Department to sanctions, other penalties, or a repayment of part of the grant award amounts. In addition, noncompliance could subject the Department to paying interest charges on these draws. Based on discussions with management and review of supporting documents, the errors were due to voucher processing and approval delays. We recommend the Department evaluate its existing cash management control procedures and update them as necessary to reasonably ensure all federal draw requests are disbursed timely and are drawn only for immediate cash needs, based on the funding technique established in accordance with 31 C.F.R. ? 205.33(a). We also recommend the Department establish procedures to periodically monitor its compliance with the cash management requirements and initiate necessary actions to resolve any noncompliance that results.

VARIOUS PROGRAMS ? TRANSPARENCY ACT REPORTING Finding Number: 2022-022 State Agency Number: MHA-03 Assistance Listing Numbers and Titles: 93.667 ? Social Services Block Grant (SSBG) 93.788 ? Opioid STR 93.958 ? Block Grants for Community Mental Health Services (MHBG) 93.958 COVID-19 ? MHBG Federal Award Identification Number / Year: 2101OHSOSR / 2021 (SSBG) 2201OHSOSR / 2022 (SSBG) H79TI081684 / 2020 (Opioid STR) H79TI083294 / 2021 (Opioid STR) B09SM082623 / 2021 (MHBG) B09SM083835 / 2021 (MHBG) B09SM085918 / 2021 (MHBG) B09SM085390 / 2021 (MHBG) B09SM084002 / 2021 (MHBG) Federal Agency: Department of Health and Human Services Compliance Requirement: Reporting Repeat Finding from Prior Audit? Yes Prior Audit Finding Number: 2021-023 NONCOMPLIANCE AND MATERIAL WEAKNESS The Federal Funding Accountability and Transparency Act (Pub. L. No. 109-282, as amended by Section 6202 of Public Law 110-252, hereafter referred as the ?Transparency Act? that are codified in 2 C.F.R. Part 170) requires prime recipients of federal awards who make first-tier subawards to report the subaward on the Federal Funding Accountability and Transparency Subaward Reporting System (FSRS) website maintained by the federal Office of Management and Budget. Under the requirements of 2 C.F.R. Part 170, recipients (i.e., direct recipients) of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more on the FSRS website. Prime recipients must report by the end of the month following the month in which the obligation is made. It is management?s responsibility to design and implement internal controls to reasonably ensure compliance with laws and regulations and to ensure management?s objectives are achieved. During state fiscal year 2022, the Department obligated approximately $123.6 million for 329 subawards which exceeded $30,000 and were required to be reported on the FSRS website in accordance with the Transparency Act, under the following major programs. Assistance Listing Number Assistance Listing Title Number of Subawards Amount Disbursed 93.667 SSBG 50 $6,690,064 93.788 Opioid STR 184 $94,056,082 93.958 MHBG 95 $22,856,777 Monthly, the Department?s Fiscal Office is to generate the Transparency Act report from the Grants Funding Management System (GFMS) and review it for completeness and accuracy, then approve it in the GFMS system. The Transparency Act report is then manually entered or uploaded into the FSRS website. However, there is no supervisory review of the report prior to submission to the FSRS website and the controls were not operating effectively during the audit period. As a result, the Department did not submit 311 of 329 (94.5%) subawards within the FSRS website for the SSBG, Opioid STR, and MHBG programs during state fiscal year 2022 as detailed below, per program: SSBG Transactions Tested Subaward not reported Report not timely Subaward amount incorrect Subaward missing key elements 50 50 50 50 50 Dollar Amount of Tested Transactions Subaward not reported Report not timely Subaward amount incorrect Subaward missing key elements $6,690,064 $6,690,064 $6,690,064 $6,690,064 $6,690,064 Opioid STR Transactions Tested Subaward not reported Report not timely Subaward amount incorrect Subaward missing key elements 172 172 172 172 172 Dollar Amount of Tested Transactions Subaward not reported Report not timely Subaward amount incorrect Subaward missing key elements $90,965,560 $90,965,560 $90,965,560 $90,965,560 $90,965,560 MHBG Transactions Tested Subaward not reported Report not timely Subaward amount incorrect Subaward missing key elements 89 89 89 89 89 Dollar Amount of Tested Transactions Subaward not reported Report not timely Subaward amount incorrect Subaward missing key elements $21,818,231 $21,818,231 $21,818,231 $21,818,231 $21,818,231 By not complying with federal Transparency Act reporting requirements, the Department risks federal funding being reduced, taken away, or other sanctions imposed by the federal grantor agency. If the subawards are not reported accurately and timely within the FSRS website, the risk exists that those using the Transparency Act reports could be relying on inaccurate information. Based on discussions with management, these errors were caused by management and employee turnover and internal system issues to comply with the Transparency Act report format. We recommend the Department collect and report on the FSRS website complete and accurate information regarding subawards made for all programs subject to the Transparency Act. We also recommend the Department evaluate its Transparency Act reporting control procedures and update them as necessary to ensure they promote compliance with the Federal regulations, as well as accuracy and completeness of information submitted. These procedures should include a supervisory review of the report information before it is submitted on the FSRS website.

DISASTER GRANTS ? SUBRECIPIENT MONITORING Finding Number: 2022-023 State Agency Number: DPS-01 Assistance Listing Number and Title: 97.036 ? Disaster Grants ? Public Assistance (Presidentially Declared Disasters) 97.036 COVID-19 ? Disaster Grants ? Public Assistance (Presidentially Declared Disasters) Federal Award Identification Number / Year: 4360-DR-OH-PA / 2018 4424-DR-OH-PA / 2019 4447-DR-OH-PA / 2019 4507-DR-OH-PA / 2020 Federal Agency: Department of Homeland Security Compliance Requirement: Subrecipient Monitoring Repeat Finding from Prior Audit? Yes Prior Audit Finding Number: 2021-024 NONCOMPLIANCE AND MATERIAL WEAKNESS 2 C.F.R. ? 3002.10 (Adoption of 2 C.F.R. Part 200) gives regulatory effect to the Department of Homeland Security for 2 C.F.R. ? 200.332 which establishes requirements over subawards for pass-through entities and states, in part, that all pass-through entities must: . . . (f) Verify that every subrecipient is audited as required by Subpart F of this part when it is expected that the subrecipient's Federal awards expended during the respective fiscal year equaled or exceeded the threshold set forth in ? 200.501. Federal regulations require pass-through entities to maintain internal controls over federal programs that provide reasonable assurance they are complying with laws and regulations. It is imperative that management monitor these control procedures to verify they are designed and operating in a manner consistent with federal regulations and program objectives. To be effective, the performance of internal controls must be evidenced in some manner to document the control is in place and functioning as intended. During state fiscal year 2022, the Department disbursed approximately $141 million in subawards to 179 subrecipients for the Disaster Grants ? Public Assistance (PA) program. After a Presidentially declared disaster or emergency occurs, a State-Local Grant Agreement is signed which outlines applicable laws and regulations the Department and subrecipient must follow in order to receive and maintain funding from the PA Program, including audit requirements if the subrecipient expends more than $750,000 in a year. The Department?s Disaster Recovery Branch (DRB) requires the subrecipient submit a certification for each year PA funds are expended, certifying if a Single Audit is required based on their total federal expenditures. The Emergency Management Grants (EMGrants) system generates these certifications based on when federal funds for a specific PA grant was paid to the subrecipient: the certifications are sent to the subrecipients at the beginning of the calendar year. Once the certification is obtained, the Department performs a desk review utilizing an Audit Review Sheet to determine if a Single Audit should have been required. If a Single Audit was required, the DRB obtains the audit report, identifies any findings related to the PA program, issues a management decision on any findings, and verifies the PA program amounts reported in the Schedule of Expenditures of Federal Awards. However, the Department did not send out certifications to the subrecipients during the audit period, or perform alternative procedures, to ensure the subrecipients obtained a Single Audit report when necessary, as required by 2 C.F.R. ? 200.332 (f). Not adequately monitoring subrecipients to ensure the required audit was performed, increases the risk that subrecipients may not be properly utilizing federal funds or adhering to program requirements which can potentially jeopardize federal funding. This could cause federal funding to be reduced, taken away, or sanctions imposed by the federal grantor agency. Based upon discussion with management, certifications were not sent because they were waiting for an enhancement to the EMGrants system which would improve Single Audit functionality, including the certification process. We recommend the Department evaluate and strengthen existing procedures regarding subrecipient monitoring. The Department should have alternative procedures to verify whether subrecipient audits were performed as required when system functionality is not available, which could include tracking funding sent to the subrecipients and/or reaching out to the subrecipients via other means. Procedures should be adequately documented to provide management reasonable assurance they have been performed. Management should periodically monitor these procedures to ensure they are operating as intended.

DISASTER GRANTS ?TRANSPARENCY ACT REPORTING Finding Number: 2022-024 State Agency Number: DPS-02 Assistance Listing Number and Title: 97.036 ? Disaster Grants ? Public Assistance (Presidentially Declared Disasters) 97.036 COVID-19 ? Disaster Grants ? Public Assistance (Presidentially Declared Disasters) Federal Award Identification Number / Year: 4360-DR-OH-PA / 2018 4424-DR-OH-PA / 2019 4447-DR-OH-PA / 2019 4507-DR-OH-PA / 2020 Federal Agency: Department of Homeland Security Compliance Requirement: Reporting Repeat Finding from Prior Audit? Yes Prior Audit Finding Number: 2021-025 NONCOMPLIANCE AND MATERIAL WEAKNESS The Federal Funding Accountability and Transparency Act (Pub. L. No. 109-282, as amended by Section 6202 of Public Law 110-252, hereafter referred as the ?Transparency Act? that are codified in 2 C.F.R. Part 170) requires prime recipients of federal awards who make first-tier subawards to report the subaward on the Federal Funding Accountability and Transparency Subaward Reporting System (FSRS) website maintained by the federal Office of Management and Budget. Under the requirements of 2 C.F.R. Part 170, recipients (i.e., direct recipients) of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more on the FSRS website. Prime recipients must report by the end of the month following the month in which the obligation is made. It is management?s responsibility to design and implement internal controls to reasonably ensure compliance with laws and regulations and to ensure management?s objectives are achieved. During state fiscal year 2022, the Department obligated approximately $139 million for 178 subawards which exceeded $30,000 and were required to be reported on the FSRS website in accordance with the Transparency Act for the Disaster Grants ? Public Assistance (PA) program. As PA projects are approved by the Federal Emergency Management Agency (FEMA), the key data elements for the report are compiled from subrecipient State-Local Agreements and Project Worksheets (PW), which are maintained in the Department?s Emergency Management Grants (EMGrants) system. The Disaster Services Administrator generates a Transparency Act upload template from the EMGrants system and provides the report for upload to the Budget Analyst Supervisor for review and submission into the FSRS website. However, the Department's internal controls were not operating effectively. As a result, the following errors were noted: Transactions Tested Subaward not reported Report not timely Subaward amount incorrect Subaward missing key elements 18 0 5 1 18 Dollar Amount of Tested Transactions Subaward not reported Report not timely Subaward amount incorrect Subaward missing key elements $10,435,840 $0 $721,980 $107,236 $10,435,840 A lack of adequate internal controls over the preparation and review of reports increases the risk the reports submitted to the federal grantor agency are inaccurate and incomplete. In addition, by not complying with federal Transparency Act reporting requirements, the Department risks federal funding being reduced, taken away, or other sanctions imposed by the federal grantor agency. If the subawards are not reported accurately and timely within FSRS, the risk exists that those using the Transparency Reports could be relying on inaccurate information. Based on discussion with management, these errors were due to staffing issues and an increased workload due to the COVID-19 disaster/emergency declaration, as well as the previous three federal disaster/emergency declarations. We recommend the Department collect and report timely on the FSRS website complete and accurate information regarding subawards subject to the Transparency Act. We also recommend the Department evaluate its Transparency Act reporting control procedures and update them as necessary to ensure they promote compliance with the Federal regulations, as well as accuracy and completeness of information submitted.

IT ? MEDICAID/CHIP/SNAP/TANF ? OHIO BENEFITS SYSTEM Finding Number: 2021-002 State Agency Number: DAS-01 Assistance Listing Program Numbers and Titles: 10.551/10.561 SNAP Cluster 93.558 ? Temporary Assistance for Needy Families (TANF) 93.767 ? Children?s Health Insurance Program (CHIP) 93.767 COVID-19 ? CHIP 93.775/93.777/93.778 ? Medicaid Cluster 93.775/93.777/93.778 COVID-19 ? Medicaid Cluster Federal Award Identification Number/Year: 192OH102S2514 / 2019 (SNAP Cluster) 192OH102S6018 / 2019 (SNAP Cluster) 202OH102S2514 / 2020 (SNAP Cluster) 202OH102S6018 / 2020 (SNAP Cluster) 212OH102S2514 / 2021 (SNAP Cluster) 212OH102S6018 / 2021 (SNAP Cluster) 1801OHTANF / 2018 (TANF) 1901OHTANF / 2019 (TANF) 2001OHTANF / 2020 (TANF) 2101OHTANF / 2021 (TANF) 2005OH5021 / 2020 (CHIP) 2105OH5021 / 2021 (CHIP) 2005OH5MAP / 2020 (Medicaid Cluster) 2105OH5MAP / 2021 (Medicaid Cluster) Federal Agencies: Department of Agriculture Department of Health and Human Services Compliance Requirements: Activities Allowed or Unallowed, Allowable Costs/Cost Principles, Eligibility, Special Tests & Provisions ? Income Eligibility Verification System Repeat Finding from Prior Audit? Yes Prior Audit Finding Number: 2020-004 MATERIAL WEAKNESS NOTE: Finding numbers 2021-013, 2021-018, 2021-019, and 2021-020 contain additional information which is integral to and should be read in conjunction with this finding. Applications/systems must be properly designed to achieve the business and IT goals of the organization. External factors effecting eligibility must be appropriately considered and properly evaluated to ensure eligibility for benefits is properly determined, and appropriate updates to eligibility are made when applicable. It is critical the appropriate monitoring controls are designed and implemented to reasonably ensure the organization has adequate controls to achieve management?s goals and objectives. During state fiscal year (SFY) 2021, the State of Ohio disbursed a combined total of $30.85 billion in public assistance payments related to the following programs: See Schedule of Findings and Questioned Costs for chart/table. The State of Ohio uses a multi-agency approach to administer these programs, as follows: overall compliance and administration of the Medicaid Cluster and CHIP falls under the Ohio Department of Medicaid (MCD), overall compliance and administration of the SNAP Cluster and TANF programs falls under the Ohio Department of Job & Family Services (ODJFS), and programming and administration of the State?s eligibility determination computer system, Ohio Benefits (OB), falls under the Ohio Department of Administrative Services (DAS). The OB system contains the eligibility and benefit information/determinations for these programs, including the Income Eligibility Verification System (IEVS) functionality which compares reported recipient income to income information maintained by outside data sources (SSA, IRS, etc.). The State also utilizes the 88 Ohio counties in the eligibility determination process to work with applicants, receive/enter eligibility documentation into the State?s system, and follow up on alerts issued by the system. Currently, individuals applying to receive public assistance benefits complete an application through one of several input locations including the Ohio Benefits Self-Service Portal, the Federally-Funded Marketplace, Social Security, County Departments of Job & Family Services (CDJFS) offices; the Medicaid Consumer Hotline (the Hotline starts the application and sends to the CDJFS to complete); and, paper applications that are sent to the CDJFS. When applying, the CDJFS collects and maintains any documentation provided by the individual either in a paper case file or in the OnBase Enterprise Documentation Management System (EDMS) maintained under contract by DAS. After collecting documentation, the county caseworker enters the individual?s information into the OB system which determines the initial eligibility benefit amount and assigns the benefit aid category, where applicable. This process is also used to perform eligibility redeterminations on an annual basis or when prompted through a system alert. The OB system is programmed with the State Plan recipient eligibility requirements to determine whether the recipient is eligible to receive the related program benefits based on the information entered by the recipient or caseworker and also assigns a benefit aid category. Once the determination is made, the OB system uploads the eligibility information to the MCD or ODJFS payment system for processing. The Ohio Benefits system is designed to issue alerts to county caseworkers for a variety of items which require review, evaluation, follow-up, and a determination about the impact on the related case and/or program benefits. However, we noted the following weaknesses in the design and monitoring of the OB system: ? Alerts ? During SFY 2021, more than 25.5 million alerts were sent to the counties for investigation and follow-up (according to DAS records, 9.8 million were IEVS alerts and 15.7 million were non-IEVS alerts). Ongoing enhancements to the OB alerts process were made in coordination with the Ohio Benefits Project Team (personnel from DAS, MCD, and ODJFS) throughout the audit period. During SFY21, the enhancements addressed design weaknesses on 12 sources of alerts, reducing the backlog to 8.8 million alerts at fiscal-year-end that required county investigation and follow-up. Although DAS has made several enhancements to OB related to improving the IEVS alert process, the following design weaknesses existed during the audit period for both the BENDEX IEVS alert process and the non-IEVS alert process, which DAS plans to continue working on: o Multiple and repetitive alerts (redundancy). o Irrelevant alerts (zero or small dollar amounts). o Alerts being received on persons not receiving public assistance. These design weaknesses created a large volume of information being sent to the counties, resulting in an increased workload and ineffective application of the alert process. ? Contract and Monitoring ? Although operating protocols were available defining DAS? responsibilities, a signed interagency agreement has not been finalized to define the roles and responsibilities of each agency and naming DAS as the administrator for OB. In addition, no data governance structure was in place to ensure reliability for management. As a result, it was not always clear if/how program objectives were being met/monitored and program compliance was being achieved. If the State?s eligibility determination system, Ohio Benefits, is not designed to properly identify changes to recipient information and generate relevant alerts when those changes could impact a recipient?s eligibility, the risk of inaccurate or unallowable benefits being paid to, or on behalf of, recipients is greatly increased. These weaknesses could allow undue subjective decisions, jeopardize accurate eligibility processing, and/or result in improper payments or federal reimbursements. Overpayments or payments to or on behalf of ineligible recipients may subject the State to penalties or sanctions which may jeopardize future funding and limit its ability to fulfill program requirements to provide benefits to those in need. Additionally, without signed agreements with related agencies there is an increased risk responsibilities of each party may not be clearly defined, creating delays in critical processing and jeopardizing the achievement of overall goals. Based on discussions with management, oversight and systemic issues led to the issues identified. Management indicated they recognize the alert process needs further refinement and they are taking steps to reduce the volume of alerts and add enhancements to the Ohio Benefits System. We recommend DAS continue to work collectively with the related state agencies to implement/update robust processes, procedures, and system controls to address the weaknesses associated with the eligibility/IEVS process within the OB system. These changes/updates should include, but not be limited to: ? Continue working on redesigning the alert process to be more effective and efficient. This could include a more centralized evaluation of alert activity and/or better use of automated tools to analyze and prioritize items requiring follow-up. This would allow related state agency level personnel to become more experienced and adept at identifying and investigating anomalies and help focus the resources of both related state agency and county personnel. ? Identifying and coordinating program changes to address the system design weaknesses identified above. This should include working collaboratively with the related state agencies to prioritize program changes which could directly impact the eligibility determinations or benefit amounts to ensure they are corrected in a timely manner to prevent and detect further improper payments. ? Ensuring interagency agreements are formalized, contain all parties of the agreements, and fully and clearly define the roles, responsibilities, and expectations related to each party, including completion of required risk assessments and evaluations, and any other specific tasks designed to achieve program compliance. ? Implementing a data governance structure designed to ensure data quality and reliability for management, the grantor agencies, and other users of this information. This should include data subject experts from each related agency to help ensure quality of data requests before external and internal users rely on the data, issues are addressed with a clear escalation path, and establishing accountabilities and alignment between the related agencies.

LOW-INCOME HOME ENERGY ASSISTANCE PROGRAM ? CASH MANAGEMENT Finding Number: 2021-003 State Agency Number: DEV-01 Assistance Listing Program Number and Title: 93.568 ? Low-Income Home Energy Assistance Program 93.568 COVID-19 ? Low-Income Home Energy Assistance Program Federal Award Identification Number / Year: 1901OHLIEA / 2019 2001OHLIEA / 2020 2001OHE5C3 / 2020 2101OHLIEA / 2021 Federal Agency: Department of Health and Human Services Compliance Requirement: Cash Management Repeat Finding from Prior Audit? Yes Prior Audit Finding Number: 2020-006 NONCOMPLIANCE AND MATERIAL WEAKNESS 31 C.F.R. Part 205 ?11 states, in part: (a) A State and a Federal Program Agency must minimize the time elapsing between the transfer of funds from the United States Treasury and the State's payout of funds for Federal assistance program purposes, whether the transfer occurs before or after the payout of funds. (b) A State and a Federal Program Agency must limit the amount of funds transferred to the minimum required to meet a State's actual and immediate cash needs. . . . To define these allowable timeframes, the State of Ohio and the U.S. Department of the Treasury entered into a Cash Management Improvement Act (CMIA) Agreement which requires the Department to utilize the Modified Pre-Issuance Methodology when requesting federal funds for the Low-Income Home Energy Assistance Program (LIHEAP). Section 6.2.4 of the agreement regarding the Modified Pre-Issuance Methodology states, in part: . . . The State shall request funds such that they are deposited in a State account not more than five business days prior to the day the State makes a disbursement. . . The amount of the request shall be the amount the State expects to disburse. . . In addition, 45 C.F.R. Part 75 ? 302(b)(6) requires states to have written procedures to implement the requirements of 45 C.F.R. Part 75 ?305. Specifically, 45 C.F.R. Part 75 ?305(a) indicates for states, payments are governed by Treasury-State CMIA agreements and default procedures codified at 31 C.F.R. Part 205 ?Rules and Procedures for Efficient Federal-State Funds Transfers? and TFM 4A-2000 Overall Disbursing Rules for All Federal Agencies. Furthermore, an entity?s system of internal controls consists of the policies and procedures established by management to provide reasonable assurance that it complies with applicable rules and regulations and those specific operational objectives are achieved. These policies establish the authorization level for financial and operational transactions to be executed and are meant to accomplish management's goals and professional and statutory requirements. During state fiscal year 2021, the Department drew down approximately $177 million in federal funding for LIHEAP. The Department utilizes the CMIA Agreement, as well as internal policies and procedures as a guide for completing federal draws; however, these policies and procedures do not specifically address the timeliness of the disbursement/draw process as required by 45 C.F.R. Part 75 ?302(b)(6). The Department compiles a worksheet of all payment requests for administrative and program costs associated with providing LIHEAP assistance in order to determine the amount of federal funds to be drawn. This evaluation includes year-to-date disbursements, year-to-date revenues, and any refunds received and/or pending. However, as noted above, the Department's internal control policies do not contain procedures which allow disbursements to be tied to a specific draw. Due to this, it is not possible to test if draws were disbursed in compliance with the applicable funding techniques specified in the Treasury-State Agreement (within five business days). Without procedures in place which allow for ensuring a timely disbursement of funds in accordance with federal requirements and the CMIA Agreement, interest penalties may be incurred by the State of Ohio. This could also subject the Department to sanctions or other penalties by the federal grantor agency. Based on discussions with management, they had not previously considered developing a process that would allow them to match federal disbursements to the appropriate federal draw: management indicated they are reviewing the current federal draw process and implementing changes in order to accomplish this goal, as well as improve the Department?s approval process for federal disbursements to allow for better transparency during the draw process. We recommend the Department continue with its review of the cash management process and revise/implement procedures where necessary. As part of this review, the Department should update its written policies and procedures to provide a methodology which allows for federal disbursements to be tied to related federal draws to help ensure compliance with the applicable C.F.R. and CMIA sections noted above. These policies and procedures should be formally approved and adopted by management, provided to all employees, and monitored periodically by management to ensure the procedures are operating as intended and updated as necessary.

LOW-INCOME HOME ENERGY ASSISTANCE PROGRAM ? REPORTING Finding Number: 2021-004 State Agency Number: DEV-02 Assistance Listing Program Number and Title: 93.568 ? Low-Income Home Energy Assistance Program 93.568 COVID-19 ? Low-Income Home Energy Assistance Program Federal Award Identification Number / Year: 1901OHLIEA / 2019 2001OHLIEA / 2020 2001OHE5C3 / 2020 2101OHLIEA / 2021 Federal Agency: Department of Health and Human Services Compliance Requirement: Reporting Repeat Finding from Prior Audit? Yes Prior Audit Finding Number: 2020-008 NONCOMPLIANCE AND MATERIAL WEAKNESS 42 U.S.C. ? 8629(b) states, in part: The Secretary shall, . . . submit a report to the Congress containing a detailed compilation of the data under subsection (a) with respect to the prior fiscal year, and a report that describes for the prior fiscal year? (1) the manner in which States carry out the requirements of clauses (2), (5), (8), and (15) of section 8624(b) of this title; and (2) the impact of each State?s program on recipient and eligible households. 45 C.F.R. ? 96.82(a) states: Each grantee which is a State or an insular area which receives an annual allotment of at least $200,000 shall submit to the Department, as part of its LIHEAP [Low-Income Home Energy Assistance Program] grant application, the data required by section 2605(c)(1)(G) of Public Law 97-35 (42 U.S.C. 8624(c)(1)(G)) for the 12-month period corresponding to the Federal fiscal year (October 1-September 30) preceding the fiscal year for which funds are requested. The data shall be reported separately for LIHEAP heating, cooling, crisis, and weatherization assistance. It is management?s responsibility to implement control policies and procedures to reasonably ensure the federal reports they submit are accurate, complete, and in compliance with program requirements. It is imperative that management maintain the underlying data and related program documentation used to prepare and support these reports. The LIHEAP Performance Data Form (OMB No. 0970-0449) is an annual report in response to 42 U.S.C. ? 8629(b), which requires State grantees to submit, by January 31st, data to the Secretary of Health and Human Services (HHS) for the prior federal fiscal year. Following the end of each federal fiscal year, the Department?s Office of Community Assistance staff completes the LIHEAP Performance Data Form using information generated internally by the Department?s Ohio Community and Energy Assistance Network (OCEAN) system and compiled on an internal LIHEAP Performance Measures Spreadsheet. The Annual Report on Households Assisted by LIHEAP (OMB No. 0970-0060) is in response to 45 C.F.R. ?96.82(a), which requires State grantees to submit, by December 15th, data to HHS for the prior federal fiscal year. Prior to the reporting deadline, the Database Administration Specialist in the Department?s Information Technology section prepares a draft of the Annual Report on Households Assisted by LIHEAP using data/amounts obtained from the OCEAN system. Both reports are reviewed by Office of Community Assistance management for completeness and accuracy before submitting them electronically to HHS. However, these control procedures were not operating effectively during the audit period. As a result, the following variances were noted for the reports submitted during the audit period when compared to the underlying supporting documents used to prepare them: LIHEAP Performance Data Form: ? Section IV. Estimated Uses of LIHEAP Funds, Line 3(d)(2) Non-Supplemental Funds, Maximum Annual Dollar Income for Four Person Household as of the Effective Date - Amount of $15,850 was understated by $30,000 or 65.4%. ? Section IV. Estimated Uses of LIHEAP Funds, Line 11 Assurance 16 Activities ? non-supplemental funds ? Amount of $256,594 was overstated by $3,000 or 11.8%. ? Section IV. Estimated Uses of LIHEAP Funds, Line 13 Administration/Planning Costs--non-supplemental funds ? Amount of $13,022,227 was understated by $3,000 or 0.023%. Annual Report on Households Assisted by LIHEAP: ? Section III. Number of Assisted Households by Vulnerable Population, Line 11 Any type of LIHEAP Assistance, Age 5 years of under (young child) ? Amount of 38,821 overstated by 2,000 or 5.4%. A lack of adequate internal controls over federal reporting increases the risk that reports submitted to the federal grantor agency are inaccurate. This also increases the risk that those using the reports could be relying on inaccurate information. Reporting inaccurate or incomplete information could subject the Department to federal sanctions, limiting the amount of funding for program activities. Based on discussions with management, the reported amounts were not adequately agreed to internal support during the review process due to oversight. We recommend the Department evaluate existing procedures and consider altering or implementing additional procedures, as necessary, to provide reasonable assurance the data being reported to the federal government for LIHEAP is accurate and traces to the supporting documentation used to compile the reports. Management should periodically review these procedures to ensure they are operating as intended.

LOW-INCOME HOME ENERGY ASSISTANCE PROGRAM ? TRANSPARENCY ACT REPORTING Finding Number: 2021-005 State Agency Number: DEV-03 Assistance Listing Program Number and Title: 93.568 ? Low-Income Home Energy Assistance Program 93.568 COVID-19 ? Low-Income Home Energy Assistance Program Federal Award Identification Number / Year: 1901OHLIEA / 2019 2001OHLIEA / 2020 2001OHE5C3 / 2020 2101OHLIEA / 2021 Federal Agency: Department of Health and Human Services Compliance Requirement: Reporting Repeat Finding from Prior Audit? No NONCOMPLIANCE AND MATERIAL WEAKNESS The Federal Funding Accountability and Transparency Act (Pub. L. No. 109-282, as amended by Section 6202 of Public Law 110-252, hereafter referred as the ?Transparency Act? that are codified in 2 C.F.R. Part 170) requires prime recipients of federal awards who make first-tier subawards to report the subaward on the Federal Funding Accountability and Transparency Subaward Reporting System (FSRS) website maintained by the federal Office of Management and Budget. Under the requirements of 2 C.F.R. Part 170, recipients (i.e., direct recipients) of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more on the FSRS website. Prime recipients must report by the end of the month following the month in which the obligation is made. It is management?s responsibility to design and implement internal controls to reasonably ensure compliance with laws and regulations and to ensure management?s objectives are achieved. During state fiscal year 2021, the Department disbursed approximately $81 million for 51 LIHEAP subawards which exceeded $30,000 and were required to be reported on the FSRS website in accordance with the Transparency Act. However, the Department had no procedures in place for and did not report LIHEAP subaward information through the FSRS website, as required by the Transparency Act and indicated below: See Schedule of Findings and Questioned Costs for chart/table. By not complying with federal Transparency Act reporting requirements, the Department risks federal funding being reduced, taken away, or other sanctions imposed by the federal grantor agency. If the subawards are not reported accurately and timely within FSRS, the risk exists that those using the Transparency Reports could be relying on inaccurate information. Based on discussions with management, they were not aware of reporting requirements under the Transparency Act. Management indicated they are currently undergoing a review of the federal grant reporting requirements and processes. We recommend the Department collect and report on the FSRS website complete and accurate information regarding subawards made for all programs subject to the Transparency Act. We also recommend the Department design and implement Transparency Act reporting control procedures to ensure they are in compliance with the Federal regulations, as well as accuracy and completeness of information submitted. These procedures should include a supervisory review of the report information before it is submitted on the FSRS website and be properly documented. Management should periodically review these control procedures to ensure they are operating as intended.

MEDICAID CLUSTER ? TRANSPARENCY ACT REPORTING Finding Number: 2021-006 State Agency Number: DDD-01 Assistance Listing Program Numbers and Titles: 93.775/93.777/93.778 ? Medicaid Cluster 93.775/93.777/93.778 COVID-19 ? Medicaid Cluster Federal Award Identification Number / Year: 2005OH5ADM / 2020 2105OH5ADM / 2021 Federal Agency: Department of Health and Human Services Compliance Requirement: Reporting Repeat Finding from Prior Audit? No NONCOMPLIANCE AND MATERIAL WEAKNESS The Federal Funding Accountability and Transparency Act (Pub. L. No. 109-282, as amended by Section 6202 of Public Law 110-252, hereafter referred as the ?Transparency Act? that are codified in 2 C.F.R. Part 170) requires prime recipients of federal awards who make first-tier subawards to report the subaward on the Federal Funding Accountability and Transparency Subaward Reporting System (FSRS) website maintained by the federal Office of Management and Budget. Under the requirements of 2 C.F.R. Part 170, recipients (i.e., direct recipients) of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more on the FSRS website. Prime recipients must report by the end of the month following the month in which the obligation is made. It is management?s responsibility to design and implement internal controls to reasonably ensure compliance with laws and regulations and to ensure management?s objectives are achieved. During state fiscal year 2021, the Department disbursed approximately $38 million for 89 subawards which exceeded $30,000 and were required to be reported on the FSRS website in accordance with the Transparency Act for the Medical Assistance Program (Assistance Listing Program Number 93.778, which is part of the Medicaid Cluster). Through Medicaid Administrative Claiming (MAC), County Boards of Developmental Disabilities and councils of government may be partially reimbursed with federal Medicaid funds for activities that assist individuals to enroll in Medicaid and access Medicaid-covered services. The amount that is billed for administrative activities is based on the Random Moment Time Study model approved by the federal Centers for Medicare and Medicaid Services. The Department is the State?s MAC Program Administrator and is responsible for compiling the time study information from each participating entity and preparing and submitting quarterly claims to the Ohio Department of Medicaid to draw down the federal funds and transfer them to the Department for disbursement to the entities. These disbursements are considered subawards; however, the Department had no procedures in place during the audit period to ensure this subaward information was submitted into the FSRS website. See Schedule of Findings and Questioned Costs for chart/table. By not complying with federal Transparency Act reporting requirements, the Department risks federal funding being reduced, taken away, or other sanctions imposed by the federal grantor agency. If the subawards are not reported within FSRS, potential users cannot access the information. Based upon discussions with management, they did not think the reporting requirement applied to the MAC. We recommend the Department work with the other Medicaid partner agencies to establish Transparency Act reporting responsibilities to ensure compliance with Federal regulations. We also recommend the Department design and implement control procedures to collect complete and accurate information regarding subawards subject to the Transparency Act for entry on the FSRS website. These procedures should include a supervisory review of the report information before it is submitted on the FSRS website.

TITLE I AND ESSER ? TRANSPARENCY ACT REPORTING Finding Number: 2021-007 State Agency Number: EDU-01 Assistance Listing Program Numbers and Titles: 84.010 Title I Grants to Local Educational Agencies 84.425D COVID-19 ? Education Stabilization Fund ? Elementary and Secondary School Emergency Relief Fund (ESSER) Federal Award Identification Number / Year: S010A190035 (Title I) S010A200035 (Title I) S425D200035 (ESSER) S425D210035 (ESSER) Federal Agency: Department of Education Compliance Requirement: Reporting Repeat Finding from Prior Audit? No NONCOMPLIANCE AND MATERIAL WEAKNESS The Federal Funding Accountability and Transparency Act (Pub. L. No. 109-282, as amended by Section 6202 of Public Law 110-252, hereafter referred as the ?Transparency Act? that are codified in 2 C.F.R. Part 170) requires prime recipients of federal awards who make first-tier subawards to report the subaward on the Federal Funding Accountability and Transparency Subaward Reporting System (FSRS) website maintained by the federal Office of Management and Budget. Under the requirements of 2 C.F.R. Part 170, recipients (i.e., direct recipients) of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more on the FSRS website. Prime recipients must report by the end of the month following the month in which the obligation is made. It is management?s responsibility to design and implement internal controls to reasonably ensure compliance with laws and regulations and to ensure management?s objectives are achieved. During state fiscal year (SFY) 2021, the Department disbursed approximately $1.04 billion for 2,063 subawards which exceeded $30,000 and were required to be reported on the FSRS website in accordance with the Transparency Act, under the following major programs. See Schedule of Findings and Questioned Costs for chart/table. The Data Administration Manager runs the SAS Enterprise Guide program on the first of the month to capture the prior month?s allocations exceeding $25,000, exports the data to an Excel master file, and performs a self-review of the data using the Department?s Comprehensive Continuous Improvement Plan (CCIP) system. Once completed, the Excel master file is sent to the Senior Financial Analyst, who separates the files by Federal Award Identification Number (FAIN) and then uploads the data into the FSRS website for processing. Once the report is uploaded into FSRS, the Senior Financial Analyst runs an error report, manually corrects all errors from the report, and resubmits the data into FSRS. However, the following weaknesses in the process were noted: ? The report ran in the SAS Enterprise Guide System was set up to identify individual allocations that exceed $25,000 rather than cumulative allocations that exceed $30,000 as required by the regulations. ? There was no supervisory level review of the subaward information entered into the FSRS website to ensure compliance with reporting requirements and accuracy of the reports. ? The Department does not reconcile the subaward information entered into the FSRS website to available independent sources (such as the USASpending.gov site, an official data source for federal spending) to ensure the reports are complete and accurate. ? The Department did not have formalized policies and procedures in place during the audit period related to Transparency Act reporting. Management indicated they have begun to draft policies and procedures, but they were not finalized during the audit period. As a result of these weaknesses, the following errors were noted: Title I See Schedule of Findings and Questioned Costs for chart/table. These errors were a result of the report that was run in the SAS Enterprise Guide System being run incorrectly and, consequently, the Department was not pulling in subawards with modifications to the original allocation into the FSRS website. We analyzed all 890 subawards submitted during SFY 2021 and noted that of these 890 subawards, modifications to 836 subawards (93.9%) totaling $4,619,846 were not reported in FSRS. ESSER See Schedule of Findings and Questioned Costs for chart/table. The Department indicated that it did not submit ESSER subawards with an obligation date prior to July 1, 2020 within the required deadlines because it was awaiting a determination from the federal awarding agency whether Transparency Act reporting was required for the program. We analyzed all 1,173 subawards reported during SFY 2021 and noted that 246 subawards (21%), totaling $191,144,241, with an obligation date prior to July 1, 2020 were not submitted timely in the FSRS website during SFY 2021. A lack of adequate internal controls over the preparation and review of reports increases the risk the reports submitted to the federal grantor agency are inaccurate and incomplete. By not establishing proper parameters when identifying subawards that require reporting (i.e., amount and cumulative awards), there is an increased risk that not all subawards will be identified and properly reported. In addition, by not complying with federal Transparency Act reporting requirements, the Department risks federal funding being reduced, taken away, or other sanctions imposed by the federal grantor agency. If the subawards are not reported accurately and timely within FSRS, the risk exists that those using the Transparency Reports could be relying on inaccurate information. Based on discussions with management, these errors were due to the lack of a supervisory review of the report compilation prior to submission, the transfer of duties from staff, questions on whether the Transparency Act reporting requirements were applicable for ESSER, as well as oversight during the compilation process We recommend the Department collect and report on the FSRS website complete and accurate information regarding subawards made for all programs subject to the Transparency Act. This should include revising the parameters for gathering subaward information to include the proper dollar threshold and aggregate allocations. We also recommend the Department evaluate its Transparency Act reporting control procedures and update them as necessary to ensure they promote compliance with the Federal regulations, as well as accuracy and completeness of information submitted. These procedures should include, but not be limited to: ? A supervisory review of the report information before it is submitted on the FSRS website. ? A reconciliation of the report information to what is reported on USAspending.gov. ? A method to more accurately pull in amounts from modified allocations. If the Department is unsure about the applicability of compliance requirements for new programs, we recommend the Department reach out to the federal awarding agency, other states, or other resources to obtain guidance/feedback to make informed and timely decisions on how to comply with program requirements. We further recommend the Department continue to develop formalized policies and procedures for the Transparency Act reporting process, have them approved by management, and provide them to all employees involved in the process.

CHILD NUTRITION CLUSTER ? INVENTORY/FEDERAL SCHEDULE AND NOTE Finding Number: 2021-008 State Agency Number: EDU-02 Assistance Listing Program Number and Title: 10.553/10.555/10.556/10.559/10.579 ? Child Nutrition Cluster Federal Award Identification Number / Year: 202120N109942 / 2021 202019N109942 / 2020 Federal Agency: Department of Agriculture Compliance Requirement: Special Tests and Provisions ? Accountability for USDA-Donated Foods Repeat Finding from Prior Audit? Yes Prior Audit Finding Number: 2020-011 NONCOMPLIANCE AND SIGNIFICANT DEFICIENCY 7 C.F.R. Part 250 contains rules and regulations for entities that receive donated foods from the United States Department of Agriculture (USDA) for use in child nutrition programs, including the National School Lunch Program (NSLP) which is part of the Child Nutrition Cluster (CNC). Specifically, 7 C.F.R. ? 250.19(a) requires that distributing agencies, recipient agencies, processors, and other entities must maintain accurate and complete records with respect to the receipt, distribution, and inventory of USDA-donated foods and warns that not maintaining required records must be considered prima facie evidence of improper distribution or loss of donated foods and may result in a claim against such party for the loss or misuse of donated foods per 7 C.F.R ?250.16. Furthermore, 2 C.F.R. ?400.1 gives regulatory effect to the USDA for the Uniform Guidance contained in 2 C.F.R. Part 200. Specifically, 2 C.F.R. ?200.510(b) requires the auditee (the State of Ohio) prepare a Schedule of Expenditures of Federal Awards (Schedule) for the period covered by the auditee's financial statements which must include the total federal awards expended. This includes the distributing agency reporting inventory and the distribution of the donated foods to schools as required by 7 C.F.R. ?250.18. It is management?s responsibility to implement control procedures to reasonably ensure compliance with these requirements. It is also management?s responsibility to implement an adequate system of internal controls to monitor the accuracy and completeness of accounting and inventory records pertaining to federal programs. Sound internal controls also require a review and verification of information and calculations used to compile an auditee?s Schedule and Notes to ensure they are complete and accurate, as well as documentation of the review in some manner. As the pass-through entity of the CNC federal program for the State of Ohio, the Department oversees the distribution of USDA-donated food goods to various local schools throughout the year. Local schools order food from two USDA web systems - Web Based Supply Chain Management (WBSCM) and Fresh Fruit and Vegetables Order Receipt System (FFAVORS). The food is distributed either directly from USDA to the school (FFAVORS orders) or first to a storage facility or processor before being delivered to the school (WBSCM orders). For the NSLP, the Department contracted with two storage facilities to house these foods during the fiscal year and also contracted with a company to perform physical inventory counts of the donated foods in the facilities in December 2020 and June 2021. The total value of all food distributed during state fiscal year (SFY) 2021 was $51.7 million dollars, while the value of the food distributed by the storage facilities was $6.7 million dollars; this is approximately 8.06 % and 1.12%, respectively, of the reported total CNC program expenditures. The Department receives data about the schools? food orders directly from WBSCM and FFAVORS and uploads the data into its Commodities Allocation Tracking System (CATS), an automated inventory process for administering and monitoring the foods donated by USDA. The Department?s procedures require it receive monthly activity reports from the storage facilities which are to be reconciled to CATS. However, the Department did not complete these reconciliations during the audit period due to a CATS issue that began in December 2017 and is still ongoing. Specifically, when school districts ordered food from storage facilities and the number of units shipped by the storage facility differed from the number of units ordered, the shipment was not recorded in CATS. Instead of performing a true reconciliation between CATS and the monthly reports, the Office of Nutrition made adjustments to CATS to reflect the ending inventory amounts on the monthly reports from the storage facilities. As a result, storage facility inventory in CATS as of June 30, 2021 was overstated by $15.8 million (5,516.59%) when compared to the physical inventory of foods on-hand at the facilities. In addition, storage facility distributions in CATS during the audit period were understated by $320,799 (5.06%) when compared to the storage facility?s portion of food commodity distributions recorded on the State of Ohio?s Schedule for SFY 2021. Although the USDA data on food orders reconciled with food orders in CATS, the ending inventory and distributions by the storage facilities did not. Based on the conditions noted above, it appears the CATS system is not operating as intended and the Department did not maintain accurate and complete inventory records during SFY 2021, as required by 7 C.F.R. ?250.19(a). Furthermore, during SFY 2021, the Ohio Office of Budget and Management (OBM) which compiles and prepares the State of Ohio?s Schedule, provided State agencies that received federal funds a reporting package containing a template of the Schedule and its attachments, as well as detailed instructions for completing the reporting package and making adjustments to the award amounts. The Department?s reporting package also included a form and instructions for providing information about donated food commodities from the NSLP, for inclusion in the Schedule?s Note 2, Non-Cash Federal Assistance Programs. To provide the information for Note 2, the Department utilized reports from the warehouse, its pre-processors, and the USDA WBSCM and FFAVORS systems. Management reviewed the Department?s reporting package for accuracy and approved it before submitting it to OBM; however, the Department did not properly calculate or verify the accuracy of the amounts reported as receipts, distributions or the ending inventory. The Department included the $16,827,050 in Fresh Fruits and Vegetables within the distributions but did not report an equal amount within the receipts. The Department reported to OBM $5,872,542 in the food commodities ending inventory for the NSLP although the actual value was $36,816,679, or an understatement of $30,944,137 (84.05%). This resulted in the Department overstating food inventory distributed by $14,117,087. As part of the follow-up on these errors, it was determined the Department used incorrect amounts because it had run the incorrect query on the processors? data, resulting in activity outside SFY 2021 being included in the totals for the last two years. Upon running the correct report, there were additional errors. Once these errors were brought to OBM's attention, the State of Ohio's Schedule and Note 2 were adjusted prior to submission to the Federal government for the following variances: ? The Food Commodity Inventory Distributions understatement of $1,454,530. ? The Food Commodity Ending Inventory understatement of $2,019,564. ? The Food Commodity Beginning Inventory overstatement of $13,352,956. If the Department does not maintain accurate and complete records of the donated foods and obtain preapproval for disposals of food commodities, it is not complying with 7 C.F.R. ?250.19(a). This could subject the Department to repayment for the value of any misplaced food to the USDA or replacement of the goods in-kind, or other sanctions and penalties. Inaccurate inventory records could also prevent schools from placing orders for available foods and lead to misuse or abuse of donated foods to the detriment of those who benefit from the program. It could also affect schools who use and rely on CATS for reporting purposes. By not accurately identifying and reporting the ending inventory value of food commodities, there is an increased risk that program activity and the State of Ohio?s Schedule and Notes may be materially misstated. This could lead to users of the Schedule and Notes making decisions based on inaccurate program activity or information. Based on discussions with management and review of support documents, the Department added a new File Transfer Protocol site that caused problems with importing the monthly activity delivery reports from the storage facilities and did not have the resources to maintain accurate and complete inventory records after the CATS system issue. In addition, the initial errors in the amounts reported on the Schedule and the Note occurred as a result of running the incorrect report, which led to an improper calculation of the amounts. We recommend the Department evaluate and strengthen its existing policies, procedures and CATS system to ensure it updates and maintains complete and accurate inventory records, as well as ensure accuracy and completeness of the food commodity ending inventory reported to OBM for inclusion in the Notes to the State of Ohio?s Schedule. Management should periodically perform and review inventory reconciliations to ensure accuracy, completeness, and proper and timely resolution of variances or reconciling items noted. In addition, management should review and monitor the compilation of information submitted to OBM to ensure it is complete and accurate. The Department should formally document and communicate these policies and procedures to all employees involved in the process and re-evaluate and update the procedures on a regular basis to address any necessary changes.

UNEMPLOYMENT INSURANCE (UI) ? PANDEMIC UNEMPLOYMENT ASSISTANCE (PUA) Finding Number: 2021-009 State Agency Number: JFS-02 Assistance Listing Program Number and Title: 17.225 ? Unemployment Insurance 17.225 COVID-19 ? Unemployment Insurance Federal Award Identification Number / Year: UI-32619-19-55-A-39 / 2019 UI-34078-20-55-A-39 / 2020 UI-35668-21-55-A-39 / 2021 Federal Agency: Department of Labor Compliance Requirements: Activities Allowed or Unallowed, Allowable Costs/Costs Principles, Eligibility Repeat Finding from Prior Audit? Yes Prior Audit Finding Number: 2020-016 QUESTIONED COSTS, NONCOMPLIANCE, AND MATERIAL WEAKNESS $142,772 NOTE: Findings 2021-001, 2021-011, 2021-012, and 2021-017 detail questioned costs, noncompliance, and weaknesses in internal control related to the Unemployment Insurance ? Pandemic Unemployment Assistance program regarding fraud issues, overpayments, and reporting. These findings are integral to and should be read in conjunction with this finding. 15 U.S.C. ? 9021 pertaining to Pandemic Unemployment Assistance, states, in part: (a) Definitions (3) Covered Individual The term ?covered individual? ? (A) means an individual who ? (i) is not eligible for regular compensation or extended benefits under State or Federal law or pandemic emergency unemployment compensation under section 9025 of this title, including an individual who has exhausted all rights to regular unemployment or extended benefits under State or Federal law or pandemic emergency unemployment compensation under section 9025 of this title; ? . . . (c) Applicability (1) In general Except as provided in paragraph (2), the assistance authorized under subsection (b) shall be available to a covered individual? (A) for weeks of unemployment, partial unemployment, or inability to work caused by COVID?19 ? (i) beginning on or after January 27, 2020; and (ii) ending on or before December 31, 2020; and (B) subject to subparagraph (A)(ii), as long as the covered individual?s unemployment, partial unemployment, or inability to work caused by COVID?19 continues. . . . (d) Amount of Assistance . . . (A) (i) the weekly benefit amount authorized under the unemployment compensation law of the State where the covered individual was employed, except that the amount may not be less than the minimum weekly benefit amount described in section 625.6 of title 20, Code of Federal Regulations, or any successor thereto; and (ii) ending on or before December 31, 2020; and (ii) the amount of Federal Pandemic Unemployment Compensation [FPUC] under section 9023 of this title; ? . . . (h) Relationship between pandemic unemployment assistance and disaster unemployment assistance [DUA] Except otherwise provided in this section or to the extent there is a conflict between this section and section?625 of title 20, Code of Federal Regulations, such section?625 shall apply to this section as if: (1) the term ?COVID?19 public health emergency? were substituted for the term ?major disaster? each place it appears in such section?625; and (2) the term ?pandemic? were substituted for the term ?disaster? each place it appears in such section? 625. . . . 20 C.F.R. ? 625.6, pertaining to the weekly amount states, in part: . . . (e) . . . An immediate determination of a weekly amount shall also be made where, in conjunction with the filing of an initial application for DUA, the individual submits documentation substantiating employment or self-employment and wages earned or paid for such employment or self-employment, or, in the absence of documentation, where any State agency records of employment or self-employment and wages earned or paid for such employment or self-employment, justify the determination of a weekly amount. . . . (1) In the case of a weekly amount determined in accordance with paragraph (e) of this section, based only on the individual's statement of earnings, the individual shall furnish documentation to substantiate the employment or self-employment or wages earned from or paid for such employment or self-employment or documentation to support that the individual was to commence employment or self-employment on or after the date the major disaster began. In either case, documentation shall be submitted within 21 calendar days of the filing of the initial application for DUA. (2) Any individual who fails to submit documentation to substantiate employment or self-employment or the planned commencement of employment or self-employment in accordance with paragraph (e)(1) of this section, shall be determined ineligible for the payment of DUA for any week of unemployment due to the disaster. Any weeks for which DUA was already paid on the application prior to the date of the determination of ineligibility under this paragraph (e)(2) are overpaid and a determination shall be issued in accordance with ? 625.14(a). In addition, the State agency shall consider whether the individual is subject to a disqualification for fraud in accordance with the provisions set forth in ? 625.14(i). . . . The federal government has established rules, regulations, and requirements related to eligibility, benefit amounts and timing, monitoring responsibilities, etc. regarding the expanded Unemployment benefits related to the pandemic. It is management?s responsibility to implement controls, processes, and procedures to provide reasonable assurance over the reliability of financial reporting, effectiveness and efficiency of operations, and compliance with these rules, regulations, and requirements. When automated systems are utilized to perform certain functions related to compliance with these requirements, management must ensure the systems are properly designed and operating effectively. Additionally, when the system is not directly administered by the entity, such as when utilizing a service organization, it is critical the appropriate monitoring controls are designed and implemented to reasonably ensure the service organization has adequate controls to achieve management?s goals and objectives and complies with applicable laws and regulations. Attestation standard (AT-C 320), Reporting on an Examination of Controls at a Service Organization Relevant to User Entities? Internal Control Over Financial Reporting, prescribes standards for reporting on service organizations. An unmodified Type 2 Report on Management?s Description of a Service Organization?s System and a Service Auditor?s Report on that Description and on the Suitability of the Design and Operating Effectiveness of Controls (SOC 1 Type 2) in accordance with AT-C 320 should provide management reasonable assurance that Unemployment Insurance benefit claims and payments conform to federal rules and regulations, as well as the contract with the service organization. Auditing standards (AU-C 402B) requires the user auditor to obtain sufficient appropriate audit evidence regarding the services provided by service organizations. The COVID-19 Pandemic presented the Department with many challenges and obstacles including a sharp increase in the volume of unemployment claims as well as the expansion of regular unemployment benefits by the federal government. The Department indicated it did not have the man-power or technology resources to adequately deal with this drastic increase in claim activity and the addition of new federal unemployment funding. The Department?s legacy unemployment system, Ohio Job Insurance (OJI), has been in place since 2004. The Department also indicated that due to OJI?s age and functionality, it was unable to handle the increased volume of claimants brought on by the pandemic. Therefore, the Department contracted with a service organization for processing of pandemic unemployment benefits and maintaining key functions of the benefit claims processing, which were customized to fit Ohio?s needs (effective May 14, 2020). This outside system, the Unemployment Framework for Automated Claim & Tax Services (uFACTS) system, was used for certain pandemic benefits only and maintained key functions of the benefit claims processing for this activity, which were customized to fit Ohio?s needs. During state fiscal year 2021, the Department disbursed more than $14.2 billion in Unemployment benefits, which were recorded in the Unemployment Compensation Fund (a major enterprise fund) and in the Business-Type Activities opinion units in the State of Ohio?s financial statements. Approximately $7.6 billion of the total disbursed related to pandemic Unemployment benefit payments issued during state fiscal year 2021, through the uFACTS system, as follows: See Schedule of Findings and Questioned Costs for chart/table. During this time-frame, fraud imposters recognized the opportunity presented by the unprecedented increase in unemployment claim activity, the relaxed eligibility and employment/earnings verification requirements associated with the new expansion of benefits, and the stress being placed on the Department and its systems to get benefits processed and into the hands of unemployed Ohioans. The combination of high claim volume, lack of effective internal controls, and the increase in imposter fraud negatively impacted the Department?s ability to keep up, creating a backlog of claims pending adjudication. The Department reported to the U.S. Department of Labor Unemployment Compensation overpayments totaling $3.75 billion as of June 30, 2021. Of these total overpayments, $474.6 million was identified as fraud and $3.27 billion as non-fraud relating to regular unemployment as well as federal pandemic unemployment benefits. Approximately $2.75 billion (84%) of the non-fraud overpayments and $449.5 million (95%) of the fraud overpayments were processed through uFACTS.

CCDF CLUSTER / TANF/ SSBG ? INELIGIBLE RECIPIENT Finding Number: 2021-010 State Agency Number: JFS-03 Assistance Listing Program Numbers and Titles: 93.575/93.596 ? CCDF Cluster 93.575/93.596 COVID-19 ? CCDF Cluster 93.558 ? Temporary Assistance for Needy Families (TANF) 93.667 ? Social Services Block Grant (SSBG) Federal Award Identification Number / Year: 1901OHCCDF / 2019 (CCDF Cluster) 2001OHCCDF / 2020 (CCDF Cluster) 2101OHCCDF / 2021 (CCDF Cluster) 1901OHTANF / 2019 (TANF) 2001OHTANF / 2020 (TANF) 2101OHTANF / 2021 (TANF) 2001OHSOSR / 2020 (SSBG) 2101OHSOSR / 2021 (SSBG) Federal Agency: Department of Health and Human Services Compliance Requirement: Eligibility Repeat Finding from Prior Audit? No QUESTIONED COSTS (CCDF CLUSTER, TANF, AND SSBG) $9,543 NONCOMPLIANCE AND MATERIAL WEAKNESS (SSBG) NONCOMPLIANCE AND SIGNIFICANT DEFICIENCY (CCDF CLUSTER AND TANF) 45 C.F.R. Part 98.20, A Child?s Eligibility for Child Care Services states, in part: (a) To be eligible for services under ??98.50, a child shall, at the time of eligibility determination or redetermination: (1)(i) Be under 13 years of age; or, (ii) At the option of the Lead Agency, be under age 19 and physically or mentally incapable of caring for himself or herself, or under court supervision; (2) (i) Reside with a family whose income does not exceed 85 percent of the State's median income (SMI), which must be based on the most recent SMI data that is published by the Bureau of the Census, for a family of the same size; and (ii) Whose family assets do not exceed $1,000,000 (as certified by such family member); and (3)(i) Reside with a parent or parents who are working or attending a job training or educational program; or (ii) Receive, or need to receive, protective services, which may include specific populations of vulnerable children as identified by the Lead Agency, and reside with a parent or parents other than the parent(s) described in paragraph (a)(3)(i) of this section. (A) At grantee option, the requirements in paragraph (a)(2) of this section may be waived for families eligible for child care pursuant to this paragraph, if determined to be necessary on a case-by-case basis. ? In addition, 45 C.F.R. Part 98.45(k) states that ?Lead Agencies shall establish, and periodically revise, by rule, a sliding fee scale(s) for families that receive CCDF child care services...? 45 C.F.R. Part 260, General Temporary Assistance for Needy Families (TANF) Provisions states, in section 31(a): (1) The term ?assistance? includes cash, payments, vouchers, and other forms of benefits designed to meet a family's ongoing basic needs (i.e., for food, clothing, shelter, utilities, household goods, personal care items, and general incidental expenses). (2) It includes such benefits even when they are: (i) Provided in the form of payments by a TANF agency, or other agency on its behalf, to individual recipients; and (ii) Conditioned on participation in work experience or community service (or any other work activity under ??261.30 of this chapter). (3) Except where excluded under paragraph (b) of this section, it also includes supportive services such as transportation and child care provided to families who are not employed. . . 42 U.S.C. Part 1397a relates to payments to States for the Social Services Block Grant (SSBG) and states in section (a)(2), in part: . . . (A) services which are directed at the goals set forth in section 1397 of this title include, but are not limited to, child care services, protective services for children and adults, services for children and adults in foster care, services related to the management and maintenance of the home, day care services for adults, transportation services, family planning services, training and related services, employment services, information, referral, and counseling services,? Furthermore, the Department has incorporated its laws and procedures for the application process for Publicly Funded Child Care (PFCC) within Ohio Administrative Code (OAC) 5101:2-16 which contains numerous requirements a caretaker must provide to be eligible to receive assistance. Specifically, OAC 5101:2-16-02(A) relates to the caretaker?s responsibility for the application for PFCC and states, in part: . . . (1) The caretaker shall complete a PFCC application and submit the application to the county agency that serves the caretaker's county of residence. (a) A valid PFCC application includes ? the applicant's name, address and signature on the form . . . It is management?s responsibility to design and implement internal controls to reasonably ensure compliance with federal and state laws and regulations. During state fiscal year (SFY) 2021, the Department disbursed approximately $595 million in federal assistance to child care providers on behalf of eligible recipients from the CCDF Cluster, TANF, and SSBG programs based on information provided by the 88 County Departments of Job and Family Services (CDJFS). The CDJFS caseworkers are to obtain and maintain a completed and signed application, verify the income and other key information from each applicant, and enter this information into the State?s Child Care Information Data System (CCIDS) for program eligibility and benefit/co-pay amount determinations. The CCIDS eligibility module then analyzes the recipient?s application information and guides the caseworker in determining the applicable federal program eligibility and assigns pay source codes based on program eligibility. As the recipient utilizes their approved child care provider, their attendance is tracked by the Department?s third party system so payments can be made to the provider based on this data. The Department?s Office of Information Services creates an interface file from CCIDS and the third party attendance tracking system to create batches of payments to child care providers. The Office of Fiscal and Monitoring Services then reviews the batches, assigns federal coding, and approves the batches of vouchers for processing. However, the CDJFS did not consistently obtain or maintain documentation of eligibility information, as indicated below: ? For two of 100 (2%) case files selected for testing at 10 CDJFS, the application and supporting documentation did not support the information entered into CCIDS: o For the first case (Lucas), the application was not signed by the recipient, as required. o For the second case (Montgomery), the application and supporting documentation could not be located. As a result, we will question all benefits paid to the child care provider on the recipient?s behalf from the CCDF Cluster, TANF, and SSBG programs, totaling $9,543 (projected to an amount greater than $25,000). However, based on how the Department assigns pay codes during the batch payment process, we were unable to identify the benefits paid from each federal program. Without obtaining or maintaining the required documentation on file, the Department may not be able to fully support or ensure benefit payments are made on behalf of eligible recipients. This could result in questioned payments or fines, penalties, or other sanctions imposed by the federal grantor agency. Based on discussions with Department and CDJFS management, the missing documents were not maintained upon application intake due to oversight by the case worker. We recommend the Department periodically monitor the established controls to determine if they are working as intended by management. We also recommend the Department ensure CDJFS caseworkers are aware of the required information to be obtained and maintained to support eligibility and benefit amount determinations. In addition, Department management should perform periodic reviews of the case files to reasonably ensure application, income, and eligibility information is properly obtained and maintained and accurately entered into CCIDS.

UNEMPLOYMENT INSURANCE (UI) ? DEATH FILE AND INCARCERATION CROSS-MATCHES Finding Number: 2021-011 State Agency Number: JFS-04 Assistance Listing Program Number and Title: 17.225 ? Unemployment Insurance 17.225 COVID-19 ? Unemployment Insurance Federal Award Identification Number / Year: UI-32619-19-55-A-39 / 2019 UI-34078-20-55-A-39 / 2020 UI-35668-21-55-A-39 / 2021 Federal Agency: Department of Labor Compliance Requirements: Activities Allowed or Unallowed, Allowable Costs/Costs Principles, Eligibility Repeat Finding from Prior Audit? No QUESTIONED COSTS AND SIGNIFICANT DEFICIENCY Undetermined NOTE: Finding numbers 2021-009, 2021-012, and 2021-017 contain additional information over the Unemployment Framework for Automated Claim & Tax Services (uFACTS) system used for the Pandemic Unemployment Assistance (PUA) program, as well as noncompliance and weaknesses in internal control regarding fraud issues, overpayments, and reporting. These findings are integral to and should be read in conjunction with this finding. 2 C.F.R. ?2900.4 gives regulatory effect to the Department of Labor for 2 C.F.R. ?200.1 which states, in part: . . . Improper Payment means: (1) Any payment that should not have been made or that was made in an incorrect amount under statutory, contractual, administrative, or other legally applicable requirements. (i) Incorrect amounts are overpayments or underpayments that are made to eligible recipients (including inappropriate denials of payment or service, any payment that does not account for credit for applicable discounts, payments that are for an incorrect amount, and duplicate payments). An improper payment also includes any payment that was made to an ineligible recipient or for an ineligible good or service, or payments for goods or services not received (except for such payments authorized by law). ? The Department of Labor?s Unemployment Program Insurance Letter (UIPL) No. 23-20 provides additional guidance to states regarding program integrity for the regular UI program and for the UI programs authorized by the CARES Act, enacted on March 27, 2020. UIPL 23-20, (4)(b) Program integrity functions for the regular UI programs and CARES Act programs states, in part: . . . The following BPC [Benefit Payment Control] activities are mandatory for states to implement for the regular UI programs on an ongoing basis. States must implement these functions for the PEUC [Pandemic Emergency Unemployment Compensation] and PUA [Pandemic Unemployment Assistance] programs in the same manner as for the regular UI programs. ? National Directory of New Hires Cross-match (UIPL Nos. 13-19 and 19-11). UIPL 13-19 provides detailed, recommended operating procedures for crossmatching with state and national directories of new hire data; ? Quarterly Wage Records Cross-match (20 CFR ? 603.23); and ? Systematic Alien Verification for Entitlement (SAVE) (Section 1137(d) of the Social Security Act (SSA) (42 U.S.C. ?1320b-7). The Department [of Labor] strongly recommends the following additional BPC activities as part of a state?s effective BPC operation for the regular UI programs, PUA, and PEUC: ? State Directory of New Hires Cross-match; ? Social Security Administration (SSA) Cross-match; ? Interstate Benefits (IB) Cross-match; ? State Identification Inquiry (SID) and IB8606 enhancements made to the Interstate Connection (ICON) network cross match to prevent concurrent claim filing in multiple states; ? State Information Data Exchange System (SIDES) (Training and Employment Notice No. 12-16); ? Identity Verification; ? Incarceration Cross-match; and ? UI Integrity Center?s Integrity Data Hub (IDH) tools including the Suspicious Actor Repository (SAR), Suspicious E-Mail Domains, Multi-State Cross-Match (MSCM), Foreign Internet Protocol (IP) Address Detection, and Fraud Alert application. It is management?s responsibility to reasonably ensure control procedures are in place and operating effectively to prevent benefits from being paid to individuals who do not meet the eligibility requirements for the UI program. During state fiscal year (SFY) 2021, the Department disbursed more than $14.2 billion in Unemployment benefits. Approximately $7.6 billion of the total disbursed related to pandemic Unemployment benefit payments issued through the uFACTS system and $6.6 billion of the total disbursed related to regular Unemployment benefit payments issued through the Ohio Job Insurance (OJI) system. For the uFACTS system, the Department relied upon the service organization to review system queries and create the fraud issues that were routed to a management queue depending on the type of issue noted. The OJI system automatically generated the cross-match reports, with the exception of the Benefits/Wage Record which had to be initiated by the Department. However, the Department did not implement the BPC cross-matches for the pandemic Unemployment benefit payments in uFACTS, as required by UIPL 23-30, until February 2021 for the Innovate Ohio matches (e.g, Death, Inmate, Nursing Home, and State Employee) and May 2021 for the SSA cross-matches. In addition, the Department did not implement the cross-matches for SSA and Incarceration in OJI until May 2021. In response to the pandemic, the Department implemented Lexis Nexis (uFACTS) and Experian (OJI) ID verification tools in late March/early April 2021; both of which factor in death when performing ID verification protocols. A cross-match with the Ohio Department of Health?s death data is also performed, but it is after-the-fact, once benefit payments are made. However, an analysis of Unemployment benefits paid during SFY 2021 compared to a data file received from the Ohio Department of Health identified benefits paid to individuals who were deceased prior to the benefit week ending date associated with the benefit payments, as follows. These results did not exclude partial eligibility where the date of death occurred in the benefit week. ? 7,903 weekly claims transactions, totaling $3,095,408 from the uFACTS system. ? 1,793 weekly claims transactions, totaling $709,463 from the OJI system. Anomalies in the amount and name fields contained in the OJI and uFACTS files provided by the Department, as well as the social security number field being limited to the last four digits in the death file provided by the Ohio Department of Health, limited our ability to place a high level of reliance on the completeness and accuracy of the above mentioned results. In addition, we were unable to obtain a reliable incarceration data file from the Ohio Department of Rehabilitation and Correction to perform an independent analysis of Unemployment benefits paid to incarcerated individuals. As a result, we will question costs for an undetermined amount related to regular and pandemic Unemployment claims improperly paid to deceased and incarcerated individuals. Without effective cross-matching against a reliable death record or incarcerated data prior to payment, there is an increased risk that inaccurate or unallowable benefit payments will be made. Overpayments to ineligible claimants may subject the Department to penalties or sanctions from the federal grantor agency which may jeopardize future funding and limit its ability to fulfill program requirements to provide benefits to those in need. We recommend the Department evaluate and strengthen current cross-matching internal control procedures, including those related to deceased and incarcerated individuals, to help identify potential ineligible individuals prior to making payments. We further recommend the Department perform procedures to identify improper payments already made to deceased and incarcerated individuals and seek recovery, reimbursement, or offset future benefits, where necessary.

UNEMPLOYMENT INSURANCE (UI) ? FRAUD ISSUES AND OVERPAYMENTS Finding Number: 2021-012 State Agency Number: JFS-05 Assistance Listing Program Number and Title: 17.225 ? Unemployment Insurance 17.225 COVID-19 ? Unemployment Insurance Federal Award Identification Number / Year: UI-34078-20-55-A-39 / 2020 UI-35668-21-55-A-39 / 2021 Federal Agency: Department of Labor Compliance Requirement: Special Tests and Provisions ? UI Program Integrity ? Overpayments and Reporting Repeat Finding from Prior Audit? Yes Prior Audit Finding Number: 2020-019 NONCOMPLIANCE AND MATERIAL WEAKNESS NOTE: Finding numbers 2021-009, 2021-011, and 2021-017 contain additional information over the Unemployment Framework for Automated Claim & Tax Services (uFACTS) system used for the Pandemic Unemployment Assistance (PUA) program, as well as noncompliance and weaknesses in internal control regarding overpayments and reporting. These findings are integral to and should be read in conjunction with this finding. The Unemployment Program Insurance Letter (UIPL) No. 23-20 provides additional guidance to states regarding program integrity for the regular UI program and for the UI programs authorized by the CARES Act enacted on March 27, 2020. UIPL 23-20, (4)(b) Program integrity functions for the regular UI programs and CARES Act programs, states, in part: ? The following BPC [Benefit Payment Control] activities are mandatory for states to implement for the regular UI programs on an ongoing basis. States must implement these functions for the Pandemic Emergency Unemployment Compensation (PEUC) and PUA programs in the same manner as for the regular UI programs. ? National Directory of New Hires Cross-match (UIPL Nos. 13-19 and 19-11). UIPL 13-19 provides detailed, recommended operating procedures for cross-matching with state and national directories of new hire data; ? Quarterly Wage Records Cross-match (20 CFR Section 603.23); and ? Systematic Alien Verification for Entitlement (SAVE) (Section 1137(d) of the Social Security Act (SSA) (42 U.S.C. Section1320b-7). The Department strongly recommends the following additional BPC activities as part of a state?s effective BPC operation for the regular UI programs, PUA and PEUC: ? State Directory of New Hires Cross-match; ? Social Security Administration (SSA) Cross-match; ? Interstate Benefits (IB) Cross-match; ? State Identification Inquiry (SID) and IB8606 enhancements made to the Interstate Connection (ICON) network cross match to prevent concurrent claim filing in multiple states; ? State Information Data Exchange System (SIDES); ? Identity Verification; ? Incarceration Cross-match; ? UI Integrity Center?s Integrity Data Hub (IDH) tools including Suspicious Actor Repository (SAR), Suspicious E-Mail Domains, Multi-State Cross-Match (MSCM), Foreign Internet Protocol (IP) Address Detection, and Fraud Alert application. 20 C.F.R. ? 625.14 pertaining to overpayments and disqualifications for fraud states, in part: . . . (h) Fraud Detection and prevention. Provisions in the procedures of each State with respect to detection and prevention of fraudulent overpayments of DUA shall be, as a minimum, commensurate with the procedures adopted by the State with respect to regular compensation and consistent with the Secretary's ?Standard for Fraud and Overpayment Detection,? . . . The Unemployment Program Insurance Letter (UIPL) No. 2-12, Change 1 provides additional guidance to states regarding program integrity for the regular UI program and amendments made by the Trade Adjustment Assistance Extension Act of 2011 (TAAEA), states in part: a. Require states to impose a monetary penalty (an amount not less than 15 percent of the erroneous payment) on claimants whose fraudulent acts resulted in overpayments; b. Prohibit states from providing relief from charges to an employer?s UC account when a UC overpayment results from an employer (or an employer?s agent) failing to respond timely or adequately to a request for information by the state agency (i.e., employer or agent at fault), and, at minimum, the employer (or its agent) has established a pattern of failing to respond to such requests; and . . . Ohio Rev. Code ? 4141.35 states, in part: (A) If the director of job and family services finds that any fraudulent misrepresentation has been made by an applicant for or a recipient of benefits with the object of obtaining benefits to which the applicant or recipient was not entitled, and in addition to any other penalty or forfeiture under this chapter, then the director: (1) Shall within four years after the end of the benefit year in which the fraudulent misrepresentation was made reject or cancel such person's entire weekly claim for benefits that was fraudulently claimed, or the person's entire benefit rights if the misrepresentation was in connection with the filing of the claimant's application for determination of benefit rights; (2) Shall by order declare that, for each application for benefit rights and for each weekly claim canceled, such person shall be ineligible for two otherwise valid weekly claims for benefits, claimed within six years subsequent to the discovery of such misrepresentation; (3) By order shall require that the total amount of benefits rejected or canceled under division (A)(1) of this section be repaid to the director before such person may become eligible for further benefits, and shall withhold such unpaid sums from future benefit payments accruing and otherwise payable to such claimant. . . . (B) If the director finds that an applicant for benefits has been credited with a waiting period or paid benefits to which the applicant was not entitled for reasons other than fraudulent misrepresentation, the director shall: (1)(a) Within six months after the determination under which the claimant was credited with that waiting period or paid benefits becomes final pursuant to section 4141.28 of the Revised Code, or within three years after the end of the benefit year in which such benefits were claimed, whichever is later, by order cancel such waiting period and require that such benefits be repaid to the director or be withheld from any benefits to which such applicant is or may become entitled before any additional benefits are paid, provided that the repayment or withholding shall not be required where the overpayment is the result of the director's correcting a prior decision due to a typographical or clerical error in the director's prior decision, or an error in an employer's report under division (G) of section 4141.28 of the Revised Code. . . . Any overpayments made to the individual that have not previously been recovered under an unemployment benefit program of the United States may be recovered in accordance with section 303(g) of the "Social Security Act" and sections 3304(a)(4) and 3306(f) of the "Federal Unemployment Tax Act," 53 Stat. 183 (1939), 26 U.S.C.A. 3301 to 3311. Ohio Rev. Code ? 131.02(A) states, in part: . . . if the amount is not paid within forty-five days after payment is due, the officer, employee, or agent shall certify the amount due to the attorney general, in the form and manner prescribed by the attorney general, and notify the director of budget and management thereof. . . . . During state fiscal year (SFY) 2021, the Department disbursed approximately $14.2 billion in unemployment benefits processed through the Ohio Job Insurance (OJI) and uFACTS systems for the regular unemployment and PUA programs, respectively. The OJI system automatically generated the cross-match reports, with the exception of the Benefits/Wage Record which had to be initiated by the Department. For the uFACTS system, the Department relied upon the service organization to review system queries and create the fraud issues that were routed to a management queue depending on the type of issue noted. The Department did not implement the BPC cross-matches for the PUA benefit payments in uFACTS as required by UIPL 23-30 until February 2021 for the Innovate Ohio (e.g, Death, Inmate, Nursing Home, and State Employee matches) and Employer/Individual Fraud (e.g., identity theft victims, identity theft employers). Furthermore, the SSA cross-matches were not implemented until May 2021. An issue is set when the system cannot determine the impact of the benefit claim or its created based off of cross-matches. Issues suspected of fraud are forwarded to the BPC to be investigated and then adjudicated. An Adjudicator reviews information, known as fact-finding, to make a determination on the benefit claim within 21-days per the Department?s policy based on the Department of Labor (DOL) guidance. Once a determination is made, a Determination Notice or Notice of Overpayment is sent to the claimant. Due to the COVID-19 pandemic, the Department experienced a significant increase in the number of weekly unemployment benefit claims issued through the OJI and uFACTS systems (15,725,641 and 18,321,313, respectively) during the year which had a direct impact on the increase of fraud issues detected. The Department adjudicated 14,934 fraudulent claims for OJI and 181,961 fraudulent claims for uFACTS during SFY 21. However, the process and/or requirements were not consistently followed, as noted below: ? Four of 60 (6.7%) OJI overpayments selected for testing had no evidence the fact-finding questionnaire was sent to the claimant. ? One of 25 (4%) OJI overpayments selected for testing had no evidence the Department sent the claimant a Notice of Determination or Notice of Overpayment which identified the reasoning, basis of the overpayment. ? Of the 45 OJI adjudicated fraud issues selected for testing: - 27 (60%) were not detected/flagged timely (30 days based on auditor?s judgement) from the benefit week ending date. Days between the benefit week ending date and the date of issue, ranged from three to 309 days, for an average of 124 days. - 25 (55.6%) Notice of Determination/Notice of Overpayments were not issued within 21-days (Department policy based on the DOL guidance). Days between the issue determination date and the Notice of Determination/Notice of Overpayment, ranged from four to 273 days, for an average of 82 days. - Eight (17.7%) were not sent the fact-finding questionnaire timely (seven days from the issue determination date based on auditor?s judgement). Days between the issue determination date and the fact-finding, ranged from four to 194 days, for an average of 65 days. - Eight (17.7%) fact-finding questionnaire dates preceded the issue detection date. According to the Department, this was a result of not sending the fact-finding questionnaire for the current issue and relying upon documentation received for a previously resolved issue. Furthermore, there was nothing documented within OJI linking the fact-finding documents to the current issue. ? Of the 45 uFACTS adjudicated fraud issues selected for testing: - 42 (93.3%) were not detected/flagged timely (30 days based on auditor?s judgement) from the initial application date. Days between the initial application and the detection date of the issue ranged from 32 to 367 days, for an average of 149 days. - 33 (73.3%) fact-finding questionnaire dates preceded the issue detection date. According to the Department, this was a result of not sending the fact-finding questionnaire for the current issue and relying upon documentation received for a previously resolved issue. Furthermore, there was nothing documented within uFACTS linking the fact-finding documents to the current issue. - Nine (20%) Notice of Determination/Notice of Overpayments were not issued within 21-days (Department policy based on the DOL guidance). Days between the issue detection date and the Notice of Determination/Notice of Overpayment, ranged from 29 to 213 days, for an average of 115 days. - One (2.2%) had no evidence in uFACTS the fact-finding questionnaire was sent to the claimant. Once an issue has been adjudicated, the Bureau of Payment Control is responsible for determining the claimant?s benefit overpayment and issues a Notice of Overpayment. Overpayments are benefits paid to individuals who are not legally entitled to receive these benefits. Losses through embezzlement or by theft, other than through the benefit payment process, are not counted as overpayments. Overpayments are reported to the DOL in the quarter and/or month in which they occur, which is once adjudication is complete. A fraud overpayment occurs when the material facts related to a determination or payment of a claim are found during the adjudication process to be knowingly misrepresented or concealed (i.e., willful misrepresentation) by the claimant in order to obtain benefits to which the individual is not legally entitled. A non-fraud overpayment occurs when the state agency determines, through adjudication, the overpayment is not due to willful misrepresentations. Non-fraud overpayments result from reversals, state agency errors, employer errors, and claimant errors. The Department reported approximately $474 million in fraudulent overpayments and $3.3 billion in non-fraudulent overpayments processed through OJI and uFACTS to the DOL during SFY 21. The Department will attempt to collect overpayments by sending an appealable overpayment determination to the claimant. If repayment is not received within 45 days after the payment is due, the amount will be certified to the Ohio Attorney General for collection pursuant to Ohio Rev. Code ?131.02. The federal government gave discretion to states to waive the need for a repayment of pandemic funding related to non-fraud overpayments. Claimants must request the waiver from the Department to avoid repayment. The Department certified the fraud and non-fraud overpayments processed through OJI to the Ohio Attorney General for collection; however, the Department did not certify any of the fraud or non-fraud overpayments processed through uFACTS, totaling approximately $449.5 million and $2.75 billion, respectively, for collection during SFY 21. Additionally, the Department has flagged approximately $1.41 billion in potential overpayments for the regular unemployment and the pandemic unemployment assistance programs as of June 30, 2021. Despite being flagged as potential overpayments, a final determination as to whether these are overpayments and/or fraudulent cannot be made until these claims are fully adjudicated. Without proper controls to ensure the timely identification of fraud issues and the adjudication of fraudulent and non-fraudulent issues and overpayment determinations (if applicable), the Department increases the risk of inaccurate or incomplete financial and/or programmatic activity being reported to the federal grantor agency. Furthermore, the Department is limiting the amount of funding available for program activities by not certifying and pursuing collection of the unemployment benefit overpayments for the pandemic unemployment assistance programs. Based on discussions with management, the required cross-matches were not formalized until February 2021 due to delays in program changes and prioritizing system enhancements that were required to process the volume of claims during the COVID-19 pandemic. We recommend the Department continue to implement and evaluate additional controls and procedures related to UI fraud and overpayments, including, but not limited to: ? Periodic management reviews of the cross-match documentation to ensure the matches are being performed timely and as intended. ? Re-evaluating the internal control procedures over the timing of the fact-finding questionnaires generated by the OJI and/or uFACTS systems once an issue has been created. If fact-finding is not automatically generated and sent to the claimant or employer, the Department should document a reason for the delay in the corresponding system. ? Developing procedures to document and/or link the fact-finding information in both systems when the information obtained for a previously created issue and relied upon for current issue. ? Developing a report to monitor the aging of issues created by the cross-matches. This aging report could assign a priority designation or flag issues that have not been processed within 21-days. The Department should use this type of report to prioritize issues, monitor the issue backlog, ensure issues are being addressed timely, and the Notices of Determination are completed and issued in a timely manner. ? Developing and implementing internal control procedures to certify the uFACTS overpayments to the Ohio Attorney General for collection as required by Ohio Rev. Code ? 131.02.

SNAP CLUSTER AND TANF ? IEVS ALERTS Finding Number: 2021-013 State Agency Number: JFS-06 Assistance Listing Program Numbers and Titles: 10.551/10.561 ? SNAP Cluster 93.558 ? Temporary Assistance for Needy Families (TANF) Federal Award Identification Number / Year: 192OH102S2514 / 2019 (SNAP Cluster) 192OH102S6018 / 2019 (SNAP Cluster) 202OH102S2514 / 2020 (SNAP Cluster) 202OH102S6018 / 2020 (SNAP Cluster) 212OH102S2514 / 2021 (SNAP Cluster) 212OH102S6018 / 2021 (SNAP Cluster) 1801OHTANF / 2018 (TANF) 1901OHTANF / 2019 (TANF) 2001OHTANF / 2020 (TANF) 2101OHTANF / 2021 (TANF) Federal Agencies: Department of Agriculture Department of Health and Human Services Compliance Requirements: Eligibility, Special Tests and Provisions ? Income Eligibility Verification System Repeat Finding from Prior Audit? Yes Prior Audit Finding Number: 2020-020 NONCOMPLIANCE AND MATERIAL WEAKNESS NOTE: Finding numbers 2021-002, and 2021-018 contain additional information which is integral to and should be read in conjunction with this finding. 7 C.F.R. ?272.8(c), states the following regarding the Supplemental Nutrition Assistance Program (SNAP) Cluster: (1) State agency action on information items about recipient households shall include: (i) Review of the information and comparison of it to case record information; (ii) For all new or previously unverified information received, contact with the households and/or collateral contacts to resolve discrepancies as specified in ???273.2(f)(4)(iv) and 273.2 (f)(9)(iii) and (f)(9)(iv); and (iii) If discrepancies warrant reducing benefits or terminating eligibility, notices of adverse action. (2) State agencies must initiate and pursue the actions on recipient households specified in paragraph (c)(1) of this section so that the actions are completed within 45 days of receipt of the information items. Actions may be completed later than 45 days from the receipt of information if: (A) The only reason that the actions cannot be completed is the nonreceipt of verification requested from collateral contacts; and (B) The actions are completed as specified in ? 273.12 of this chapter when verification from a collateral contact is received or in conjunction with the next case action when such verification is not received, whichever is earlier. (3) When the actions specified in paragraph (c)(1) of this section substantiate an over issuance, State agencies must establish and take actions on claims as specified in ??273.18 of this chapter. (4) State agencies must use appropriate procedures to monitor the timeliness requirements in paragraph (c)(2) of this section. 45 C.F.R. ?205.56(a)(1)(iv) states the following regarding the Temporary Assistance for Needy Families (TANF) program: For individuals who are recipients when the information is received or for whom a decision could not be made prior to authorization of benefits, the State agency shall within forty-five (45) days of its receipt, initiate a notice of case action or an entry in the case record that no case action is necessary, except that: Completion of action may be delayed beyond forty-five (45) days on no more than twenty (20) percent of the information items targeted for follow-up, if: (A) The reason that the action cannot be completed within forty-five (45) days is the nonreceipt of requested third-party verification; and (B) Action is completed promptly, when third party verification is received or at the next time eligibility is redetermined, whichever is earlier. If action is completed when eligibility is redetermined and third party verification has not been received, the State agency shall make its decision based on information provided by the recipient and any other information in its possession. It is management?s responsibility to implement controls, processes, and procedures to ensure compliance with these regulations. When automated systems are utilized to perform certain functions related to this compliance, management must ensure the system is properly designed and operating effectively. The Ohio Benefits system is utilized for processing eligibility for the SNAP Cluster and TANF programs with total expenditures to recipients of approximately $3.3 billion and $235 million, respectively, in state fiscal year (SFY) 2021. The Ohio Benefits system, administered by the Ohio Department of Administrative Services (DAS) for various public assistance programs, includes an Income Eligibility Verification System (IEVS) which compares income, as reported by the recipients, to information maintained by outside sources. Information that does not agree is communicated in the form of an Ohio Benefits system alert, which is forwarded to the appropriate county for investigation and resolution. Each alert has a defined due date, which is unique based on the priority level and other policy and process related factors. During SFY 2021, more than 25.5 million alerts were issued (9.8 million IEVS alerts and 15.7 million non-IEVS alerts) for all public assistance programs that utilize Ohio Benefits, including the SNAP Cluster and TANF programs. Ongoing enhancements to the Ohio Benefits alerts process were made in coordination with the Ohio Benefits Project Team (personnel from the Department, the Ohio Department of Medicaid, and DAS) throughout the audit period. During SFY 2021, the enhancements addressed design weaknesses on 12 sources of alerts, reducing the backlog to 8.8 million alerts at fiscal-year-end that required county investigation and follow-up. Although DAS has made several enhancements to OB related to improving the IEVS alert process, the following design weaknesses existed during the audit period for both the BENDEX IEVS alert process and the non-IEVS alert process, which DAS plans to continue working on: multiple and repetitive alerts (redundancy), irrelevant alerts (zero or small dollar amounts), and alerts being received on persons not receiving public assistance. These design weaknesses created a large volume of information being sent to the counties, resulting in an increased workload and ineffective application of the alert process. As a result of the extremely high number of alerts and weaknesses detected, the Department suspended its Fraud Control Triad Reviews in March 2020 and they resumed in January 2021 as enhancements were made to the Ohio Benefits system and weaknesses began to be corrected. In addition, the Department continues to suspend monthly IEVS reviews until the alert volume is more manageable; however, the Department continues to encourage counties to work alerts. The Department also conducted trainings for county caseworkers in October 2020 and June 2021, including the creation of job aids, training resources, and access to IEVS coordinators; however, these trainings were not required to be attended by all county caseworkers. Therefore, the Department did not have effective controls or procedures in place to review and monitor the IEVS alerts generated and processed by the Ohio Benefits system to ensure they were being completed by the counties in accordance with the requirements and timeframes established in 7 C.F.R. ?272.8, and 45 C.F.R. ?205.56. Furthermore, an Ohio Benefits report showed 1,708,837 of the 2,500,659 (68%) IEVS alerts sent to the counties during the audit period were not cleared within 45 days as required. The alerts were cleared between one and 470 days beyond the 45-day requirement, for an average of 125 days late. Failure to correct system design weaknesses, perform monitoring activities, mandate training for county caseworkers, and complete IEVS alerts within the established timeframes increases the risk benefits given to ineligible recipients or for inappropriate amounts will not be identified timely. This condition could adversely affect the Department?s ability to comply with IEVS requirements for these federal programs which could result in federal sanctions or penalties. Based on discussions with management, systemic issues and increased county caseworker work load led to the issues identified. DAS management indicated they recognize the alert process needs further refinement and they are taking steps to reduce the volume of alerts and add enhancements to the Ohio Benefits System. We recommend Department management continue to work collectively with the related state agencies to implement/update robust processes, procedures, and system controls to address the weaknesses associated with the IEVS process within the Ohio Benefits system. These changes/updates should include, but not be limited to: ? Performing periodic and timely reviews at the Department level to monitor the status and completion of IEVS alerts. Such procedures should also include required monitoring by each County IEVS Coordinator or other supervisory personnel (through the eligibility system), which should be explicitly identified in the sub-grant agreements with the counties and include appropriate ramifications for noncompliance with the stated requirements. ? Including a more centralized evaluation of alert activity and/or better use of automated tools to vet and prioritize items requiring follow-up at the county level. This would allow Department level personnel to become more experienced and adept at identifying and investigating anomalies and help focus the resources of both Department and county personnel. ? Monitoring the IEVS alert processing procedures guide for the alerts issued by the Ohio Benefits system to ensure alerts are properly documented within the system, worked within the proper timeframes, and proper verification documentation is obtained and maintained by the counties for resolved alerts. ? Determining if the IEVS training for county caseworkers is working effectively to ensure they have the knowledge to properly document and resolve IEVS alerts generated by the Ohio Benefits system. We also recommend Department management continue to monitor the status of system enhancements and roll-out of resources to the appropriate personnel to ensure they are implemented timely and as planned.

TANF AND ADOPTION ASSISTANCE ? FEDERAL REPORTING Finding Number: 2021-014 State Agency Number: JFS-07 Assistance Listing Program Numbers and Titles: 93.558 ? Temporary Assistance for Needy Families (TANF) 93.558 COVID-19 ? TANF 93.659 Adoption Assistance Federal Award Identification Number / Year: 2001OHTANF / 2020 (TANF) 1901OHTANF / 2019 (TANF) 1801OHTANF / 2018 (TANF) 2101OHADPT / 2021 (Adoption Assistance) Federal Agency: Department of Health and Human Services Compliance Requirement: Reporting Repeat Finding from Prior Audit? Yes Prior Audit Finding Number: 2020-021 NONCOMPLIANCE AND MATERIAL WEAKNESS 45 C.F.R. ? 75.302 contains the Department of Health and Human Services uniform administrative requirements for grants to state and local governments relating to financial administration and standards for financial management systems. Specifically, 45 C.F.R. ? 75.302 states, in part: (a) Each state must expend and account for the Federal award in accordance with state laws and procedures for expending and accounting for the state?s own funds. In addition, the state?s and the other non-Federal entity?s financial management systems, including records documenting compliance with Federal statutes, regulations, and the terms and conditions of the Federal award, must be sufficient to permit the preparation of reports required by general and program-specific terms and conditions; and the tracing of funds to a level of expenditures adequate to establish that such funds have been used according to the Federal statutes, regulations, and the terms and conditions of the Federal award. . . (b) The financial management system of each non-Federal entity must provide for the following (see also Sections 75.361, .362, .363, .364, and .365): . . . (2) Accurate, current, and complete disclosure of the financial results of each Federal award or program in accordance with the reporting requirements set forth in Section 75.341 and .342? (3) Records that identify adequately the source and application of funds for federally-funded activities. These records must contain information pertaining to Federal awards, authorizations, obligations, unobligated balances, assets, expenditures, income and interest and be supported by source documentation. . . . It is management?s responsibility to implement control policies and procedures to reasonably ensure the federal reports they submit are accurate, complete, and in compliance with program requirements. It is imperative that management be able to provide the underlying data and related program documentation required to prepare and support these reports. The Department?s Bureau of Grants Management and Federal Reporting Services (the Bureau) is responsible for the preparation of various federal financial expenditure reports, including the annual TANF ACF-204 and quarterly TANF ACF-196R and Adoption Assistance CB-496 reports. The Bureau runs reports from various computer systems, transfers this information to the applicable federal reports, and submits them for a two level review process prior to submitting them to the federal grantor agency. However, the Bureau?s review of federal reports was not adequate and/or operating effectively. As a result, the following errors were identified in the reports tested during state fiscal year 2021: ? For the annual TANF ACF-204 report: o For the Publicly Funded Child Care Services program, the Total Number of Families Served under the Program with MOE funds was reported as 79,762; however, the supporting documentation showed the amount should be 78,762, for an overstatement of 1,000. o For the Ohio Association of Second Harvest Foodbanks program, the Total Number of Families Served under the Program with MOE funds was properly reported as 1,853,246 families; however, the report incorrectly indicated this amount included the average monthly total for the fiscal year. ? For one of two (50%) quarterly TANF ACF-196R reports selected for testing (quarter ending September 30, 2020): o The Bureau over reported Line 20c ? Additional Child Welfare Services cumulative expenditures by $2,871,738. In addition, the Bureau under reported Line 22a - Administrative Costs and Line 22b - Assessment/Service Provision cumulative expenditures by $439,782 and $2,431,956 respectively. The net effect of these errors was $0 so the report was mathematically accurate in total. ? For one of two (50%) quarterly Adoption Assistance CB-496 reports selected for testing (quarter ending December 31, 2020): o The Bureau under reported Line 22 - Administrative Costs Agency prior quarter total adjustments by $517,742 and the federal share by $258,871. In addition, the Bureau over reported Line 23 - Administrative Costs - Non-Recurring prior quarter total and federal share adjustments by these same amounts. The net effect of these errors was $0 so the report was mathematically accurate in total. A lack of adequate internal controls over federal reporting increases the risk that reports submitted to the federal grantor agency are inaccurate. If the underlying data for the submitted reports cannot be readily verified, the Department and the federal government may not be reasonably assured the information is accurate and complete. Reporting inaccurate or incomplete information could subject the Department to federal sanctions, limiting the amount of funding for program activities. Based on discussions with management, these errors were due to oversight. We recommend the Department evaluate current procedures and implement additional policies and procedures as necessary to provide reasonable assurance the data being reported for all federal programs is reasonable and accurate and agrees to supporting documentation. The Department should ensure all reports (and any necessary corrections to reports) are reviewed and approved by the appropriate level of management.

TRANSPARENCY ACT REPORTING ? VARIOUS PROGRAMS Finding Number: 2021-015 State Agency Number: JFS-08 Assistance Listing Program Numbers and Titles: 17.225 ? Unemployment Insurance (UI) 17.225 COVID-19 ? UI 17.258/17.259/17.278 ? WIOA Cluster 93.558 ? Temporary Assistance for Needy Families (TANF) 93.558 COVID-19 ? TANF 93.575/93.596 ? CCDF Cluster 93.575/93.596 COVID-19 ? CCDF Cluster 93.658 ? Foster Care Title IV-E (FC) 93.775/93.777/93.778 ? Medicaid Cluster 93.775/93.777/93.778 COVID-19 ? Medicaid Cluster 93.767 ? Children?s Health Insurance Program (CHIP) 93.767 COVID-19 ? CHIP Federal Award Identification Number / Year: UI-34515-20-60-A-39 / 2020 (UI) AA332491955A39 / 2020 (WIOA Cluster) AA348122055A39/ 2020 (WIOA Cluster) AA3211861855A39 / 2021 (WIOA Cluster) 1901OHTANF / 2019 (TANF) 2001OHTANF / 2020 (TANF) 2101OHTANF / 2021 (TANF) 2001OHCCDD / 2020 (CCDF Cluster) 2101OHCCDD / 2021 (CCDF Cluster) 2001OHFOST / 2020 (FC) 2101OHFOST / 2021 (FC) 2005OHINCT / 2020 (Medicaid) 2105OHINCT / 2021 (Medicaid) 2005OH5021 / 2020 (CHIP) 2105OH5021 / 2021 (CHIP) Federal Agencies: Department of Labor Department of Health and Human Services Compliance Requirement: Reporting Repeat Finding from Prior Audit? No NONCOMPLIANCE AND MATERIAL WEAKNESS The Federal Funding Accountability and Transparency Act (Pub. L. No. 109-282, as amended by Section 6202 of Public Law 110-252, hereafter referred as the ?Transparency Act? that are codified in 2 CFR Part 170) requires prime recipients of federal awards who make first-tier subawards to report the subaward on the Federal Funding Accountability and Transparency Subaward Reporting System (FSRS) website maintained by the federal Office of Management and Budget. Under the requirements of 2 C.F.R. Part 170, recipients (i.e., direct recipients) of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more on the FSRS website. Prime recipients must report by the end of the month following the month in which the obligation is made. It is management?s responsibility to design and implement internal controls to reasonably ensure compliance with laws and regulations and to ensure management?s objectives are achieved. During state fiscal year 2021, the Department disbursed approximately $1.8 billion for 765 subawards which exceeded $30,000 and were required to be reported on the FSRS website in accordance with the Transparency Act, under the following major programs. See Schedule of Findings and Questioned Costs for chart/table. For county subaward reporting, the Office of County Finance and Technical Assistance coordinated the filing of the reports for the subsidy payments processed through the County Finance Information System Web (CFIS), which makes up approximately 90% of the subaward reporting. The Senior Fiscal Analyst runs a report in Ohio Administrative Knowledge System (OAKS) Business Intelligence (BI) that lists all the grant distributions from the previous month, compares the report to the CFIS system, and then enters the information into the FSRS website. For contracts and state subaward reporting, the Office of Contracts and Acquisitions runs a report from OAKS BI that lists all contracts and acquisitions the Department entered into in the prior month. The Senior Financial Analyst then reviews the listing and contacts the various program areas to determine the information to be reported on the FSRS website. However, there was no supervisory level review of the state, contracts, or county subaward information entered on the FSRS website to ensure compliance with reporting requirements and accuracy of the reports. As a result, the following errors were noted: Unemployment Insurance See Schedule of Findings and Questioned Costs for chart/table. WIOA Cluster See Schedule of Findings and Questioned Costs for chart/table. TANF See Schedule of Findings and Questioned Costs for chart/table. CCDF Cluster See Schedule of Findings and Questioned Costs for chart/table. Foster Care See Schedule of Findings and Questioned Costs for chart/table. Medicaid Cluster See Schedule of Findings and Questioned Costs for chart/table. CHIP See Schedule of Findings and Questioned Costs for chart/table. A lack of adequate internal controls over the preparation and review of reports increases the risk the reports submitted to the federal grantor agency are inaccurate and incomplete. In addition, by not complying with federal Transparency Act reporting requirements, the Department risks federal funding being reduced, taken away, or other sanctions imposed by the federal grantor agency. If the subawards are not reported accurately and timely within FSRS, the risk exists that those using the Transparency Reports could be relying on inaccurate information. Based on discussions with management, these errors were due to the lack of a supervisory review of the report compilation prior to submission, as well as oversight during the compilation process. We recommend the Department collect and report on the FSRS website complete and accurate information regarding subawards made for all programs subject to the Transparency Act. We also recommend the Department evaluate its Transparency Act reporting control procedures and update them as necessary to ensure they promote compliance with the Federal regulations, as well as accuracy and completeness of information submitted. These procedures should include a supervisory review of the report information before it is submitted on the FSRS website.

IT ? UI FUTA CERTIFICATION MATCH Finding Number: 2021-016 State Agency Number: JFS-09 Assistance Listing Program Number and Title: 17.225 ? Unemployment Insurance 17.225 COVID-19 ? Unemployment Insurance Federal Award Identification Number / Year: UI-32619-19-55-A-39 / 2019 UI-34070-20-55-A-39 / 2020 UI-34078-20-55-A-39 / 2020 UI-35668-21-55-A-39 / 2021 Federal Agency: Department of Labor Compliance Requirement: Special Tests and Provisions - Match with IRS 940 FUTA Tax Form Repeat Finding from Prior Audit? Yes Prior Audit Finding Number: 2020-026 NONCOMPLIANCE AND SIGNIFICANT DEFICIENCY 26 C.F.R. ? 31.3302(a)-3(a), pertaining to proof of credit states, in part: Credit against the tax for any calendar year for contributions paid into State unemployment funds shall not be allowed unless there is submitted to the district director: (a) A certificate of the proper officer of each State (the laws of which required the contributions to be paid) showing, for the taxpayer: (1) The total amount of contributions required to be paid under the State law with respect to such calendar year (exclusive of penalties and interest) which was actually paid on or before the date the Federal return is required to be filed; and (2) The amounts and dates of such required payments (exclusive of penalties and interest) actually paid after the date the Federal return is required to be filed. (b) A statement by the taxpayer that no part of any payment made by him into a State unemployment fund for such calendar year, which is claimed as a credit against the tax, was deducted or is to be deducted from the remuneration of individuals in his employ. Such statement shall contain or be verified by a written declaration that it is made under the penalties of perjury. (c) Such other or additional proof as the Commissioner or the district director may deem necessary to establish the right to the credit provided for under section 3302(a). States are required to annually certify for each taxpayer the total amount of contributions required to be paid under the State law for the calendar year and the amounts and dates of such payments in order for the taxpayer to be allowed the credit against the FUTA tax (26 C.F.R. ? 31.3302(a)-3(a)). In order to accomplish this certification, States annually perform a match of employer tax payments with credit claimed for these payments on the employer?s IRS 940 FUTA tax form. The Employment Resource Information Center (ERIC) system is the web-based system used to collect and process Ohio unemployment taxes and store and report wage information for Ohio employers. During state fiscal year 2021, approximately $1.15 billion in unemployment compensation taxes were collected and processed by the ERIC system. However, the record count of the Input File received from the IRS had one additional record when compared to the Certification File returned to the IRS. Therefore, one in 200,713 (0.000498%) records was not certified and reported on the Certification File returned to the IRS. In addition, three of 60 (5%) sampled certifications from the IRS_CERT table did not match the payments included in the ERIC system. Further analysis and inquiry with the client indicated a bug within the source code of the ERIC system caused unemployment tax payment information to not be properly populated in the IRS_CERT table for transactions with a Form Type Indicator of 4. The Department?s FUTA certification process controls did not identify this exception. For state fiscal year 2021, unemployment tax payment transactions with a Form Type Indicator 4 represented 4,109 (2.04%) of the 200,712 total transactions. Wage reports provide the basis for possible benefit claim awards. Inaccurate and untimely reporting increases the risk taxpayers may not be able to properly claim credit against FUTA taxes. Errors or discrepancies in reporting may also require additional reporting for the employer. We recommend the Department review existing FUTA certification controls and/or update policies and procedures to ensure tax payments meet the stated criteria for the FUTA tax credits allowance (e.g., timely state unemployment tax filings and payments). Additionally, we recommend Department management continually monitor these procedures to ensure the compliance requirements of the program, as well as management?s overall objectives, are being met.

UNEMPLOYMENT INSURANCE (UI) ? PUA REPORTING Finding Number: 2021-017 State Agency Number: JFS-10 Assistance Listing Program Number and Title: 17.225 COVID-19 ? Unemployment Insurance Federal Award Identification Number / Year: UI-34078-20-55-A-39 / 2020 UI-35668-21-55-A-39 / 2021 Federal Agency: Department of Labor Compliance Requirement(s): Reporting Repeat Finding from Prior Audit? Yes Prior Audit Finding Number: 2020-019 MATERIAL WEAKNESS NOTE: Finding numbers 2021-009, 2021-011, and 2021-012 contain additional information over the Unemployment Framework for Automated Claim & Tax Services (uFACTS) system used for the Pandemic Unemployment Assistance (PUA) program, as well as noncompliance and weaknesses in internal control regarding fraud issues and overpayments. These findings are integral to and should be read in conjunction with this finding. 15 U.S.C. ? 9021 pertaining to PUA, states, in part: . . . (h) Relationship between pandemic unemployment assistance and disaster unemployment assistance [DUA] Except otherwise provided in this section or to the extent there is a conflict between this section and section?625 of title 20, Code of Federal Regulations, such section?625 shall apply to this section as if: (1) the term ?COVID?19 public health emergency? were substituted for the term ?major disaster? each place it appears in such section?625; and (2) the term ?pandemic? were substituted for the term ?disaster? each place it appears in such section?625. 20 C.F.R. ? 625.14 pertaining to overpayments and disqualifications for fraud, states, in part: . . . (h) Fraud Detection and prevention. Provisions in the procedures of each State with respect to detection and prevention of fraudulent overpayments of DUA shall be, as a minimum, commensurate with the procedures adopted by the State with respect to regular compensation and consistent with the Secretary's ?Standard for Fraud and Overpayment Detection,? . . . Furthermore, UI Reports Handbook No. 401 contain instructions for completing and submitting various reports for the UI program. Included in the handbook is the ETA 902P Pandemic Unemployment Assistance Activities report, described in section IV-4 of the Handbook, which states, in part: The ETA 902P report contains monthly data on PUA activities provided by the Coronavirus Aid, Relief, and Economic Security (CARES) Act of 2020 (Pub. Law 116-136), enacted on March 27, 2020. PUA is a temporary Federal program created under the CARES Act to provide relief for workers affected by the coronavirus who do not qualify for other Federal benefits such as regular unemployment insurance or extended benefits. ? Reports shall be submitted electronically each month providing PUA activities performed during the preceding calendar month. It is management?s responsibility to establish and implement internal control procedures to ensure program objectives and requirements are met and information (both financial and non-financial) is accurately and completely processed and maintained. Additionally, outsourcing critical functions of an entity?s IT architecture and systems can have a significant impact on an agency?s internal controls. Effective management of these risks requires the implementation of monitoring controls to ensure manual and automated controls are operating effectively. During state fiscal year (SFY) 2021, the Department disbursed approximately $7.6 billion in pandemic unemployment benefits for the PUA, the Pandemic Emergency Unemployment Compensation (PEUC), and the Federal Pandemic Unemployment Compensation (FPUC) programs. The Department reports the activities for the pandemic unemployment assistance programs to the Department of Labor (DOL) on the ETA 902P report on a monthly basis. This report includes the number of applicants, number of claimants determined eligible, and overpayments related to fraud, identity theft, and overpayments. The data for the ETA 902P report is obtained from uFACTS and the appeals data from the Unemployment Compensation Review Commission. The Department?s Office of Unemployment Operations is responsible for reviewing the data and compiling the report. Then the Accounting Unit obtains and submits the ETA 902P report to the DOL via the Unemployment Insurance Data Base system for data validation. If there are no errors, the report is transmitted to the DOL. However, for 11 of 12 (91.8%) months of the fiscal year, the Department did not verify the monthly data reported from uFACTS and the Unemployment Compensation Review Commission was accurate and complete prior to submission to DOL. Additionally, there was no output from the Unemployment Insurance Data Base system since PUA, PEUC, and FPUC were new programs with no comparative data, thereby increasing the reliance of the Department?s data validation prior to submission. As of June 2021, the Department implemented data validation procedures for the ETA 902P report. After the data is obtained from uFACTS, the Unemployment Insurance?s Systems Support is responsible for reviewing the data/records at an aggregate level and determine if any cells should be examined further due to a high or low volume count. Systems Support will also review individual records by sampling and verifying that the transactions are accurate and ensuring the data included in the report is accurate. The lack of adequate internal controls over reporting increases the risk of inaccurate or incomplete pandemic unemployment activities being reported to the federal grantor agency. If the underlying data for the submitted reports cannot be readily verified, the Department and the federal government may not be reasonably assured the information is accurate and complete. Based on discussions with management, a Standard Operating Procedures document was not formalized until May 2021 to address the ETA 902P?s data validation procedures. This was a direct result of delays in program changes due to prioritized system enhancements required to process the volume of claims during the COVID-19 pandemic. We recommend the Department continue its efforts of verifying the monthly reports generated from the uFACTS system and/or the Unemployment Insurance Data Base. Procedures should be updated as new data elements are added or removed to ensure the data reported on the ETA 902P reports are accurate, complete, and in compliance with federal requirements. We also recommend management implement periodic monitoring procedures to ensuring the established controls are operating effectively and as intended.

SNAP CLUSTER AND TANF ? ELIGIBILITY SYSTEM Finding Number: 2021-018 State Agency Number: JFS-11 Assistance Listing Program Numbers and Titles: 10.551/10.561 ? SNAP Cluster 93.558 ? Temporary Assistance for Needy Families (TANF) Federal Award Identification Number / Year: 192OH102S2514 / 2019 (SNAP Cluster) 192OH102S6018 / 2019 (SNAP Cluster) 202OH102S2514 / 2020 (SNAP Cluster) 202OH102S6018 / 2020 (SNAP Cluster) 212OH102S2514 / 2021 (SNAP Cluster) 212OH102S6018 / 2021 (SNAP Cluster) 1801OHTANF / 2018 (TANF) 1901OHTANF / 2019 (TANF) 2001OHTANF / 2020 (TANF) 2101OHTANF / 2021 (TANF) Federal Agencies: Department of Agriculture Department of Health and Human Services Compliance Requirement: Eligibility Repeat Finding from Prior Audit? Yes Prior Audit Finding Number: 2020-027 MATERIAL WEAKNESS NOTE: Finding numbers 2021-002 and 2021-013 contain additional information which is integral to and should be read in conjunction with this finding. 7 C.F.R. ? 272.10(b)(1)(i), pertaining to the SNAP Cluster, states in part, that a State?s system should: Determine eligibility and calculate benefits or validate the eligibility worker?s calculations by processing and storing all casefile information necessary for the eligibility determination and benefit computation (including but not limited to all household members? names, addresses, dates of birth, social security numbers, individual household members? earned and unearned income by source, deductions, resources and household size)? 45 C.F.R. ? 206.10(a), pertaining to public assistance programs, including TANF, states in part: ? (8) Each decision regarding eligibility or ineligibility will be supported by facts in the applicant?s or recipient?s case record? ? (12) The State agency shall establish and maintain methods by which it shall be kept currently informed about local agencies' adherence to the State plan provisions and to the State agency's procedural requirements for determining eligibility, and it shall take corrective action when necessary. As the lead agency responsible for administering the SNAP Cluster and TANF federal grant awards for the State of Ohio, the Department is responsible for providing reasonable assurance only eligible individuals receive assistance and documentation maintained is accurate, complete, and properly recorded in the Ohio Benefits system to ensure appropriate eligibility determinations. It is the Department?s responsibility to implement sufficient controls, systems, processes, and procedures to reasonably ensure compliance with the rules and regulations associated with these programs and only eligible recipients receive benefits. The Department is also responsible for overall program compliance and must have appropriate oversight and monitoring procedures in place to ensure those they rely on are operating in accordance with all expectations, guidelines, and requirements related to their tasks. During state fiscal year (SFY) 2021, the Department disbursed a combined total of nearly $3.5 billion in public assistance payments, to recipients processed through the Ohio Benefits system related to the following programs: See Schedule of Findings and Questioned Costs for chart/table. These programs are administered using a multi-agency approach, as follows: overall compliance and administration of the SNAP Cluster and TANF programs fall under the Department, and programming and administration of the State?s eligibility determination computer system, Ohio Benefits, falls under the Ohio Department of Administrative Services (DAS). The Ohio Benefits system contains the eligibility and benefit information/determinations for these programs, including the Income Eligibility Verification System (IEVS) functionality which compares reported recipient income to income information maintained by outside data sources (SSA, IRS, etc.). The Department also utilizes the 88 Ohio counties in the eligibility determination process to work with applicants, receive/enter eligibility documentation into the Ohio Benefits system, and follow up on alerts issued by the system. Currently, individuals applying to receive public assistance benefits complete an application through various methods. The County Departments of Job & Family Services (CDJFS) collect and maintain any documentation provided by the individual either in a paper case file or in the OnBase Enterprise Documentation Management System (EDMS) maintained under contract by DAS and utilized by the Department. After collecting documentation, the county caseworker enters the individual?s information into the Ohio Benefits system which determines the initial eligibility benefit amount and assigns the benefit aid category, where applicable. This process is also used to perform eligibility redeterminations on an annual basis or when prompted through a system alert. Once the determination is made, the Ohio Benefits system uploads the eligibility information to the Department?s payment system for processing. During SFY 2021, we noted the following weaknesses in the eligibility process: ? Alerts ? The Ohio Benefits system is designed to issue alerts to county caseworkers for a variety of items which require review, evaluation, follow-up, and a determination about the impact on the related case and/or program benefits. During SFY 2021, more than 25.5 million alerts were issued according to DAS records (more than 9.8 million IEVS alerts and 15.7 million non-IEVS alerts). Ongoing enhancements to the Ohio Benefits alerts process were made in coordination with the Ohio Benefits Project Team (personnel from the Department, the Ohio Department of Medicaid (MCD), and DAS) throughout the audit period. During SFY 2021, the enhancements addressed design weaknesses on 12 sources of alerts, reducing the backlog to 8.8 million alerts at fiscal-year-end that required county investigation and follow-up. Although DAS has made several enhancements to OB related to improving the IEVS alert process, the following design weaknesses existed during the audit period for both the BENDEX IEVS alert process and the non-IEVS alert process, which DAS plans to continue working on: o Multiple and repetitive alerts (redundancy). o Irrelevant alerts (zero or small dollar amounts). o Alerts being received on persons not receiving public assistance. These design weaknesses created a large volume of information being sent to the counties, resulting in an increased workload and ineffective application of the alert process. As a result of the extremely high number of alerts and defects detected, the Department suspended its Fraud Control Triad Reviews in March 2020 and they resumed in January 2021. In addition, the Department continued to suspend monthly IEVS reviews until the alert volume is more manageable while encouraging counties to continue working alerts for the SNAP Cluster and TANF programs. ? Caseworker Reliance/Training ? The current process relies heavily on the knowledge and judgement of county caseworkers in the eligibility process. The Department conducted trainings for county caseworkers in October 2020 and June 2021 and made available on-line job aids, various trainings, and access to IEVS coordinators. However, these trainings are typically optional and/or attended by a representative of the county who is expected to relay the information to others. We also noted the following weakness/issue regarding the contract and monitoring related to the Ohio Benefits system in Finding Number 2021-002 for DAS. ? Although operating protocols were available defining DAS? responsibilities, a signed interagency agreement has not been finalized to define the roles and responsibilities of each agency and naming DAS as the administrator for Ohio Benefits. In addition, no data governance structure was in place to ensure reliability for management. As a result, it was not always clear if/how program objectives were being met/monitored and program compliance was being achieved. Without proper controls for entering, processing, and maintaining recipient information and system alerts, there is an increased risk that benefits paid to or on behalf of recipients will be inaccurate or unallowable. This risk is substantially increased if the State?s eligibility determination system, Ohio Benefits, is not designed to properly identify changes to recipient information and generate relevant alerts when those changes could impact a recipient?s eligibility.. These weaknesses could allow undue subjective decisions, jeopardize accurate eligibility processing, and/or result in improper payments or federal reimbursements. Overpayments or payments to or on behalf of ineligible recipients may subject the Department to penalties or sanctions which may jeopardize future funding and limit its ability to fulfill program requirements to provide benefits to those in need. Based on discussions with management, oversight and systemic issues led to the issues identified. Management indicated they recognize the alert process needs further refinement and they are taking steps to reduce the volume of alerts and add enhancements to the Ohio Benefits System. We recommend Department management continue to work collectively with the related state agencies to implement/update robust processes, procedures, and system programming to address the weaknesses in the overall eligibility process, including those associated with the Ohio Benefits system. These changes/updates should include, but not be limited to: ? Redesigning the alert process to be more effective and efficient. This could include a more centralized evaluation of alert activity and/or better use of automated tools to vet and prioritize items requiring follow-up. This would allow Department level personnel to become more experienced and adept at identifying and investigating anomalies and help focus the resources of both Department and county personnel. ? Requiring mandatory training for all CDJFS employees who are entering the assistance group information into Ohio Benefits to help ensure proper and complete information is being collected, entered, and verified prior to an individual?s eligibility determination being made. The Department should provide this training initially to ensure all users are knowledgeable of the process, procedures, and impacts of the work they do. As changes occur to the rules/regulations, system, or process, detailed training should be required of all users on those changes. ? Regularly evaluating selected benefit payments for all programs to verify the recipient?s eligibility, verify the recipient information entered into Ohio Benefits by the CDJFS is accurate and the information is being maintained to support the State?s eligibility decision, and ensure initial eligibility determinations and redeterminations are completed timely. Any problems noted should be promptly corrected to reduce the risk of benefit payments being made on behalf of ineligible individuals and additional training provided to the State and/or county employees affected. ? Identifying and coordinating program changes to address the system design weaknesses identified above. This should include working collaboratively with DAS to prioritize program changes which could directly impact the eligibility determinations or benefit amounts to ensure they are corrected in a timely manner to prevent and detect further improper payments. ? Ensuring interagency agreements are formalized, contain all parties of the agreements, and fully and clearly define the roles, responsibilities, and expectations related to each party, including completion of required risk assessments and evaluations, and any other specific tasks designed to achieve program compliance. ? Implementing a data governance structure designed to ensure data quality and reliability for management, the grantor agencies, and other users of this information. This should include data subject experts from each related agency to help ensure quality of data requests before external and internal users rely on the data, issues are addressed with a clear escalation path, and establishing accountabilities and alignment between the related agencies.

MEDICAID/CHIP ? ELIGIBILITY Finding Number: 2021-019 State Agency Number: MCD-01 Assistance Listing Program Numbers and Titles: 93.767 ? Children?s Health Insurance Program (CHIP) 93.767 COVID-19 ? CHIP 93.775/93.777/93.778 ? Medicaid Cluster 93.775/93.777/93.778 COVID-19 ? Medicaid Cluster Federal Award Identification Number / Year: 2005OH5021 / 2020 (CHIP) 2105OH5021 / 2021 (CHIP) 2005OH5MAP / 2020 (Medicaid) 2105OH5MAP / 2021 (Medicaid) Federal Agency: Department of Health and Human Services Compliance Requirements: Activities Allowed or Unallowed, Allowable Costs/Cost Principles, Eligibility Repeat Finding from Prior Audit? Yes Prior Audit Finding Number: 2020-029 QUESTIONED COSTS, NONCOMPLIANCE, AND MATERIAL WEAKNESS (CHIP) $49,523 QUESTIONED COSTS AND MATERIAL WEAKNESS (MEDICAID CLUSTER) $1,122,338 QUESTIONED COSTS (MEDICAID CLUSTER AND CHIP) Undetermined NOTE: Finding numbers 2021-002 and 2021-020 contain additional information which is integral to and should be read in conjunction with this finding. 42 C.F.R. ? 435.10, State Plan requirements, pertaining to the Medicaid Cluster states, in part A State plan must--- (a) Provide that the requirements of this part are met; and (b) Specify the groups to whom Medicaid is provided, as specified in subparts B, C, and D of this part, and the conditions of eligibility for individuals in those groups. 42 C.F.R. ? 435.914, Case documentation, pertaining to the Medicaid Cluster states, in part: (a) The agency must include in each applicant's case record facts to support the agency's decision on his application. 42 C.F.R. ? 433.400, pertaining to continued enrollment during the public health emergency states, in part: (b) Definitions Validly enrolled means that the beneficiary was enrolled in Medicaid based on a determination of eligibility. A beneficiary is not validly enrolled if the agency determines the eligibility was erroneously granted at the most recent determination, redetermination, or renewal of eligibility (if such last determination was completed prior to March 18, 2020) because of agency error or fraud. . . or abuse . . . (c) General Requirements (2) Except as provided in paragraph (d) of this section, for all beneficiaries validly enrolled for benefits . . as of or after March 18, 2020, the state must maintain the beneficiary?s enrollment . . . through the end of the month in which the public health emergency for COVID-19 ends. (i)(A) For beneficiaries whose Medicaid coverage meets the definition of MEC (Minimum Essential Coverage) . . . as of or after March 18, 2020, the state must continue to provide Medicaid coverage that meets the definition of MEC . . . (d) Exceptions (1) . . . a state may terminate a beneficiary?s Medicaid enrollment prior to the first day of the month after the public health emergency for COVID-19 ends in the following circumstances: (i) The beneficiary or beneficiary?s representative requests a voluntary termination of eligibility; (ii) The beneficiary ceases to be a resident of the state; or (iii) The beneficiary dies 42 U.S.C. ?1397bb (b), pertaining to the Children?s Health Insurance Program (CHIP) states, in part: (1) Eligibility Standards (A) The plan shall include a description of the standards used to determine the eligibility of targeted low-income children for child health assistance under the plan. Ohio Admin. Code 5160-26-02.1 states, in part: . . . (B) The Ohio department of Medicaid (ODM) will terminate a member from enrollment in a managed care organization for any of the following reasons: (3) The member dies, in which case MCO enrollment ends on the date of death (C) All of the following apply when enrollment is terminated for any of the reasons set forth in paragraph (B) of this rule: (5) ODM shall recover from the MCO any capitation paid for retroactive enrollment termination occurring as a result of paragraph (B) of this rule. The Medicaid and CHIP State Plan outlines the specific eligibility conditions and standards within Sections 2.2 ? Coverage and Conditions of Eligibility and 2.6 A ? Financial Eligibility, Eligibility Conditions and Requirements for Medicaid and Section 4 ? Eligibility Standards and Methodology for CHIP. During the Public Health Emergency (PHE), the Department issued several Medicaid Eligibility Procedure Letters (MEPLs) to Medicaid personnel, including county caseworkers, in how to address new federal rule changes put into place during the PHE. One such MEPL gave guidance on acceptable and nonacceptable transitions of benefit aid categories to maintain MEC, as described in 42 C.F.R. ?433.400. It is management?s responsibility to implement policies and procedures to provide reasonable assurance they have complied with these requirements. As the lead agency responsible for administering the CHIP and Medicaid federal grant awards for the State of Ohio, the Department is responsible for providing reasonable assurance only eligible individuals receive assistance and documentation maintained is accurate, complete, and properly recorded in the Ohio Benefits system to ensure appropriate eligibility determinations. It is also the Department?s responsibility to implement sufficient controls, systems, processes, and procedures to reasonably ensure compliance with the rules and regulations associated with these programs and only eligible recipients receive benefits. The Department is responsible for overall program compliance and must have appropriate oversight and monitoring procedures in place to ensure those they rely on are operating in accordance with all expectations, guidelines, and requirements related to their tasks. During state fiscal year (SFY) 2021, the Department disbursed a combined total of $27.3 billion in public assistance payments, to recipients processed through the Ohio Benefits system related to the following programs: See Schedule of Findings and Questioned Costs for chart/table. These programs are administered using a multi-agency approach, as follows: overall compliance and administration of CHIP and the Medicaid Cluster fall under the Department, and programming and administration of the State?s eligibility determination computer system, Ohio Benefits, falls under the Ohio Department of Administrative Services (DAS). The Ohio Benefits system contains the eligibility and benefit information/determinations for these programs, including the Income Eligibility Verification System (IEVS) functionality which compares reported recipient income to income information maintained by outside data sources (SSA, IRS, etc.). The Department also, through a Memorandum of Understanding with the Ohio Department of Job & Family Services (ODJFS), utilizes the 88 Ohio counties in the eligibility determination process to work with applicants, receive/enter eligibility documentation into the Ohio Benefits system, and follow up on alerts issued by the system. SYSTEM/CONTROL ISSUES Currently, individuals applying to receive public assistance benefits complete an application through various methods. The County Departments of Job & Family Services (CDJFS) offices collect and maintain any documentation provided by the individual either in a paper case file or in the OnBase Enterprise Documentation Management System (EDMS) maintained under contract by DAS. After collecting documentation, the county caseworker enters the individual?s information into the Ohio Benefits system which determines the initial eligibility benefit amount and assigns the benefit aid category, where applicable. This process is also used to perform eligibility redeterminations on an annual basis or when prompted through a system alert. Once the determination is made, the Ohio Benefits system uploads the eligibility information to the Department?s payment system, Medicaid Information Technology System (MITS), to process the payment. During SFY 2021, we noted the following weaknesses in the eligibility process: ? Alerts ? The Ohio Benefits system is designed to issue alerts to county caseworkers for a variety of items which require review, evaluation, follow-up, and a determination about the impact on the related case and/or program benefits. During SFY 2021, more than 25.5 million alerts were issued according to DAS records (more than 9.8 million IEVS alerts and 15.7 million non-IEVS alerts). Ongoing enhancements to the Ohio Benefits alerts process were made in coordination with the Ohio Benefits Project Team (personnel from the Department, ODJFS, and DAS) throughout the audit period. During SFY 2021, the enhancements addressed design weaknesses on 12 sources of alerts, reducing the backlog to 8.8 million alerts at fiscal-year-end that required county investigation and follow-up. Although DAS has made several enhancements to OB related to improving the IEVS alert process, the following design weaknesses existed during the audit period for both the BENDEX IEVS alert process and the non-IEVS alert process, which DAS plans to continue working on: o Multiple and repetitive alerts (redundancy). o Irrelevant alerts (zero or small dollar amounts). o Alerts being received on persons not receiving public assistance. These design weaknesses created a large volume of information being sent to the counties, resulting in an increased workload and ineffective application of the alert process. ? Caseworker Reliance/Training - The current process relies heavily on the knowledge and judgement of county caseworkers in the eligibility process. Although various trainings were held for county caseworkers by the various state agencies and on-line job aids are made available, this training is typically optional and/or attended by a representative of the county who is expected to relay the information to others. We also noted the following weakness/issue regarding the contract and monitoring related to the Ohio Benefits system in Finding Number 2021-002 for DAS. ? Although operating protocols were available defining DAS? responsibilities, a signed interagency agreement has not been finalized to define the roles and responsibilities of each agency and naming DAS as the administrator for Ohio Benefits. In addition, no data governance structure was in place to ensure reliability for management. As a result, it was not always clear if/how program objectives were being met/monitored and program compliance was being achieved. NONCOMPLIANCE ISSUES The following noncompliance was noted related to eligibility for the Medicaid and CHIP programs: ? One of 80 (1.3%) Medicaid recipients and 8 of 80 (10%) CHIP recipients selected for testing were not eligible to receive benefits on the date services were performed as they were not validly enrolled beneficiaries. Since Ohio Benefits is the State?s official eligibility determination system, these items will result in questioned costs for all claims paid for services provided for these individuals during the time they were ineligible, totaling $7,007 for Medicaid and $45,802 for CHIP. The items noted included issues such as: o The recipient failed to timely report an increase in income and/or new employment. o The caseworker failed to timely update Ohio Benefits with an increase in income. o U.S. Citizenship was not properly verified. o The recipient was covered by other health insurance. o The recipient exceeded the eligibility period for Continuous Eligibility. o The recipient was awarded `ineligible? status in Ohio Benefits which did not result in a transition to MITS to end Medicaid eligibility due to caseworker error. ? One of 80 (1.3%) Medicaid recipients and 12 of 80 (15%) CHIP recipients selected for testing were not placed in the correct benefit aid category. The Medicaid recipient and eight of the 12 CHIP individuals are included in the preceding bullet as being deemed ineligible. For the other four CHIP recipients, although their age and/or income deemed them to be in the incorrect benefit aid category and ineligible for the CHIP program, they were qualified to be placed in a Medicaid benefit aid category that would maintain MEC. Since Ohio Benefits is the State?s official eligibility determination system, these items will result in questioned costs for all claims paid under the CHIP program for services provided for these individuals during the time they were ineligible, totaling $1,551. ? One of 80 (1.3%) Medicaid recipient cases and 19 of 80 (23.8%) CHIP recipient cases selected for testing either did not contain adequate documentation to support the Department?s decision on the recipient?s eligibility or incorrect recipient information was entered into Ohio Benefits. However, based on additional information we obtained from other sources, the recipient was still eligible. The items noted generally related to the following documentation categories: o Income verification and documentation o Household size o Caseworker processing error o Social Security Number verification and documentation o US Citizenship verification ADDITIONAL QUESTIONED COSTS: In January 2022, the Auditor of State?s Medicaid Contract Audit (MCA) section released a Public Interest Report regarding Improper Capitation Payments covering SFY 2018 through SFY 2020 for the Medicaid program. The objectives were to identify duplicate payments to recipients; payments for individuals not eligible for managed care due to their incarceration; and, payments for recipients in the months following their death. Utilizing the results from the MCA report, we performed additional procedures, specifically focused on duplicate recipient payments and payments made after a recipient?s death to see if these issues still existed during our audit period and payments were still made on behalf of these individuals from the Medicaid and CHIP programs. We noted the following: ? The Department made 1,173 payments, totaling $1,117,501, on behalf of 95 deceased individuals. This represented $1,115,331 for Medicaid recipients and $2,170 for CHIP recipients. These are considered unallowable payments and we will question the costs for these payments. These amounts represent the entire payment to the recipient and do not represent only the federal share of these payments. The recipients? dates of death ranged from March 2, 2017 to May 25, 2020. We noted the Department had started the recoupment process for these payments; however, this process took place outside of our audit period. ? The Department made 1,770 payments totaling $1,021,140, on behalf of 167 Medicaid and CHIP recipients where a Social Security Number was associated with multiple recipient IDs within MITS. This amount includes both allowable payments and unallowable duplicate payments and represents the entire payment to the recipient, not only the federal share of the payment. However, without reviewing the support within each individual case file, we were unable to identify exactly how much was improperly paid from each program. As a result, we will question costs for an undetermined amount for both programs. Without proper controls for entering, processing, and maintaining recipient information and system alerts, there is an increased risk that benefits paid to or on behalf of recipients will be inaccurate or unallowable. This risk is substantially increased if the State?s eligibility determination system, Ohio Benefits, is not designed to properly identify changes to recipient information and generate relevant alerts when those changes could impact a recipient?s eligibility. These weaknesses could allow undue subjective decisions, jeopardize accurate eligibility processing, and/or result in improper payments or federal reimbursements. Overpayments or payments to or on behalf of ineligible recipients may subject the Department to penalties or sanctions which may jeopardize future funding and limit its ability to fulfill program requirements to provide benefits to those in need. Based on discussions with management, oversight and systemic issues led to the issues identified. DAS management indicated they recognize the alert process needs further refinement and they are taking steps to reduce the volume of alerts and add enhancements to the Ohio Benefits System. RECOMMENDATIONS We recommend the Department evaluate and seek reimbursement for all claims that were incorrectly paid. We also recommend management continue to work collectively with the related state agencies to implement/update robust processes, procedures, and system programming to address the weaknesses in the overall eligibility process, including those associated with the Ohio Benefits system. These changes/updates should include, but not be limited to: ? Redesigning the alert process to be more effective and efficient. This could include a more centralized evaluation of alert activity and/or better use of automated tools to vet and prioritize items requiring follow-up. This would allow Department level personnel to become more experienced and adept at identifying and investigating anomalies and help focus the resources of both Department and county personnel. ? Requiring mandatory training for all CDJFS employees who are entering the assistance group information into Ohio Benefits to help ensure proper and complete information is being collected, entered, and verified prior to an individual?s eligibility determination being made. ? Regularly evaluating selected benefit payments for all programs to verify the recipient?s eligibility, verify the recipient information entered into Ohio Benefits by the CDJFS is accurate and the information is being maintained to support the State?s eligibility decision, and ensure initial eligibility determinations and redeterminations are completed timely. Any problems noted should be promptly corrected to reduce the risk of benefit payments being made to or on behalf of ineligible individuals and additional training provided to the State and/or county employees affected. ? Identifying and coordinating program changes to address the system design weaknesses identified above. This should include working collaboratively with DAS to prioritize program changes which could directly impact the eligibility determinations or benefit amounts to ensure they are corrected in a timely manner to prevent and detect further improper payments. ? Ensuring interagency agreements are formalized, contain all parties of the agreements, and fully and clearly define the roles, responsibilities, and expectations related to each party, including completion of required risk assessments and evaluations, and any other specific tasks designed to achieve program compliance. ? Implementing a data governance structure designed to ensure data quality and reliability for management, the grantor agencies, and other users of this information. This should include data subject experts from each related agency to help ensure quality of data requests before external and internal users rely on the data, issues are addressed with a clear escalation path, and establishing accountabilities and alignment between the related agencies. ? Evaluating current processes for identifying duplicate recipient IDs and deceased individuals and updating Ohio Benefits and MITS in a timely manner.

MEDICAID/CHIP ? IEVS ALERTS Finding Number: 2021-020 State Agency Number: MCD-02 Assistance Listing Program Numbers and Titles: 93.767 ? Children?s Health Insurance Program (CHIP) 93.767 COVID-19 ? CHIP 93.775/93.777/93.778 ? Medicaid Cluster 93.775/93.777/93.778 COVID-19 ? Medicaid Cluster Federal Award Identification Number / Year: 2005OH5021 / 2020 (CHIP) 2105OH5021 / 2021 (CHIP) 2005OH5MAP / 2020 (Medicaid) 2105OH5MAP / 2021 (Medicaid) Federal Agency: Department of Health and Human Services Compliance Requirement: Eligibility Repeat Finding from Prior Audit? Yes Prior Audit Finding Number: 2020-030 NONCOMPLIANCE AND MATERIAL WEAKNESS NOTE: Finding numbers 2021-002 and 2021-019 contain additional information which is integral to and should be read in conjunction with this finding. 42 C.F.R. ? 435.945 states, in part, the following regarding the Medicaid Cluster program: (a) Except where the law requires other procedures . . . the agency may accept attestation of information needed to determine the eligibility of an individual for Medicaid . . . without requiring further information (including documentation) from the individual. (b) The agency must request and use information relevant to verifying an individual's eligibility for Medicaid in accordance with ? 435.948 through 435.956 . . . 42 C.F.R. ? 457.380, states, in part, the following regarding the Children?s Health Insurance Program (CHIP): (a) General requirements. Except where law requires other procedures . . . the State may accept attestation of information needed to determine the eligibility of an individual for CHIP. . . without requiring further information (including documentation) from the individual. (b) Status as a citizen, national or a non-citizen. (1) Except for newborns identified in ? 435.406(a)(1)(iii)(E) of this chapter, who are exempt from any requirement to verify citizenship, the agency must? . . . (ii) Provide a reasonable opportunity period to verify such status in accordance with ? 435.956(a)(5) and (b) of this chapter and provide benefits during such reasonable opportunity period to individuals determined to be otherwise eligible for CHIP. Furthermore, 42 U.S.C. ? 1320b?7(a) Requirements of State eligibility systems states, in part: In order to meet the requirements of this section, a State must have in effect an income and eligibility verification system which meets the requirements of subsection (d) and under which? (1) the State shall require, as a condition of eligibility for benefits under any program listed in subsection (b), that each applicant for or recipient of benefits under that program furnish to the State his social security account number (or numbers, if he has more than one such number), and the State shall utilize such account numbers in the administration of that program so as to enable the association of the records pertaining to the applicant or recipient with his account number; (2) wage information from agencies administering State unemployment compensation laws available pursuant to section 3304(a)(16) of the Internal Revenue Code of 1986, wage information reported pursuant to paragraph (3) of this subsection, and wage, income, and other information from the Social Security Administration and the Internal Revenue Service available pursuant to section 6103(l)(7) of such Code, shall be requested and utilized to the extent that such information may be useful in verifying eligibility for, and the amount of, benefits available under any program listed in subsection (b), as determined by the Secretary of Health and Human Services . . . . . . (4) the State agencies administering the programs . . . adhere to standardized formats and procedures . . . under which ? (A) the agencies will exchange with each other information in their possession which may be of use in establishing or verifying eligibility or benefit amounts under any other such program . . . (C) the use of such information shall be targeted to those uses which are most likely to be productive in identifying and preventing ineligibility and incorrect payments. . . In order to comply with 42 C.F.R. ? 435.945 and 42 U.S.C. ? 1320b-7, the State of Ohio codified specific rules related to its Income Eligibility Verification System (IEVS) in the Ohio Administrative Code. Ohio Admin. Code 5160:1-1-04 states, in part: (A) This rule describes the requirements in section 1137 of the Social Security Act and in section 42 C.F.R. 435.945. . ., requiring state agencies administering certain federally funded, state administered public assistance programs, to establish procedures for obtaining, using and verifying information relevant to determinations of eligibility. The Ohio department of medicaid shall obtain and share income and benefit information with the following sources: (1) The social security administration (SSA). (2) The internal revenue service (IRS). (3) The state wage information collection agency (SWICA). (4) The agencies administering the State unemployment compensation (UC) laws. . . . (C) Administrative agency responsibilities. Within forty-five days of receipt of the information, the administrative agency shall initiate, pursue, and complete the actions specified. . .: . . . (3) Review and compare against the case record all information received from the IEVS data matches to determine whether the information affects the individual's eligibility, in accordance with 42 C.F.R. 435.948. (4) Obtain additional information or documentation from the individual, if needed, to determine eligibility and initiate appropriate action in accordance with 42 C.F.R. 435.952(c). (5) . . . The administrative agency shall verify information. . . (6) Update case information and redetermine eligibility when the verification received is discrepant from information currently listed in the electronic eligibility system. It is management?s responsibility to implement controls, processes, and procedures to ensure compliance with these regulations. When automated systems are utilized to perform certain functions related to this compliance, management must ensure the system is properly designed and operating effectively. During state fiscal year (SFY) 2021, the Department disbursed approximately $26.7 billion and $596.4 million on behalf of recipients who were determined eligible for the Medicaid Cluster and CHIP programs, respectively. The Ohio Benefits (OB) system, administered by the Ohio Department of Administrative Services (DAS), determines eligibility for the Medicaid Cluster and CHIP programs. The OB system also includes the IEVS functionality which compares reported recipient income to income information maintained by outside data sources (i.e. SSA, IRS, etc.). Income information that does not agree to the OB amount is communicated as an IEVS alert and forwarded to the appropriate county for investigation and resolution. Each alert has a defined due date, which is unique based on the priority level and other policy and process related factors. During SFY 2021, more than 25.5 million alerts were issued (9.8 million IEVS alerts and 15.7 million non-IEVS alerts) for all public assistance programs that utilize OB, including the Medicaid and CHIP programs. Ongoing enhancements to the OB alerts process were made in coordination with the Ohio Benefits Project Team (personnel from the Department, the Ohio Department of Job and Family Services (JFS), and DAS throughout the audit period. During SFY 2021, the enhancements addressed design weaknesses on 12 sources of alerts, reducing the backlog to 8.8 million alerts at fiscal-year-end that required county investigation and follow-up. Although DAS has made several enhancements to OB related to improving the IEVS alert process, the following design weaknesses existed during the audit period for both the BENDEX IEVS alert process and the non-IEVS alert process, which DAS plans to continue working on: multiple and repetitive alerts (redundancy), irrelevant alerts (zero or small dollar amounts), and alerts being received on persons not receiving public assistance. These design weaknesses created a large volume of information being sent to the counties, resulting in an increased workload and ineffective application of the alert process. In addition, the Department relies heavily on JFS to coordinate with and provide training to the counties; however, these trainings were not required to be attended by all county caseworkers. See findings 2021-002 and 2021-018 for more detailed information regarding the OB weaknesses and defects, as well as the training control weaknesses. Furthermore, an OB report showed 3,400,357 of the 5,823,566 (58.3%) IEVS alerts sent to the counties during the audit period were not cleared within 45 days as required. The alerts were cleared between one and 471 days beyond the 45-day requirement, with an average of 235 days late. Failure to correct system design weaknesses, mandate training for county caseworkers, and complete IEVS alerts within the established timeframes increases the risk benefits given to ineligible recipients or for inappropriate amounts will not be identified timely. This condition could adversely affect the Department?s ability to comply with IEVS requirements for these federal programs which could result in federal sanctions or penalties. Based on discussions with management, systemic issues and increased county caseworker work load led to the issues identified. DAS management indicated they recognize the alert process needs further refinement and they are taking steps to reduce the volume of alerts and add enhancements to the Ohio Benefits System. We recommend the Department continue to work collectively with the related state agencies to implement/update robust processes, procedures, and system controls to address the weaknesses associated with the IEVS process within the Ohio Benefits system. These changes/updates should include, but not be limited to: ? Including a more centralized evaluation of alert activity and/or better use of automated tools to vet and prioritize items requiring follow-up at the county level. This would allow Department level personnel to become more experienced and adept at identifying and investigating anomalies and help focus the resources of both Department and county personnel. ? Monitoring the IEVS alert processing procedures guide for the alerts issued by the Ohio Benefits system to ensure alerts are properly documented within the system, worked within the proper timeframes, and proper verification documentation is obtained and maintained by the counties for resolved alerts. ? Determining if the IEVS training for county caseworkers is working as intended to ensure they have the knowledge to properly document and resolve IEVS alerts generated by the Ohio Benefits system. We also recommend the Department continue to monitor the status of system enhancements and roll-out of resources to the appropriate personnel to ensure they are implemented timely and as planned.

IT ? MEDICAID/CHIP ? NCCI REQUIREMENTS AND MONITORING Finding Number: 2021-021 State Agency Number: MCD-03 Assistance Listing Program Numbers and Titles: 93.767 ? Children?s Health Insurance Program (CHIP) 93.767 COVID-19 ? CHIP 93.775/93.777/93.778 ? Medicaid Cluster 93.775/93.777/93.778 COVID-19 ? Medicaid Cluster Federal Award Identification Number/Year: 2005OH5021 / 2020 (CHIP) 2105OH5021 / 2021 (CHIP) 2005OH5MAP / 2020 (Medicaid) 2105OH5MAP / 2021 (Medicaid) Federal Agency: Department of Health and Human Services Compliance Requirement: Special Tests & Provisions ? Medicaid National Correct Coding Initiative (NCCI) Repeat Finding from Prior Audit? Yes Prior Audit Finding Number: 2020-032 NONCOMPLIANCE AND MATERIAL WEAKNESS The Center for Medicare & Medicaid Services (CMS) National Correct Coding Initiative (NCCI) promotes national correct coding methodologies and reduces improper coding which may result in inappropriate payments of Medicare Part B claims and Medicaid claims. The coding policies are based on coding conventions defined in the American Medical Association's (AMA) Current Procedural Terminology (CPT) Manual, national Medicare policies, coding guidelines developed by national societies, standard medical and surgical practice, and current coding practice. Effective October 1, 2010, CMS incorporated five initial NCCI methodologies into the state Medicaid programs pursuant to the requirements of Section 6507, Mandatory State Use of NCCI, of the Patient Protection and Affordable Care Act (P.L. 111-148), as amended by the Health Care and Education Recovery Act of 2010 (P.L. 111-152), together referred to as the Affordable Care Act, which amended section 1903(r) of the Social Security Act. CMS has adopted the contents of the NCCI Policy Manual for Medicare Services with minor modifications for state Medicaid programs. Effective in October 2012, CMS implemented a sixth Medicaid NCCI methodology. As such, States are required to implement the six Medicaid NCCI methodologies stated below: 1. NCCI procedure-to procedure (PTP) edits for practitioner and ambulatory surgical center (ASC) claims; 2. NCCI PTP edits for outpatient hospital services including emergency department, observation care, and outpatient hospital laboratory services; 3. Medically Unlikely Edit (MUE) units of service (UOS) edits for practitioner and ASC services; 4. MUE UOS edits for outpatient hospital services including emergency department, observation care, and outpatient hospital laboratory services; 5. MUE UOS edits for durable medical equipment (DME) billed by providers; and, 6. NCCI PTP edits for DME. To correctly implement the methodologies, state Medicaid agencies must use the most recent final quarterly Medicaid NCCI edit files published by CMS for processing and paying Medicaid claims. Agencies are required to implement the quarterly Medicaid NCCI edit files in the Medicaid Enterprise System (MES) by the first day of the second month of the calendar quarter. If a state has not implemented the quarterly edit files by this deadline, then the state must reprocess all claims that were processed between the first day of the calendar quarter and the date the new quarterly edit files were implemented in the MES. It is management?s responsibility to implement controls and procedures to comply with these regulations. When automated systems are utilized to perform certain functions related to this compliance, management must ensure the system is properly designed and operating effectively. Additionally, when the system is not directly administered by the entity, such as when utilizing a vendor, appropriate monitoring controls must be designed and implemented to reasonably ensure all tasks and controls performed by the vendor on behalf of the entity comply with applicable laws and regulations. During state fiscal year 2021, the Department disbursed approximately $6.3 billion for Medicaid and $32 million for Children?s Health Insurance Program (CHIP) related to fee-for-services claims. The Department administers the Medicaid Information Technology System (MITS), which is an automated application, to determine if the services provided to eligible recipients were by an eligible provider and allowable prior to payment. The Department is responsible for ensuring the NCCI methodologies are properly implemented for the state Medicaid program and contracts with vendors to assist with the administration of NCCI. However, the Department failed to properly monitor CMS requirements and updates which resulted in the DME PTP methodology from 2012 not being implemented until February 2021. The Department has a process in place to help ensure quarterly documentation from CMS, used for implementation of the methodologies, is properly updated and implemented in MITS in accordance with the timing requirements set forth in the NCCI initiative. Each quarter, the vendor providing the NCCI clinical editing software obtains NCCI methodology update files from CMS. These files are shared with Department management and the MITS vendor for their review. After the initial review is complete, the MITS vendor tests the configuration of the files for correctness. Department management must then approve the MITS vendor?s testing prior to the files being approved for implementation in MITS. However, the calendar year 2020 fourth quarter NCCI edit files were not implemented in accordance with the timing requirements set forth in the NCCI initiative. Without adequate monitoring controls over the implementation of NCCI, management cannot be reasonably assured the NCCI compliance requirement is being met. In addition, if all methodologies are not implemented completely, correctly, and timely, improper payments for services could occur. Based on discussions with Department and vendor management, PTP edits for DME claims and lack of monitoring controls over the implementation process were not implemented due to oversight. The fourth quarter NCCI edit files were not implemented timely due to delays in correcting issues identified during testing. We recommend the Department continue to monitor all CMS requirements, as well as the quarterly implementation process of all NCCI edits, including vendor responsibilities, to help ensure all Medicaid NCCI requirements are met completely, accurately, and timely. We also recommend the Department periodically evaluate and update these monitoring procedures, as necessary, to ensure they meet management's objectives and help ensure compliance with NCCI requirements.

SSBG & OPIOID STR ? SUBRECIPIENT MONITORING Finding Number: 2021-022 State Agency Number: MHA-01 Assistance Listing Program Numbers and Titles: 93.667 Social Services Block Grant (SSBG) 93.788 Opioid STR Federal Award Identification Number / Year: 2001OHSOSR / 2020 (SSBG) 2101OHSOSR / 2021 (SSBG) H79TI080261 / 2019 (Opioid STR) H79TI081684 / 2020 (Opioid STR) H79TI083294 / 2021 (Opioid STR) Federal Agency: Department of Health and Human Services Compliance Requirement: Subrecipient Monitoring Repeat Finding from Prior Audit? No NONCOMPLIANCE AND MATERIAL WEAKNESS 45 C.F.R. ?75.352 states, in part: All pass-through entities must: . . . (b) Evaluate each subrecipient's risk of noncompliance with Federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate subrecipient monitoring described in paragraphs (d) and (e) of this section? (d) Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. Pass-through entity monitoring of the subrecipient must include: (1) Reviewing financial and performance reports required by the pass-through entity; (2) Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the Federal award provided to the subrecipient from the pass-through entity detected through audits, on-site reviews, and other means; and (3) Issuing a management decision for audit findings pertaining to the Federal award provided to the subrecipient from the pass-through entity as required by ? 75.521. (e) Depending upon the pass-through entity's assessment of risk posed by the subrecipient (as described in paragraph (b) of this section), the following monitoring tools may be useful for the pass-through entity to ensure proper accountability and compliance with program requirements and achievement of performance goals: (1) Providing subrecipients with training and technical assistance on program-related matters; (2) Performing on-site reviews of the subrecipient's program operations; and (3) Arranging for agreed-upon-procedures engagements as described in ? 75.425. Federal regulations require pass-through entities to maintain internal controls over federal programs that provide reasonable assurance they are in compliance with laws and regulations. In addition, sound internal control procedures require management to monitor these control procedures to verify they are designed and operating in a manner consistent with federal regulations and program objectives. To be effective, the performance of internal controls must be evidenced in some manner to document the control is in place and functioning as intended. During state fiscal year (SFY) 2021, the Department disbursed approximately $7.1 million in subawards from SSBG funds to the 50 Alcohol, Drug Addiction and Mental Health (ADAMH) boards. The Department also disbursed approximately $63.8 million in subawards from Opioid STR funds, specifically the State Opioid Response Project (SOR) grants, to 189 subrecipients (includes the 50 ADAMH boards). The Department?s Community Monitoring Section (CMS) deploys a risk management monitoring technique for subrecipient monitoring to analyze and evaluate vulnerabilities of federal awards provided to the ADAMH boards. At the beginning of each fiscal year, CMS sends out questionnaires to all 50 ADAMH boards soliciting feedback regarding financial reporting, organizational turnover, number of contracted agencies, and whether any other monitoring (i.e., financial audits, peer review) has been completed. The Department then compiles the Consolidated Unexpended Funds spreadsheet based on financial data obtained from the questionnaires, including any variances in financial data and unexpended federal funds. The CMS Manager then utilizes the Consolidated Unexpended Funds spreadsheet to determine how to manage the State-wide risk and instructs CMS staff how to deploy its monitoring efforts for the SFY. During SFY 2021, the Department performed desk reviews over Board Level Reports (financial reports with revenue and expenditure data by funding source) for all ADAMH boards, as well as a limited number of Stakeholder Assistance Reviews (on-site) at ADAMH boards that were designated higher risk. However, the Department did not provide the Consolidated Unexpended Funds spreadsheet and as a result, we were unable to determine if the risk management procedures outlined above were operating effectively during the audit period and were properly documented within the spreadsheet. Additionally, we were unable to determine if the Department completed any desk reviews of the additional 139 subrecipients related to SOR grants. Annually, CMS is to conduct Single Audit reviews to ensure subrecipients have complied with the requirements for federal awards passed through the Department and make management decisions on audit findings/corrective action plans. The Department utilizes a database/Audit Review Tracking Spreadsheet to track data on subrecipients, such as: desk reviews, single audit reviews, subrecipient financial information, amounts subrecipients reported on their Schedule of Expenditures of Federal Awards, financial information from the State?s accounting system, and any other information about the subrecipient that would assist in effectively managing State-wide concerns on the federal awards passed through the Department. However, the Department did not provide the Audit Review Tracking Spreadsheet and as a result, we could not determine if the audit review and tracking controls were operating effectively. In addition, the Department did not complete any Single Audit reviews for its subrecipients during the audit period, as required by 45 C.F.R. ?75.352(d). Furthermore, CMS completes a Percentage of Coverage spreadsheet to determine an appropriate level of audit coverage is obtained for each federal program it passes through to subrecipients, based on major program testing during subrecipient Single Audits. However, the Department did not provide the Percentage of Coverage spreadsheet and any supporting documentation to evidence the controls were operating effectively and that an appropriate level of coverage was obtained. Without adequate procedures in place to monitor subrecipient compliance with federal statutes, laws and regulations, there is an increased risk subrecipients may misuse federal funds for unauthorized purposes. This could lead to fines, penalties, or repayment of program funds being imposed by the federal grantor agency. Based on discussions with management, the lack of subrecipient monitoring and documentation was caused by employee turnover, new management, and limited access to current systems. We recommend the Department evaluate its current control procedures and processes over subrecipient monitoring and update them as necessary to reasonably ensure compliance with 45 C.F.R. ?75.352. These procedures should include risk management monitoring, desk reviews, and Single Audit reviews, as well as ensuring an appropriate level of coverage is obtained for each federal program based on major program testing. Additionally, these procedures should include maintaining all tracking spreadsheets and supporting documentation in accordance with the Department?s record retention policy. Management should periodically monitor these procedures to ensure they are operating effectively and as intended.

SSBG & OPIOID STR ? TRANSPARENCY ACT REPORTING Finding Number: 2021-023 State Agency Number: MHA-02 Assistance Listing Program Numbers and Titles: 93.677 Social Services Block Grant (SSBG) 93.788 Opioid STR Federal Award Identification Number / Year: 2001OHSOSR / 2020 (SSBG) 2101OHSOSR / 2021 (SSBG) H79TI080261 / 2019 (Opioid STR) H79TI081684 / 2020 (Opioid STR) H79TI083294 / 2021 (Opioid STR) Federal Agency: Department of Health and Human Services Compliance Requirement: Reporting Repeat Finding from Prior Audit? No NONCOMPLIANCE AND MATERIAL WEAKNESS The Federal Funding Accountability and Transparency Act (Pub. L. No. 109-282, as amended by Section 6202 of Public Law 110-252, hereafter referred as the ?Transparency Act? that are codified in 2 C.F.R. Part 170) requires prime recipients of federal awards who make first-tier subawards to report the subaward on the Federal Funding Accountability and Transparency Subaward Reporting System (FSRS) website maintained by the federal Office of Management and Budget. Under the requirements of 2 C.F.R. Part 170, recipients (i.e., direct recipients) of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more on the FSRS website. Prime recipients must report by the end of the month following the month in which the obligation is made. It is management?s responsibility to design and implement internal controls to reasonably ensure compliance with laws and regulations and to ensure management?s objectives are achieved. During state fiscal year 2021, the Department obligated approximately $7.2 million for 50 subawards and $108 million for 254 subawards for the SSBG and Opioid STR programs, respectively, which exceeded $30,000 and were required to be reported on the FSRS website in accordance with the Transparency Act. However, the Department did not have controls in place and did not submit subawards within the FSRS website during the audit period. As a result, the following errors were noted: SSBG See Schedule of Findings and Questioned Costs for chart/table. Opioid STR See Schedule of Findings and Questioned Costs for chart/table. By not complying with federal Transparency Act reporting requirements, the Department risks federal funding being reduced, taken away, or other sanctions imposed by the federal grantor agency. If the subawards are not reported accurately and timely within FSRS, the risk exists that those using the Transparency Reports could be relying on inaccurate information. Based on discussions with management, these errors were caused by oversight of the reporting requirements, employee turnover, and new management. Management indicated they have implemented control procedures and have begun reporting subawards in FSRS website during SFY 2022. We recommend the Department collect and report on the FSRS website complete and accurate information regarding subawards made for all programs subject to the Transparency Act. We also recommend the Department evaluate its Transparency Act reporting control procedures and update them as necessary to ensure they promote compliance with the Federal regulations, as well as accuracy and completeness of information submitted. These procedures should include a supervisory review of the report information before it is submitted on the FSRS website.

DISASTER GRANTS ? SUBRECIPIENT MONITORING Finding Number: 2021-024 State Agency Number: DPS-01 Assistance Listing Program Number and Title: 97.036 ? Disaster Grants ? Public Assistance (Presidentially Declared Disasters) Federal Award Identification Number / Year: 4360-DR-OH-PA / 2018 4424-DR-OH-PA / 2019 4447-DR-OH-PA / 2019 4507-DR-OH-PA / 2020 Federal Agency: Department of Homeland Security Compliance Requirement: Subrecipient Monitoring Repeat Finding from Prior Audit? No NONCOMPLIANCE AND MATERIAL WEAKNESS 2 C.F.R. ? 3002.10 gives regulatory effect to the Department of Homeland Security for 2 C.F.R. ? 200.332 which establishes requirements over subawards for pass-through entities and states, in part, that all pass-through entities must: . . . (d) Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. Pass-through entity monitoring of the subrecipient must include: . . . (2) Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the Federal award provided to the subrecipient from the pass-through entity detected through audits, on-site reviews, and written confirmation from the subrecipient, highlighting the status of actions planned or taken to address Single Audit findings related to the particular subaward. (3) Issuing a management decision for applicable audit findings pertaining only to the Federal award provided to the subrecipient from the pass-through entity as required by ? 200.521. . . . (f) Verify that every subrecipient is audited as required by Subpart F of this part when it is expected that the subrecipient's Federal awards expended during the respective fiscal year equaled or exceeded the threshold set forth in ? 200.501. Federal regulations require pass-through entities to maintain internal controls over federal programs that provide reasonable assurance they are in compliance with laws and regulations. In addition, internal control procedures require management to monitor these control procedures to verify they are designed and operating in a manner consistent with federal regulations and program objectives. To be effective, the performance of internal controls must be evidenced in some manner to document the control is in place and functioning as intended. During state fiscal year 2021, the Department disbursed approximately $174 million in subawards to 169 subrecipients for the Disaster Grants ? Public Assistance (PA) program. After a Presidentially declared disaster or emergency occurs, a State-Local Grant Agreement is signed which outlines applicable laws and regulations the Department and subrecipient must follow in order to receive and maintain funding from the PA Program, including audit requirements if the subrecipient expends more than $750,000 in a year. The Department?s Disaster Recovery Branch (DRB) requires the subrecipient submit a certification for each year PA funds are expended, certifying if a Single Audit is required. The Emergency Management Grants (EMGrants) system generates these certifications based on when federal funds for a specific PA grant was paid to the subrecipient: the certifications are sent to the subrecipients at the beginning of the calendar year. Once the certification is obtained, the Department performs a desk review utilizing an Audit Review Sheet to determine if a Single Audit should have been required. If a Single Audit was required, the DRB obtains the audit report, identifies any findings related to the PA program, issues a management decision on any findings, and verifies the PA program amounts reported in the Schedule of Expenditures of Federal Awards. The EMGrants system contains information that allows the Department to monitor the status of the audit reviews for each subrecipient or run an ad hoc report to show the status of all subrecipient audit reviews; however, the Department does not have a process in place to continually track the status of audit reviews. Additionally, the Department did not send out certifications to the subrecipients during the audit period, or perform alternative procedures, to ensure the subrecipients obtained a Single Audit report when necessary, as required by 2 C.F.R. ? 200.332 (f). Furthermore, the Department did not obtain and review any Single Audit reports for subrecipients during the audit period in order to make a management decision on any findings related to the PA program, as required by 2 C.F.R. ? 200.332(d)(2)-(3). Not adequately monitoring subrecipients increases the risk that subrecipients may not properly utilize federal funds or adhere to program requirements, potentially jeopardizing federal funding. In addition, without appropriate review of subrecipient audit reports, there is an increased risk that all applicable audit findings may not be addressed appropriately. This could cause federal funding to be reduced, taken away, or sanctions imposed by the federal grantor agency. Based upon discussion with management, monitoring did not occur due to staffing issues and increased workloads. Additionally, certifications were not sent due to an error within the EMGrants system. We recommend the Department evaluate and strengthen existing procedures regarding subrecipient monitoring. The Department should have alternative procedures to verify subrecipient audits were required and performed when system issues occur, which could include searching the federal audit clearinghouse and/or reaching out to the subrecipients via other means. The Department should consistently obtain and perform a review of subrecipient audit reports to ensure timely and appropriate corrective action is taken to address any findings for the PA program. We also recommend the Department monitor the progress of subrecipient audit reviews with a centralized tracking sheet that is updated throughout the review process, as opposed to running a report on an ad hoc basis, to ensure all reviews and any associated management decisions are completed timely. Furthermore, procedures should be adequately documented to provide management reasonable assurance they have been performed. Management should periodically monitor these procedures to ensure they are operating as intended.

DISASTER GRANTS ?TRANSPARENCY ACT REPORTING Finding Number: 2021-025 State Agency Number: DPS-02 Assistance Listing Program Number and Title: 97.036 ? Disaster Grants ? Public Assistance (Presidentially Declared Disasters) Federal Award Identification Number / Year: 4360-DR-OH-PA / 2018 4424-DR-OH-PA / 2019 4447-DR-OH-PA / 2019 4507-DR-OH-PA / 2020 Federal Agency: Department of Homeland Security Compliance Requirement: Reporting Repeat Finding from Prior Audit? No NONCOMPLIANCE AND MATERIAL WEAKNESS The Federal Funding Accountability and Transparency Act (Pub. L. No. 109-282, as amended by Section 6202 of Public Law 110-252, hereafter referred as the ?Transparency Act? that are codified in 2 CFR Part 170) requires prime recipients of federal awards who make first-tier subawards to report the subaward on the Federal Funding Accountability and Transparency Subaward Reporting System (FSRS) website maintained by the federal Office of Management and Budget. Under the requirements of 2 C.F.R. Part 170, recipients (i.e., direct recipients) of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more on the FSRS website. Prime recipients must report by the end of the month following the month in which the obligation is made. It is management?s responsibility to design and implement internal controls to reasonably ensure compliance with laws and regulations and to ensure management?s objectives are achieved. During state fiscal year 2021, the Department obligated approximately $238 million for 205 subawards which exceeded $30,000 and were required to be reported on the FSRS website in accordance with the Transparency Act for the Disaster Grants ? Public Assistance (PA) program. As PA projects are approved by the Federal Emergency Management Agency (FEMA), the key data elements for the report are compiled from subrecipient State-Local Agreements and Project Worksheets (PW), which are maintained in the Department?s EMGrants system. The Disaster Services Administrator generates a Transparency Act upload template from the EMGrants system and provides the report for upload to the Budget Analyst Supervisor for review and submission into the FSRS website. However, the Department's internal controls were not operating effectively. As a result, the following errors were noted: See Schedule of Findings and Questioned Costs for chart/table. A lack of adequate internal controls over the preparation and review of reports increases the risk the reports submitted to the federal grantor agency are inaccurate and incomplete. In addition, by not complying with federal Transparency Act reporting requirements, the Department risks federal funding being reduced, taken away, or other sanctions imposed by the federal grantor agency. If the subawards are not reported accurately and timely within FSRS, the risk exists that those using the Transparency Reports could be relying on inaccurate information. Based on discussion with management, these errors were due to staffing issues and an increased workload due to the COVID-19 disaster/emergency declaration, as well as the previous three federal disaster/emergency declarations. We recommend the Department collect and report on the FSRS website complete and accurate information regarding subawards subject to the Transparency Act. We also recommend the Department evaluate its Transparency Act reporting control procedures and update them as necessary to ensure they promote compliance with the Federal regulations, as well as accuracy and completeness of information submitted.

DISASTER GRANTS ? QUARTERLY PROGRESS REPORTING Finding Number: 2021-026 State Agency Number: DPS-03 Assistance Listing Program Number and Title: 97.036 ? Disaster Grants ? Public Assistance (Presidentially Declared Disasters) Federal Award Identification Number / Year: 4360-DR-OH-PA / 2018 4424-DR-OH-PA / 2019 4447-DR-OH-PA / 2019 4507-DR-OH-PA / 2020 Federal Agency: Department of Homeland Security Compliance Requirement: Reporting Repeat Finding from Prior Audit? No NONCOMPLIANCE AND SIGNIFICANT DEFICIENCY 2 C.F.R. ?3002.10 gives regulatory effect to the Department of Homeland Security for 2 C.F.R. ?200.329 which establishes requirements over reporting program performance and states, in part: . . . (b) . . . when required by the terms and conditions of the Federal award, recipients must provide cost information to demonstrate cost effective practices . . . 44 C.F.R. ?206.204 (f) states, in part: Progress reports will be submitted by the recipient to the Regional Administrator quarterly. . . Such reports will describe the status of those projects on which a final payment of the Federal share has not been made to the recipient. . . It is management?s responsibility to implement control policies and procedures to reasonably ensure the federal reports they submit are accurate, complete, and in compliance with program requirements. During state fiscal year 2021, the Department disbursed approximately $174 million in sub-awards for 169 subrecipients for the Disaster Grants - Public Assistance (PA) program. The Department is required to submit quarterly progress reports on all open large projects 30 days after the end of each calendar quarter. A Disaster Services Consultant II completes the quarterly progress report spreadsheet for submission to Federal Emergency Management Agency (FEMA), which includes an updated status and expenditure data for each large project. The project information is provided by subrecipients and is manually entered into the report by the Disaster Services Consultant II. The Disaster Services Administrator then reviews the spreadsheet for accuracy and completeness and submits the report to FEMA. However, the Department?s internal controls were not operating effectively. As a result, for one of 25 (4%) subrecipients selected for testing from one Quarterly Progress Report, the amounts included for Expenditures to Date and Federal Funds Disbursed were entered incorrectly. The line items were overstated by $192,762 and $725,500, respectively. A lack of effective internal controls over federal reports increases the risk that reports submitted to FEMA are inaccurate and incomplete. In addition, by not complying with program requirements, the Department risks federal funding being reduced, taken away, or other sanctions imposed by the federal grantor agency. If subawards are not accurately reported to FEMA, the risk exists that those using the reports could be relying on inaccurate information. Based on discussion with management, these issues occurred due to data entry errors. We recommend the Department strengthen existing controls and procedures, specifically supervisory reviews, for Quarterly Progress Report submissions to FEMA to ensure they promote compliance with the Federal regulations, as well as accuracy and completeness of information submitted. Management should ensure the data in the reports is accurate and complete before submission to the federal grantor agency. Management should monitor these procedures to ensure the controls are operating effectively and as intended.

NGMOMP ? CASH MANAGEMENT Finding Number: 2020-003 State Agency Number: ADJ-01 CFDA Number and Title: 12.401 ? National Guard Military Operations and Maintenance (O&M) Projects Federal Award Identification Number/Year: W91364-20-2-1024T / 2020 Federal Agency: Department of Defense Compliance Requirements: Cash Management Repeat Finding from Prior Audit? Yes Prior Audit Finding Number: 2019-004 NONCOMPLIANCE AND MATERIAL WEAKNESS 31 C.F.R. Section?205.33(a) states, in part: A State must minimize the time between the drawdown of Federal funds from the Federal government and their disbursement for Federal program purposes. A Federal Program Agency must limit a funds transfer to a State to the minimum amounts needed by the State and must time the disbursement to be in accord with the actual, immediate cash requirements of the State in carrying out a Federal assistance program or project. The timing and amount of funds transfers must be as close as is administratively feasible to a State's actual cash outlay for direct program costs and the proportionate share of any allowable indirect costs? National Guard Regulations (NGR) 5 -1, Chapter 11 ? states, in part: 11-4. Payment Processing: a. The National Guard Bureau (NGB) Cooperative Agreement program operates on the basis that the grantee expends State government funds first and then submits request (vouchers) for reimbursement from NGB for allowable CA costs. All approved CA agreement payments (to include Advances) made to the grantee by NGB are reimbursable payments. To process reimbursement payments the grantee shall provide an OMB Standard Form (SF) 270 (Request for Advance or Reimbursement) with supporting documentation to the CA PM. The supporting documentation will itemize, by AMSCO and EEIC, the amount of funds expended and the corresponding grantee accounting classification to be reimbursed. . . . g. The USPFO/Asst USPFO Air (Fiscal) will process reimbursement request from the grantee to DFAS so as to meet the requirements of U.S Treasury, 31 Code of Federal Regulation, Part 205, Rules and Procedures for Efficient Federal-State Funds Transfers 31 CFR Part 205 and the Cash Management Information Act Treasury-State Agreements. 11-5. Advance Payment Method (a)(5): A statement that the grantee agrees to minimize the time elapsing between the transfer of funds from the U.S. Treasury and their disbursement by the State. (No more than 45 days) It is management?s responsibility to implement control policies and procedures to reasonably ensure advance requests of federal funds are for immediate cash needs, processed accurately, and disbursed timely in accordance with applicable laws and regulations. During state fiscal year 2020, the Department received approximately $37.5 million in advance federal funding for the National Guard Military Operations and Maintenance Projects program (NGMOMP). The Department utilizes the SF-270 form to request the advances of funds in accordance with 31 C.F.R. Section 205.33(a) and N.G.R. 5-1 - National Guard Grants and Cooperative Agreements. To monitor the cash flow of each cooperative agreement (CA), the State Finance Office and Federal Program Managers track the funding by creating spreadsheets to ensure the revenues, expenditures, cash balance, percent spent, and liquidation percentages are all in accordance with each CA by program and department. However, the Department's controls did not detect or prevent noncompliance with the time limits established in 31 C.F.R. Section 205.33(a) and N.G.R. 5-1. For one of nine (11.1%) advance requests selected for testing, the Department did not disburse the advance within 45 days of the receipt of the federal funds, as required by 31 C.F.R. Section 205.33(a) and N.G.R. 5-1. The Department disbursed the funds 12 days after the required disbursement date. Not having effective controls over the timely disbursement of federal funds could lead to the Department not limiting funds based on immediate cash needs and not expending funds timely, resulting in noncompliance with 31 C.F.R. Section 205.33(a) and N.G.R. 5-1. These conditions could subject the Department to sanctions or other penalties and a repayment of part of the cooperative agreement amounts. In addition, noncompliance could subject the Department to paying interest charges on these requests. Based on discussions with management, payroll has large cost differences each pay period which make it difficult to estimate the immediate cash needs. The Department projects the cost for advance and requests the highest projected amount. This caused the request to be fully liquidated after the 45 day period. We recommend the Department evaluate its existing cash management control procedures and update them as necessary to reasonably ensure all federal advance requests are disbursed timely and are only for immediate cash needs, as established in accordance with 31 C.F.R. Section 205.33(a) and N.G.R. 5-1. These procedures should clearly document the responsibilities of the State Finance Office and Federal Program Managers. We also recommend the Department establish procedures to periodically monitor its compliance with the cash management requirements and initiate necessary actions to resolve any noncompliance that results.

IT ? OHIO BENEFITS SYSTEM ? MEDICAID/CHIP/SNAP/TANF Finding Number: 2020-004 State Agency Number: DAS-02 CFDA Number and Title: 10.551/10.561 SNAP Cluster 93.558 ? Temporary Assistance for Needy Families (TANF) 93.767 ? Children?s Health Insurance Program (CHIP) 93.775/93.777/93.778 ? Medicaid Cluster Federal Award Identification Number/Year: 182OH102S2514 / 2018 (SNAP Cluster) 182OH102S6018 / 2018 (SNAP Cluster) 192OH102S2514 / 2019 (SNAP Cluster) 192OH102S6018 / 2019 (SNAP Cluster) 202OH102S2514 / 2020 (SNAP Cluster) 202OH102S6018 / 2020 (SNAP Cluster) 1801OHTANF / 2018 (TANF) 1901OHTANF / 2019 (TANF) 2001OHTANF / 2020 (TANF) 1905OH5021 / 2019 (CHIP) 2005OH5021 / 2020 (CHIP) 1905OH5MAP / 2019 (Medicaid) 2005OH5MAP / 2020 (Medicaid) Federal Agencies: Department of Agriculture Department of Health and Human Services Compliance Requirements: Activities Allowed or Unallowed, Allowable Costs/Cost Principles, Eligibility, Special Tests & Provisions - Income Eligibility Verification System Repeat Finding from Prior Audit? Yes Prior Audit Finding Number: 2019-005 MATERIAL WEAKNESS NOTE: Finding numbers 2020-001 , 2020-XXX, 2020-XXX, 2020-XXX, and 2020-XXX contain additional information which is integral to and should be read in conjunction with this finding. Applications/systems must be properly designed to achieve the business and IT goals of the organization. External factors effecting eligibility must be appropriately considered and properly evaluated to ensure eligibility for benefits is properly determined, and appropriate updates to eligibility are made when applicable. It is critical the appropriate monitoring controls are designed and implemented to reasonably ensure the organization has adequate controls to achieve management?s goals and objectives. During state fiscal year (SFY) 2020, the State of Ohio disbursed a combined total of $26.8 billion in public assistance payments related to the following programs: See Schedule of Findings and Questioned Costs for chart/table. The information below summarizes Finding 2020-001 as it relates to the control process and weaknesses identified related to eligibility for the SNAP Cluster and Medicaid Cluster. These issues also apply to the CHIP and TANF programs and additional information was added, where necessary, to identify any errors related to these programs. The State of Ohio uses a multi-agency approach to administer these programs, as follows: overall compliance and administration of the Medicaid Cluster, and CHIP falls under the Ohio Department of Medicaid (MCD), overall compliance and administration of the SNAP Cluster and TANF programs falls under the Ohio Department of Job & Family Services (ODJFS), and programming and administration of the State?s eligibility determination computer system, Ohio Benefits (OB), falls under the Ohio Department of Administrative Services (DAS). The OB system was first implemented for Medicaid in SFY 2014; CHIP was added in August 2016; and, SNAP and TANF were added in August 2018. The OB system includes the Income Eligibility Verification System (IEVS) functionality which compares reported recipient income to income information maintained by outside data sources (SSA, IRS, etc.). The State also utilizes the 88 Ohio counties in the eligibility determination process to work with applicants, receive/enter eligibility documentation into the State?s system, and follow up on alerts issued by the system. Currently, individuals applying to receive public assistance benefits complete an application through one of several input locations including the Ohio Benefits Self-Service Portal, the Federally-Funded Marketplace, Social Security, County Departments of Job & Family Services (CDJFS) offices; the Medicaid Consumer Hotline (the Hotline starts the application and sends to the CDJFS to complete); and, paper applications that are sent to the CDJFS. When applying, the CDJFS collects and maintains any documentation provided by the individual either in a paper case file or in the OnBase Enterprise Documentation Management System (EDMS) maintained under contract by DAS. After collecting documentation, the county caseworker enters the individual?s information into the OB system which determines the initial eligibility benefit amount, where applicable. This process is also used to perform eligibility redeterminations on an annual basis or when prompted through a system alert. The OB system is programmed with the State Plan recipient eligibility requirements to determine whether the recipient is eligible to receive the related program benefits based on the information entered by the recipient or caseworker and also assigns a benefit aid category. Once the determination is made, the OB system uploads the eligibility information to the MCD or ODJFS payment system to process the payment. During SFY 2020, we noted the following weaknesses/defects in the eligibility process, as listed below: ? Overwriting ? the OB system maintains several pieces of key information related to a recipient?s eligibility (income, household size, age, etc.). If new or updated information is identified, the county caseworker is expected to add this information to the system. Based on our testing, in some cases, the caseworker is replacing/overwriting the existing information with new information instead of adding this new data to the case record. However, there is no system warning or other control in place to identify or prevent this overwrite. ? Multi-program Info ? There are certain pieces of key information (i.e. name, income, age, etc.) maintained in the OB system which impact all public assistance programs, including SNAP, TANF, Medicaid, and CHIP. However, due in part to the complexities/variations of the requirements for each federal program, the system currently does not link this information between programs. Therefore, the county caseworker must manually adjust each affected program separately when a change occurs. ? System Design Weaknesses/Defects in the OB system: ? Alerts ? During SFY20, an overwhelming volume of alerts were sent to the counties for investigation and follow-up (more than 26.3 million alerts were issued according to DAS records; 17 million related to IEVS alerts and 9.3 million to non-IEVS alerts). This resulted in an unmanageable workload and ineffective application of the alert process. Our testing and inquiry with both State and county personnel identified the following system design weaknesses or defects in the Ohio Benefits system related to alerts: ? Multiple and repetitive alerts (redundancy). ? Irrelevant alerts (zero or small dollar amounts). ? Additional steps required to complete an alert (having to leave the alert window, opening an OB window, and then having to go back through the Alert Inventory to clear the alert). ? Alerts being received on persons not receiving public assistance. ? For three of 80 (3.8%) Medicaid recipients and five of 80 (6.3%) CHIP recipients selected for testing, a systemic design and/or issue within Ohio Benefits either impacted the eligibility process and/or eligibility determination for the recipient, which are detailed in the findings for the Ohio Department of Medicaid. Additionally, we noted the following weakness/issues regarding the contract and monitoring related to the OB system: ? DAS and ODJFS entered into a contract agreement with the developing vendor during SFY 2013 to integrate eligibility systems across public assistance programs, resulting in the implementation of OB. In SFY 2014, MCD and ODJFS were separated into two different departments. However, signed amendments did not include MCD as a separate agency. Since the original contract was signed, there have been numerous amendments to the contract, also not signed by MCD or ODJFS, making organization of the additional deliverables difficult to monitor. ? Although operating protocols were available defining DAS? responsibilities, signed interagency agreements have not been prepared to define the roles and responsibilities of each agency and naming DAS as the administrator for OB. No data governance structure was in place to ensure reliability for management. As a result, it was not always clear if/how program objectives were being met/monitored and program compliance was being achieved. ? DAS engaged a third party evaluator to provide a variety of Quality Assurance and Independent Verification and Validation (QA/IV&V) professional services. One of the services included providing monthly and quarterly IV&V reports. These reports provided a summary of project progress during the reporting period, along with detailed findings, risks, and recommendation items. These reports were provided to DAS, who distributed them to MCD and ODJFS. However, reports for two of 12 (17%) months and three of four (75%) quarters did not have evidence the State reviewed the findings or performed any remediation of the recommendations/issues noted. ? There was no comprehensive inventory or other documentation and tracking of internal or external reviews/evaluations/certifications performed for the OB system, or those required to ensure they were completed timely. Such reviews could include a gate review, annual security and privacy control assessments, or other internal or external reviews. Without proper controls for entering, processing, and maintaining recipient information and system alerts, there is an increased risk that benefits paid to or on behalf of recipients will be inaccurate or unallowable. This risk is substantially increased if the State?s eligibility determination system, Ohio Benefits, contains design or operational flaws that could impact a recipient?s eligibility and, as a result, could have a material impact on the amounts reimbursed by the federal government. These weaknesses/defects could allow undue subjective decisions, jeopardize accurate eligibility processing, and/or result in improper payments or federal reimbursements. Overpayments or payments to or on behalf of ineligible recipients may subject the State to penalties or sanctions which may jeopardize future funding and limit its ability to fulfill program requirements to provide benefits to those in need. Lack of monitoring the IV&V progress reports, contract amendments, and outside evaluations and assessments could result in a lack of confidence that financial and compliance goals will be achieved. Failure to obtain signed agreements from related agencies could result in agreed upon functions not being met. Based on discussions with management, human error/ oversight and systemic issues led to the issues identified. Based on discussions with management, human error/ oversight and systemic issues led to the issues identified. Management also indicated they have been and are continuing to make corrections and enhancements to the Ohio Benefits system to address the weaknesses and defects identified in the previous and current audit findings. RECOMMENDATIONS We recommend DAS work collectively with the related state agencies to implement/update robust processes, procedures, and system controls to address the weaknesses associated with the IEVS process within the OB system. These changes/updates should include, but not be limited to: ? Redesigning the alert process to be more effective and efficient. This could include a more centralized evaluation of alert activity and/or better use of automated tools to analyze and prioritize items requiring follow-up. This would allow related state agency level personnel to become more experienced and adept at identifying and investigating anomalies and help focus the r?esources of both related state agency and county personnel. ? Identifying and coordinating program changes to address the system design weaknesses/defects identified above. This should include working collaboratively with the related state agencies to prioritize program changes which could directly impact the eligibility determinations or benefit amounts to ensure they are corrected in a timely manner to prevent and detect further improper payments. ? Implementing program logic to ensure changes made to recipient information for one public assistance program are carried through in Ohio Benefits to other applicable public assistance programs for that recipient without caseworker initiation. ? Ensuring vendor contacts/amendments, and interagency agreements are formalized, contain all parties of the agreements, and fully and clearly define the roles, responsibilities, and expectations related to each party, including completion of required risk assessments and evaluations, and any other specific tasks designed to achieve program compliance. ? Ensuring appropriate and coordinated monitoring and tracking procedures are in place regarding reviews required and performed, and the timely remediation of issues identified, including, but not limited to: ? A data governance structure designed to ensure data quality and reliability for management, the grantor agencies, and other users of this information. This should include data subject experts from each related agency to help ensure quality of data requests before external and internal users rely on the data, issues are addressed with a clear escalation path, and establishing accountabilities and alignment between the related agencies. ? Reviewing and monitoring the IV&V reports prepared by the third party evaluator and to prioritize and develop a remediation plan, along with MCD and ODJFS, to help track and ensure necessary changes to the OB application are completed accurately and timely, and the system is operating as intended. ? Coordinating and managing the contract contents with the developing vendor to help ensure all contract and amendment deliverables are being met. ? Ensuring documentation related to all internal and external evaluations and assessments of the Ohio Benefits eligibility environment be tracked, monitored, and maintained to ensure all appropriate monitoring and remediation efforts are completed timely and in compliance with standards.

UNIFORM GUIDANCE POLICIES AND PROCEDURES Finding Number: 2020-005 State Agency Number: AGE-01 CFDA Number and Title: 93.044 / 93.045 / 93.053 ? Aging Cluster Federal Award Identification Number / Year: 18AAOHT3SS / 2018 18AAOHT3CM / 2018 18AAOHT3HD / 2018 18AAOHNSIP / 2018 1901OHOASS / 2019 1901OHOACM / 2019 1901OHOAHD / 2019 1901OHOANS / 2019 2001OHOASS / 2020 2001OHOACM / 2020 2001OHOAHD / 2020 2001OHOANS / 2020 Federal Agency: Department of Health and Human Services Compliance Requirements: Activities Allowed and Unallowed, Allowable Costs/Cost Principles, Cash Management Repeat Finding from Prior Audit? Yes Prior Audit Finding Number: 2019-006 NONCOMPLIANCE AND MATERIAL WEAKNESS 45 C.F.R. Part 75 establishes uniform administrative requirements, cost principles, and audit requirements for federal awards provided by the Department of Health and Human Services and requires an entity receiving federal funds establish written policies in order to comply with certain requirements. Specifically, 45 C.F.R. Section 75.302(b)(6) and 45 C.F.R. Section 75.305, 45 C.F.R. Section 75.302(b)(7), and 45 C.F.R. Section 75.430(a) relate to written policies for cash management, allowability of costs, and time and effort, respectively. Furthermore, an entity?s system of internal controls consists of the policies and procedures established by management to provide reasonable assurance that it complies with applicable rules and regulations and that specific operational objectives are achieved. These policies establish the authorization level for financial and operational transactions to be executed and are meant to accomplish management's goals and professional and statutory requirements. The policies and procedures must be officially approved and distributed to all applicable employees to ensure they are aware of the policies and procedures, and are adhering to them. During the audit period, the Department disbursed approximately $54 million in federal funds related to the Aging Cluster, with $45.7 million distributed to subgrantees. The Department had written policies and procedures in place regarding the general purchase of goods, unallowable costs for contracts and agreements, and time and attendance, but did not address specific allowability of costs and cost principles of 45 C.F.R. Section 75, Subparts D and E, cash management, and the terms and conditions of the federal award. In addition, they were not current (most recent was 2017) and inconsistent with statutory requirements, referenced repealed OMB (Office of Management and Budget) Circulars and defunct accounting systems, and did not contain evidence of formal approval by management. During the current audit period, the Department made progress in updating its related policies and procedures, but most of the documents remained in draft mode. UNIFORM GUIDANCE POLICIES AND PROCEDURES (Continued) Without complete, accurate, updated, and formally approved policies and procedures, the Department subjects itself to risk that transactions will not be processed timely, accurately, consistently, or in accordance with federal requirements. This risk is increased if there is turnover in staff and new employees do not have up-to-date formal policies and procedures as a guide to define processes and requirements. This could lead to the Department not complying with the requirements and could result in decreased future funding, repayment of grant awards, sanctions, and/or fines imposed by the federal grantor agency. Based on discussion with management and review of documents, the Department did not have sufficient time nor the human resources to finish updating the policies. We recommend the Department continue to finalize, formally approve, and implement updated written policies and procedures over the compliance areas noted above. These policies and procedures should be reflective of the current accounting policies and approaches related to all significant federal funds, including the Aging Cluster. We also recommend management provide these procedures to all employees and periodically monitor them to ensure they are operating as intended and updated as necessary. Lastly, we recommend the Department review, evaluate, and update its policies and procedures on a regular basis to ensure they remain current and are meeting management?s objectives and federal requirements.

LOW-INCOME HOME ENERGY ASSISTANCE PROGRAM ? CASH MANAGEMENT Finding Number: 2020-006 State Agency Number: DEV-01 CFDA Number and Title: 93.568 Low-Income Home Energy Assistance Program Federal Award Identification Number / Year: 18B1OHLIEA / 2018 1801OHLIE4 / 2018 1901OHLIEA / 2019 1901OHLIE4 / 2019 2001OHLIEA / 2020 2001OHLIE4 / 2020 Federal Agency: Department of Health and Human Services Compliance Requirement: Cash Management Repeat Finding from Prior Audit? Yes Prior Audit Finding Number: 2019-007 NONCOMPLIANCE AND MATERIAL WEAKNESS 31 C.F.R. Section 205.11 states, in part: (a) A State and a Federal Program Agency must minimize the time elapsing between the transfer of funds from the United States Treasury and the State's payout of funds for Federal assistance program purposes, whether the transfer occurs before or after the payout of funds. (b) A State and a Federal Program Agency must limit the amount of funds transferred to the minimum required to meet a State's actual and immediate cash needs. . . . To define these allowable timeframes, the State of Ohio and the U.S. Department of the Treasury entered into a Cash Management Improvement Act (CMIA) Agreement which requires the Agency to utilize the Modified Pre-Issuance Methodology when requesting federal funds for the Low-Income Home Energy Assistance Program (LIHEAP). Section 6.2.4 of the agreement regarding the Modified Pre- Issuance Methodology states, in part: . . . The State shall request funds such that they are deposited in a State account not more than eight business days prior to the day the State makes a disbursement. . . The amount of the request shall be the amount the State expects to disburse. . . In addition, 45 C.F.R. Sections 75.302 and .305 give regulatory effect to the Department of Health and Human Services for 2 C.F.R. Section 200.302(b)(6) which requires states to have written procedures to implement the requirements of 2 C.F.R. Section 200.305. 45 C.F.R. Section 75.305(a) indicates for states, payments are governed by Treasury-State CMIA agreements and default procedures codified at 31 C.F.R. Part 205 ?Rules and Procedures for Efficient Federal-State Funds Transfers? and TFM 4A- 2000 Overall Disbursing Rules for All Federal Agencies. Furthermore, an entity?s system of internal controls consists of the policies and procedures established by management to provide reasonable assurance that it complies with applicable rules and regulations and those specific operational objectives are achieved. These policies establish the authorization level for financial and operational transactions to be executed and are meant to accomplish management's goals and professional and statutory requirements. During state fiscal year 2020, the Agency drew down approximately $160 million in federal funding for LIHEAP. The Agency utilizes the CMIA Agreement, as well as internal policies and procedures as a guide for completing federal draws; however, these policies and procedures do not specifically address the timeliness of the disbursement/draw process as required by 45 C.F.R. Section 75.302(b)(6). The Agency compiles a worksheet of all payment requests for administrative and program costs associated with providing LIHEAP assistance in order to determine the amount of federal funds to be drawn. This evaluation includes year-to-date disbursements, year-to-date revenues, and any refunds received and/or pending. However, as noted above, the Agency's internal control policies do not contain procedures which allow disbursements to be tied to a specific draw. Due to this, it is not possible to test if draws were disbursed in compliance with the applicable funding techniques specified in the Treasury-State Agreement (within eight business days). Without procedures in place which allow for ensuring a timely disbursement of funds in accordance with federal requirements and the CMIA Agreement, interest penalties may be incurred by the State of Ohio. This could also subject the Agency to sanctions or other penalties by the federal grantor agency. Based on discussions with management, they have not considered developing a methodology which allows them to trace federal draw amounts to subsequent disbursements since their focus is to draw federal funds based on an amount calculated from disbursements already made. We recommend the Agency update its written policies and procedures for the cash management process to provide a methodology which allows for disbursements to be tied to related federal draws to help ensure compliance with 45 C.F.R. Section 75.302(b)(6). These policies and procedures should be formally approved and adopted by management, provided to all employees, and monitored periodically by management to ensure the procedures are operating as intended and updated as necessary.

LOW-INCOME HOME ENERGY ASSISTANCE PROGRAM ? SUBRECIPIENT MONITORING Finding Number: 2020-007 State Agency Number: DEV-02 CFDA Number and Title: 93.568 Low-Income Home Energy Assistance Program Federal Award Identification Number / Year: 18B1OHLIEA / 2018 1801OHLIE4 / 2018 1901OHLIEA / 2019 1901OHLIE4 / 2019 2001OHLIEA / 2020 2001OHLIE4 / 2020 Federal Agency: Department of Health and Human Services Compliance Requirement: Subrecipient Monitoring Repeat Finding from Prior Audit? No NONCOMPLIANCE AND MATERIAL WEAKNESS 45 C.F.R. Section 75.352 gives regulatory effect to the Department of Health and Human Services uniform administrative requirements for grants to states and local governments relating to subrecipient monitoring and management and states, in part: All pass-through entities must: . . . (b) Evaluate each subrecipient's risk of noncompliance with Federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate subrecipient monitoring described in paragraphs (d) and (e) of this section?? (e) Depending upon the pass-through entity's assessment of risk posed by the subrecipient (as described in paragraph (b) of this section), the following monitoring tools may be useful for the pass-through entity to ensure proper accountability and compliance with program requirements and achievement of performance goals: (1) Providing subrecipients with training and technical assistance on program-related matters; (2) Performing on-site reviews of the subrecipient's program operations; and (3) Arranging for agreed-upon-procedures engagements as described in ? 75.425. Additionally, 45 C.F.R. Section 75.521(d) states: (d) Time requirements. The . . . pass-through entity responsible for issuing a management decision must do so within six months of acceptance of the audit report by the FAC [Federal Audit Clearinghouse]. The auditee must initiate and proceed with corrective action as rapidly as possible and corrective action should begin no later than upon receipt of the audit report. During state fiscal year 2020, the Agency awarded LIHEAP funds to 51 subrecipients. As part of the subrecipient monitoring process, the Agency?s Office of Community Assistance Field Unit performs annual on-site visits, typically in the Spring, to assess each subrecipient?s compliance with federal statutes and the terms and conditions of the subaward. However, the Agency was unable to perform on-site reviews of LIHEAP subrecipients during the audit period due to the COVID-19 pandemic restrictions. In addition, the Agency?s audit Section monitors all subrecipient audit reports issued during the year to ensure proper disclosure of federal funds and issues closure letters in response to any LIHEAP findings noted in the subrecipient?s audit report. Also, for two of seven (28.6%) subrecipient audits selected for testing, the Agency did not issue a management decision and send a closure letter responding to any LIHEAP-related comments within six months of the report being accepted by the FAC, as required. The closure letters were issued 17 and 44 days late. Without adequate procedures in place to monitor subrecipient compliance with federal statutes, laws and regulations, there is an increased risk subrecipients may misuse subaward funds for unauthorized purposes. This could lead to fines, penalties, or repayment of program funds being imposed by the federal grantor agency. Based on discussions with management, on-site reviews were not plausible due to the COVID-19 pandemic and the ensuing stay-at-home order. Management indicated a remote monitoring process has been developed, but was not implemented by the end of the audit period. The pandemic and move to working from home also caused additional delays in the subrecipient audit report monitoring process, which led to the delays in issuing the closure letters. We recommend the Department evaluate its current control procedures and processes over LIHEAP subrecipient monitoring and update them as necessary to reasonably ensure compliance with 45 C.F.R. Sections 75.352 & 75.521(d). These procedures should include continuing to prioritize development of a remote monitoring process for subrecipients and ensuring closure letters are sent in a timely manner. In addition, management should periodically monitor these activities to help ensure the procedures are functioning as intended.

LOW-INCOME HOME ENERGY ASSISTANCE PROGRAM ? REPORTING Finding Number: 2020-008 State Agency Number: DEV-03 CFDA Number and Title: 93.568 Low-Income Home Energy Assistance Program Federal Award Identification Number / Year: 18B1OHLIEA / 2018 1801OHLIE4 / 2018 1901OHLIEA / 2019 1901OHLIE4 / 2019 2001OHLIEA / 2020 2001OHLIE4 / 2020 Federal Agency: Department of Health and Human Services Compliance Requirement: Reporting Repeat Finding from Prior Audit? No NONCOMPLIANCE AND MATERIAL WEAKNESS 45 C.F.R. Section 96.82(a) states: Each grantee which is a State or an insular area which receives an annual allotment of at least $200,000 shall submit to the Department, as part of its LIHEAP [Low-Income Home Energy Assistance Program] grant application, the data required by section 2605(c)(1)(G) of Public Law 97-35 (42 U.S.C. 8624(c)(1)(G)) for the 12-month period corresponding to the Federal fiscal year (October 1-September 30) preceding the fiscal year for which funds are requested. The data shall be reported separately for LIHEAP heating, cooling, crisis, and weatherization assistance. 42 U.S.C. Section 8624(c)(1)(g) states: (1) As part of the annual application required in subsection (a), the chief executive officer of each State shall prepare and furnish to the Secretary, in such format as the Secretary may require, a plan which? ? (G) states, with respect to the 12-month period specified by the Secretary, the number and income levels of households which apply and the number which are assisted with funds provided under this subchapter, and the number of households so assisted with? (i) one or more members who had attained 60 years of age; (ii) one or more members who were disabled; and (iii) one or more young children; 42 U.S.C. Section 8629(a) states: The Secretary, after consultation with the Secretary of Energy, shall provide for the collection of data, including? (1) information concerning home energy consumption; (2) the amount, cost and type of fuels used for households eligible for assistance under this subchapter; (3) the type of fuel used by various income groups; (4) the number and income levels of households assisted by this subchapter; (5) the number of households which received such assistance and include one or more individuals who are 60 years or older or disabled or include young children; and (6) any other information which the Secretary determines to be reasonably necessary to carry out the provisions of this subchapter. It is management?s responsibility to implement control policies and procedures to reasonably ensure the federal reports they submit are accurate, complete, and in compliance with program requirements. It is imperative that management maintain the underlying data and related program documentation used to prepare and support these reports. Each year, the Database Administration Specialist in the Information Technology section prepares a draft of the Annual Report on Households Assisted by LIHEAP (OMB No. 0970-0060) using data/amounts obtained from the Agency?s Ohio Community and Energy Assistance Network (OCEAN). The draft report is then reviewed by the Agency?s Fiscal Manager and Office of Community Assistance Management for completeness and accuracy. Once approved, the Fiscal Manager submits the annual report numbers electronically to the Department of Health and Human Services by December 15. However, for the Annual Report on Households Assisted by LIHEAP submitted during state fiscal year 2020, the Agency could not provide supporting documentation from OCEAN to corroborate the reported amounts for the following line items: ? Section II. Number of Assisted Households by Poverty Interval, Line 4 Weatherization; ? Section III. Number of Assisted Households by Vulnerable Population, Line 4 Weatherization; and, ? Section VI. Number of Assisted Households by Young Child Age Category, Line 4 Weatherization. A lack of adequate internal controls and record retention over federal reporting increases the risk that reports submitted to the federal grantor agency are inaccurate. Reporting inaccurate or incomplete information could subject the Agency to federal sanctions, limiting the amount of funding for program activities. Based on discussions with management, copies of the time-sensitive reports were not retained due to oversight. We recommend the Agency evaluate current procedures and consider altering or implementing additional policies and procedures, as necessary, to provide reasonable assurance the data being used to prepare reports for all federal programs is being maintained and accessible. This data and/or documents should be maintained according to the Agency?s record retention policy.

IT ? INAPPROPRIATE APPLICATION ADMINISTRATOR ACCOUNT ACCESS Finding Number: 2020-009 State Agency Number: DDD-01 CFDA Number and Title: 93.775/93.777/93.778 ? Medicaid Cluster Federal Award Identification Number / Year: 1805OH5MAP / 2018 1905OH5MAP / 2019 Federal Agency: Department of Health and Human Services Compliance Requirements: Activities Allowed or Unallowed, Allowable Costs/Cost Principles, Special Tests and Provisions ? Provider Eligibility Repeat Finding from Prior Audit? Yes Prior Audit Finding Number: 2019-008 MATERIAL WEAKNESS Organizations logically restrict access to their computer systems, programs, and data to help reduce the risk of unauthorized use of key computer resources. They establish levels of access commensurate to a specific user?s job responsibilities. Access to administrative privileges, which may be used to override other controls, is tightly restricted. Computer systems are regularly monitored for possible misuse and periodic reviews of user access are performed to ensure all access is authorized. The Department?s Information Policies include the following, which govern implementation of the controls described above: ? Completion of Information Technology Services Security Affidavit (ITS-001). ? System Access and User Authentication (ITS-002) Section IV.C: Access Control for DODD Web Applications. The Medicaid Billing System (MBS) is designed to process Medicaid claims for waiver and targeted case management services provided by eligible providers. During state fiscal year 2020, approximately $2 billion in payments were processed through MBS. MBS is supported by several ancillary systems, including the Medicaid Services System (MSS) and Provider Services Management (PSM). MSS enrolls clients onto the various waivers and records individual service plans (which ultimately authorize waiver claims) while PSM certifies providers of Medicaid services. The internal controls in the PSM and MSS systems are significant to the Department?s efforts to prevent unauthorized disbursements of Medicaid funds. The following MBS and MSS accounts did not require access for the performance of their job functions: ? One of 19 (5.2%) MBS users had administrative access allowing them to upload data, edit the billing schedule, and delete no match claims (claims previously uploaded that could not be processed during the billing cycle they were uploaded; typically a claim on a pending-prior report). A non-matched claim might be deleted if notified by the provider they did not want the subsequent claim to process. ? One of 34 (2.9%) MSS users had administrative access allowing them to submit a Payment Application Waiver Plan and enroll a provider. Inappropriate access increases the risk that users have inappropriate access to programs and data which could jeopardize the integrity of departmental data. This could result in the transmission of inaccurate transactions, which may misstate federal or state expenditure activity, or result in the misuse or fraudulent misappropriation of state resources or federal program monies. Based on discussions with management, these access exceptions were due to inadequate review processes and updating of access. We recommend the Department evaluate the roles for these accounts and remove all unnecessary access not required for the job function. We also recommend management follow the formal policies in place which prescribe the process for performing periodic reviews of all user accounts, especially administrator accounts. We also recommend the Department update IT policies to reflect approved changes governing how IT security is administered.

SEI ? PAYROLL EXPENDITURES Finding Number: 2020-010 State Agency Number: EDU-01 CFDA Number and Title: 84.367 ? Supporting Effective Instruction State Grants Federal Award Identification Number / Year: S367A190034 / 2019 S367A180034 / 2018 Federal Agency: Department of Education Compliance Requirements: Activities Allowed or Unallowed/Allowable Costs Repeat Finding from Prior Audit? No QUESTIONED COSTS $16,877 2 C.F.R. Section 3474. 1 gives regulatory effect to the Department of Education for 2 C.F.R. Part 200, except for 2 C.F.R. Section 200.102(a) and 2 C.F.R. Section 200.207(a). 2 C.F.R. Section 200.403, establishes requirements over the allowability of costs and states, in part: Except where otherwise authorized by statute, costs must meet the following general criteria in order to be allowable under Federal awards: (a) Be necessary and reasonable for the performance of the Federal award and be allocable thereto under these principles. . . . In addition, 2 C.F.R. Section 200.430(a) states, in part: General. Compensation for personal services includes all remuneration, paid currently or accrued, for services of employees rendered during the period of performance under the Federal award, including but not necessarily limited to wages and salaries. Compensation for personal services may also include fringe benefits which are addressed in ?200.431. Costs of compensation are allowable to the extent that they satisfy the specific requirements of this part, and that the total compensation for individual employees: (1) Is reasonable for the services rendered and conforms to the established written policy of the non-Federal entity consistently applied to both Federal and non-Federal activities; . . . It is management?s responsibility to implement control policies and procedures to reasonably ensure compliance with program requirements. Effective controls require the Department ensure payments for payroll expenditures are allowable, based on complete and accurate employee timesheets, and made in accordance with program rules and regulations. During state fiscal year 2020, the Department expended $802,331 in payroll expenditures for the Supporting Effective Instruction State Grants (SEI) program. Employees in the Office of Educator Effectiveness administer various state level activities for the SEI program and are paid from the SEI program through fund 3Y60. Although the Department had controls over processing payroll, they did not prevent or detect an overpayment of payroll costs to the SEI program for one of 22 (4.5%) employee timesheets tested. In February 2020, the employee took another position within the Department that should have been and was paid from the General Revenue Fund (GRF). In April 2020, the Department made adjustments to realign expenditures between its administrative fund (3Z30) and 3Y60. During this process, the Department also included the employee who transferred to the other position, resulting in the employee?s payroll being incorrectly charged to the SEI program from April until at least the date of testing in January 2021. As a result, the employee was incorrectly paid $16,877 from the SEI program from April 2020 through June 2020 and we will question the entire overpayment (projects to an amount greater than $25,000). Without sufficient controls and monitoring over SEI program expenditures, management cannot be reasonably assured that payroll expenditures are necessary and reasonable for activities related to the program. This could result in a misuse of funds and noncompliance with federal requirements, which could subject the Department to sanctions, other penalties, or repayment of federal grant awards. Based on discussions with management and review of various documents, this issue was caused by the incorrect adjustment to the employee?s payroll coding in April 2020. We recommend the Department evaluate its current control procedures and processes over federal payroll expenditures and update them as necessary to reasonably ensure expenditures are necessary and reasonable for the performance of the federal award. These procedures should include a process for ensuring employees are being paid from the proper fund and/or federal program based on their roles and responsibilities, especially when they transfer positions within the Department. The Department should formally document and communicate these procedures to all employees involved in the process and update the procedures on a regular basis to address any necessary changes. In addition, management should periodically monitor these activities to help ensure the procedures are functioning as intended. Finally, we recommend the Department make adjustments to correct the improper payroll expenditures.

CHILD NUTRITION CLUSTER ? INVENTORY/FEDERAL SCHEDULE AND NOTE Finding Number: 2020-011 State Agency Number: EDU-02 CFDA Number and Title: 10.553/10.555/10.556/10.559 ? Child Nutrition Cluster Federal Award Identification Number / Year: 202020N109942 / 2020 201919N109942 / 2019 Federal Agency: Department of Agriculture Compliance Requirement: Special Tests and Provisions ? Accountability for USDA-Donated Foods Repeat Finding from Prior Audit? Yes Prior Audit Finding Number: 2019-011 NONCOMPLIANCE AND MATERIAL WEAKNESS 7 C.F.R. Part 250 contains rules and regulations for entities that receive donated foods from the United States Department of Agriculture (USDA) for use in child nutrition programs, including the National School Lunch Program (NSLP) which is part of the Child Nutrition Cluster (CNC). Specifically, 7 C.F.R. Section 250.19(a) requires that distributing agencies, recipient agencies, processors, and other entities must maintain accurate and complete records with respect to the receipt, distribution, and inventory of USDA-donated foods and warns that failure to maintain required records must be considered prima facie evidence of improper distribution or loss of donated foods and may result in a claim against such party for the loss or misuse of donated foods per 7 C.F.R. Section 250.16. In addition, 7 C.F.R. Section 250.15(a) requires the distributing agency ensure that donated foods that are out-of-condition, as defined in Section250.2, at any of its storage facilities are removed, destroyed, or otherwise disposed of, in accordance with FNS (Food and Nutrition Service) instruction and State or local food safety and health requirements. Furthermore, 2 C.F.R. Section 400.1 gives regulatory effect to the USDA for the Uniform Guidance contained in 2 C.F.R. Section 200. Specifically, 2 C.F.R. Section 200.510(b) requires the auditee (the State of Ohio) prepare a Schedule of Expenditures of Federal Awards (Schedule) for the period covered by the auditee's financial statements which must include the total federal awards expended. This includes the distributing agency reporting inventory and the distribution of donated foods to schools as required by 7 C.F.R. Section 250.18. It is management?s responsibility to implement control procedures to reasonably ensure compliance with these requirements. It is also management?s responsibility to implement an adequate system of internal controls to monitor the accuracy and completeness of accounting and inventory records pertaining to federal programs. Sound internal controls also require a review and verification of information and calculations used to compile an auditee?s Schedule and Notes to ensure they are complete and accurate, as well as documentation of the review in some manner. As the pass-through entity of the CNC federal program for the State of Ohio, the Department oversees the distribution of USDA-donated food goods to various local schools throughout the year. Local schools order food from two USDA web systems - Web Based Supply Chain Management (WBSCM) and Fresh Fruit and Vegetables Order Receipt System (FFAVORS). The food is distributed either directly from USDA to the school (FFAVORS orders) or first to a storage facility or processor before being delivered to the school (WBSCM orders). For the NSLP, the Department contracted with two storage facilities to house these foods during the fiscal year and also contracted with a company to perform physical inventory counts of the donated foods in the facilities in July 2019 and December 2020. The total value of all food distributed during state fiscal year (SFY) 2020 was $62.7 million dollars, while the value of the food distributed by the storage facilities was $9.2 million dollars; this is approximately 11.7 % and 1.9%, respectively, of the reported total CNC program expenditures. The Department receives data about the schools? food orders directly from WBSCM and FFAVORS and uploads the data into its Commodities Allocation Tracking System (CATS), an automated inventory process for administering and monitoring the foods donated by USDA. The Department?s procedures require it receive monthly activity reports from the storage facilities which are to be reconciled to CATS. However, the Department did not complete these reconciliations during the audit period due to a CATS issue that began in December 2017 and is still ongoing. Specifically, when school districts ordered food from storage facilities and the number of units shipped by the storage facility differed from the number of units ordered, the shipment was not recorded in CATS. Instead of performing a true reconciliation between CATS and the monthly reports, the Office of Integrated Student Supports made adjustments to CATS to reflect the ending inventory amounts on the monthly reports from the storage facilities. As a result, storage facility inventory in CATS as of June 30, 2020 was overstated by $14.4 million (3,135.9%) when compared to the physical inventory of foods on-hand at the facilities. In addition, storage facility distributions in CATS during the audit period were understated by $7.5 million (462.9%) when compared to the storage facility?s portion of food commodity distributions recorded on the State of Ohio?s Schedule of Expenditures of Federal Awards for SFY 2020. Although the USDA data on food orders reconciled with food orders in CATS, the ending inventory and distributions by the storage facilities did not. Based on the conditions noted above, it appears the CATS system is not operating as intended and the Department did not maintain accurate and complete inventory records during SFY 2020 as required by 7 C.F.R. Section 250.19(a). Also during SFY 2020, the Department approved 18 requests for disposal of out-of-condition commodities by the storage facilities. The Department's Donation and Disposal of USDA Foods Policy requires the Office for Child Nutrition obtain approval from the USDA Midwest Regional Office prior to donating or disposing of USDA foods. However, for four of the 18 (22.2%) requests, the Department did not obtain pre-approval for the disposal of the item. The Department instructed the storage facilities to dispose of the food commodities on April 13 and April 20, 2020, but did not obtain verbal approval from the USDA Midwest Regional Office until May 6, 2020. Furthermore, during SFY 2020, the Ohio Office of Budget and Management (OBM) which compiles and prepares the State of Ohio?s Schedule, provided State agencies that received federal funds a reporting package containing a template of the Schedule and its attachments, as well as detailed instructions for completing the reporting package and making adjustments to the award amounts. The Department?s reporting package also included a form and instructions for providing information about donated food commodities from the NSLP, for inclusion in the Schedule?s Note 2, Non-Cash Federal Assistance Programs. To provide the information for Note 2, the Department utilized reports from the warehouse, its pre-processors, and the USDA WBSCM and FFAVORS systems. Management reviewed the Department?s reporting package for accuracy and approved it before submitting it to OBM; however, the Department did not properly calculate or verify the accuracy of the Ending Inventory amount. As a result, the Department reported to OBM $4,760,162 in the food commodities ending inventory for the NSLP although the actual value was $28,215,151, or an understatement of $23,454,989 (83.1%). Once this error was brought to OBM's attention, the State of Ohio's Schedule and Note 2 were adjusted prior to submission to the Federal government. If the Department does not maintain accurate and complete records of the donated foods and obtain pre-approval for disposals of food commodities, it is not complying with 7 C.F.R. Sections 250.19(a) and 250.15(a). This could subject the Department to repayment for the value of any misplaced food to the USDA or replacement of the goods in-kind, or other sanctions and penalties. Inaccurate inventory records could also prevent schools from placing orders for available foods and lead to misuse or abuse of donated foods to the detriment of those who benefit from the program. It could also affect schools who use and rely on CATS for reporting purposes. By not accurately identifying and reporting the ending inventory value of food commodities, there is an increased risk that program activity and the State of Ohio?s Schedule and footnotes may be materially misstated. This could lead to users of the Schedule and footnotes making decisions based on inaccurate program activity or information. Based on discussion with management and review of support documents, the Department added a new File Transfer Protocol site that caused problems with importing the monthly activity delivery reports from the storage facilities, and did not have the resources to maintain accurate and complete inventory records after the CATS system failure and the disposal of food commodities without prior approval was due to oversight. In addition, the understatement of ending inventory was due to a change in the compilation approach from the previous year, which led to an improper calculation of the amount. We recommend the Department evaluate and strengthen its existing policies, procedures, and CATS system to ensure it updates and maintains complete and accurate inventory records, to ensure all requests for disposal of food commodities are pre-approved by the USDA Midwest Regional Office, and also to ensure the accuracy and completeness of the food commodity ending inventory reported to OBM for inclusion in the Notes to the State of Ohio?s Schedule. Management should periodically perform and review inventory reconciliations to ensure accuracy, completeness, and proper and timely resolution of variances or reconciling items noted. In addition, management should review and monitor the compilation of information submitted to OBM to ensure it is complete and accurate. The Department should formally document and communicate these policies and procedures to all employees involved in the process and re-evaluate and update the procedures on a regular basis to address any necessary changes.

CACFP ? REPORTING Finding Number: 2020-012 State Agency Number: EDU-03 CFDA Number and Title: 10.558 ? Child and Adult Care Food Program Federal Award Identification Number / Year: 202020N109942 / 2020 201919N109942 / 2019 Federal Agency: Department of Agriculture Compliance Requirement: Reporting Repeat Finding from Prior Audit? Yes Prior Audit Finding Number: 2019-012 NONCOMPLIANCE AND MATERIAL WEAKNESS As part of administering the Child and Adult Care Food Program (CACFP), 7 C.F.R. Section 226.7(d) requires a final FNS-44, Report of the Child and Adult Care Food Program, report be submitted for each month ?no later than 90 days following the last day of the month covered by the report.? In addition to this ?90-day report?, which contains actual data only, instructions to the report state a "30-day report", which may contain actual and estimated data, is due ?on the last day of the month following the month being reported.? Report instructions also define "Estimated" as ?Projection of the number of meals that were served and are expected to be approved for reimbursement for which claims have not been received or approved by the reporting due date.? In addition, Parts A - Day Care Homes (reported monthly) and B - Participation (reported quarterly) of the report instructions state "Estimates for missing data should be included on the 30-Day report." It is management?s responsibility to implement control policies and procedures to reasonably ensure compliance with program requirements. Effective controls require management review reports for accuracy, completeness, and compliance with program rules and regulations prior to submission to the federal grantor agency. During state fiscal year 2020, the Department disbursed approximately $89.3 million in subsidy expenditures for CACFP. The Department had controls in place during the fiscal year for reviewing and submitting the required reports. When preparing reports for submission to the U. S. Department of Agriculture via the Food Program Reporting System (FPRS), the Management Analyst generates the support documents in the Claims Reimbursement and Reporting System (CRRS), which aggregates estimated and actual reporting data, including meals served and number of sponsors and sites. The Management Analyst enters the data into FPRS and checks it for validity. The Fiscal Manager then reviews the data to ensure its accuracy and completeness before certifying the report in FPRS. However, for five of 12 (41.7%) 30-day FNS-44 reports submitted during the audit period (including the months June 2019 through October 2019), the Department included only actual data and did not also include projections/estimates for the number of participating entities and recipients in the Day Care Homes (Part A) and Participation (Part B) sections. The November 2019 through May 2020 30-day FNS-44 reports, which were submitted during the audit period, appropriately included both actual data and projections/estimates in Parts A and B. Without including estimated data for Parts A and B of the 30-day FNS-44 reports, the Department is not submitting accurate and complete reports to the federal grantor agency per the instructions provided. Providing incomplete information to the federal grantor agency on interim reports makes them less effective for the federal grantor agency for monitoring and planning purposes. Any noncompliance could result in repayment, reduction, or elimination of federal funding or sanctions imposed by the federal grantor agency. Based on discussions with management and review of supporting documentation, it appears the Department interpreted the report instructions to mean that if any sponsor does not submit the data by the report due date, the state-wide data available in CRRS is incomplete (not missing) and therefore, not required to be included in the report. It also appears the Department?s approach for not including estimates in Parts A and B of the report has been in place for several years although the federal grantor agency has not provided guidance that it is acceptable. Management changed their approach once the auditor brought this to their attention during the prior audit. We recommend the Department evaluate existing procedures and implement new procedures, if necessary, to provide reasonable assurance the 30-day FNS-44 reports submitted in FPRS are accurate and complete per the report instructions. In addition, we recommend the Department establish procedures to periodically monitor its compliance with the report submission requirements and initiate necessary actions to resolve any noncompliance that results.

CACFP ? SPONSOR REVIEWS Finding Number: 2020-013 State Agency Number: EDU-04 CFDA Number and Title: 10.558 ? Child and Adult Care Food Program Federal Award Identification Number / Year: 202020N109942 / 2020 201919N109942 / 2019 Federal Agency: Department of Agriculture Compliance Requirement: Subrecipient Monitoring Repeat Finding from Prior Audit? Yes Prior Audit Finding Number: 2019-013 NONCOMPLIANCE AND MATERIAL WEAKNESS As part of administering the Child and Adult Care Food Program (CACFP), 7 C.F.R. Section 226.6 requires the Department provide technical and supervisory assistance to institutions and facilities to facilitate effective program operations; monitor progress toward achieving program goals; ensure compliance with all requirements of the program; and maintain documentation of supervisory assistance activities, including reviews conducted, corrective actions prescribed, and follow-up efforts. Specifically, 7 C.F.R. Section 226.6(m)(6) prescribes the frequency and number of required institution reviews and states, in part: (i) Independent centers and sponsoring organizations of 1 to 100 facilities must be reviewed at least once every three years. A review of such a sponsoring organization must include reviews of 10 percent of the sponsoring organization?s facilities; In addition, 7 C.F.R. Section 226.14 states, in part: (a) State agencies shall disallow any portion of a claim for reimbursement and recover any payment to an institution not properly payable under this part. . . . Minimum State agency collection procedures for unearned payments shall include: (1) Written demand to the institution for the return of improper payments; (2) if, after 30 calendar days, the institution fails to remit full payment or agree to a satisfactory repayment schedule, a second written demand for the return of improper payments sent by certified mail return receipt requested; and (3) if, after 60 calendar days, the institution fails to remit full payment or agree to a satisfactory repayment schedule, the State agency shall refer the claim against the institution to appropriate State or Federal authorities for pursuit of legal remedies. It is management?s responsibility to implement control policies and procedures to reasonably ensure compliance with program requirements. Effective controls require the Department monitor the frequency of each sponsor?s reviews to ensure they are completed in accordance with program rules and regulations and perform proper collection procedures for unearned payments. During state fiscal year (SFY) 2020, the Department completed reviews of 258 sponsors that participated in CACFP. Education Program Specialists (EPS) are responsible for visiting these institutions, performing the required reviews, and completing various documents within the Claims Reimbursement Reporting System (CRRS) to evidence what they reviewed and the results. In addition, the Department maintains a CRRS tracking module that lists all participants of the program and when they were reviewed or are scheduled for review. However, the Department?s controls did not prevent noncompliance with the review requirements. As a result, for three of 25 (12%) reviews selected for testing (all sponsors with between 1 and 100 facilities), the Department performed the reviews four years after the previous review, which is not within the required three-year period. In addition, 206 of the 258 reviews completed by the Department included required corrective actions. For reviews where the EPS identifies overpayments of program funds, Financial Associate sends a fiscal action letter to the sponsor, giving the sponsor the option to appeal the decision or repay the identified amount. However, for one of 21 (4.8%) reviews with required corrective actions tested, the Department did not send a fiscal action letter seeking repayment. As a result, the Department has not yet collected $5,803 of program benefit overpayments from the sponsor. Not properly monitoring sponsor reviews and performing proper collection procedures could result in noncompliance with federal regulations. Noncompliance with the review requirements could subject the Department to sanctions or other penalties and a repayment of part of the grant award amount. Based on discussions with management and review of support documents, the reviews were not completed timely due to staffing issues. The fiscal action letter was not sent due to a lack of communication between the EPS completing the review and the Financial Associate responsible for sending the letter. We recommend the Department evaluate its existing sponsor review control procedures and update them as necessary to reasonably ensure all reviews are performed within the timeframes prescribed in 7 C.F.R Section 226.6(m)(6) and any unearned payments identified during reviews are collected as prescribed by 7 C.F.R. Section 226.14. We also recommend the Department establish procedures to periodically monitor its compliance with the review requirements and initiate necessary actions to resolve any noncompliance that results. Finally, we recommend the Department follow up on the corrective action noted above and obtain repayment from the sponsor, if appropriate.

CHARTER SCHOOL MONITORING ? VARIOUS PROGRAMS Finding Number: 2020-014 State Agency Number: EDU-05 CFDA Number and Title: 84.010 ? Title I Grants to Local Educational Agencies 84.027 / 84.173 ? Special Education Cluster (IDEA) 84.367 ? Supporting Effective Instruction State Grants Federal Award Identification Number / Year: S010A190035 / 2019 (Title I) S010A180035 / 2018 (Title I) H027A190111 / 2019 (IDEA) H027A180111 / 2018 (IDEA) H173A190119 / 2019 (IDEA) H173A180119 / 2018 (IDEA) S367A190034 / 2019 (SEI) S367A180034 / 2018 (SEI) Federal Agency: Department of Education Compliance Requirement: Special Tests and Provisions - Oversight and Monitoring Responsibilities with Respect to Charter Schools with relationships with Charter Management Organizations Repeat Finding from Prior Audit? Yes Prior Audit Finding Number: 2019-014 NONCOMPLIANCE AND MATERIAL WEAKNESS 2 C.F.R. Section 3474.1 gives regulatory effect to the Department of Education for 2 C.F.R. Section 200.331 (in the January 1, 2020 edition and 2 C.F.R. Section 200.332 in the January 1, 2021 edition), which establishes requirements over subawards for pass-through entities and states, in part: All pass-through entities must: . . . (b) Evaluate each subrecipient's risk of noncompliance with Federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate subrecipient monitoring described in paragraphs (d) and (e) of this section, . . . . . . (d) Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. . . . Additionally, Part N.3, Oversight and Monitoring Responsibilities with Respect to Charter Schools with Relationships with Charter Management Organizations [CMOs], of the ED-Cross-Cutting Section (2020 OMB Compliance Supplement) states: Additional requirements applicable to non-federal entities receiving federal funds include: (1) the Code of Federal Regulations (CFR) requirements regarding conflicts of interest [2 C.F.R. Sections 200.112 and 200.318], (2) the American Institute of Certified Public Accountants guidance regarding related-party transactions [AU Section 334], and (3) the GAO Green Book and COSO framework guidance regarding segregation of duties [Page 50] applicable to charter schools with relationships with CMOs. It is management?s responsibility to implement control policies and procedures to reasonably ensure compliance with program requirements. Effective controls require the Department complete a review of charter (community) schools with relationships with CMOs, including procedures to assess the risk posed by conflicts of interest, related party transactions, and insufficient segregation of duties. During state fiscal year (SFY) 2020, the Department had agreements with 1,021 local educational agencies (LEAs), including 232 community schools with CMOs. The Department completed 919 reviews of the LEAs for the Title I Grants to Local Educational Agencies and Supporting Effective Instruction State Grants programs and 987 reviews for the Special Education Cluster during SFY 2020. The Department uses a three-tiered (Self Survey, Desk Review, and On-site Review) risk assessment approach to monitor and assist LEAs in determining whether they are compliant with program requirements. However, monitoring by the program divisions did not include procedures to assess the risk posed by conflicts of interest, related party transactions, and insufficient segregation of duties for community schools with relationships with CMOs as required by the federal grantor agency, although the Grants Management office did complete additional monitoring over 21 of the LEA?s that included procedures over conflicts of interest. Furthermore, the Department did not have effective internal controls designed to provide reasonable assurance that community schools with relationships with CMOs have effective controls to mitigate financial risks, provide for accountability over federal funds, and mitigate performance risks. Without proper controls and monitoring over community schools with CMOs, management is not complying with the federal grantor agency?s requirements for these programs and cannot be reasonably assured that the community schools have effective controls to mitigate financial risks, provide for accountability over federal funds, and mitigate performance risks. This could result in a misuse of funds and noncompliance with federal requirements, which could subject the Department to sanctions, other penalties, or having to repay part of the federal grant awards. Based on discussions with management and review of various documents, this issue was caused by the amount of time needed to develop and implement new risk assessment procedures, which the Department is currently developing. We recommend the Department evaluate its current control procedures and processes over subrecipient monitoring and update them as necessary to include specific procedures for community schools with CMOs. These procedures should include an assessment of the risk posed by conflicts of interest, related party transactions, and insufficient segregation of duties. The Department should also monitor these community schools to ensure controls are in place to mitigate financial risks, provide for accountability over federal funds, and mitigate performance risks, as well as track the correction of any identified non-compliance that results. In addition, management should periodically monitor these activities to help ensure the procedures are performed timely and functioning as intended.

TANF ? UNSUPPORTED WORK PARTICIPATION ACTIVITIES Finding Number: 2020-015 State Agency Number: JFS-03 CFDA Number and Title: 93.558 ? Temporary Assistance for Needy Families (TANF) Federal Award Identification Number / Year: 1402OHTANF / 2014 1502OHTANF / 2015 1601OHTANF / 2016 Federal Agency: Department of Health and Human Services Compliance Requirements: Activities Allowed/Unallowed; Eligibility Repeat Finding from Prior Audit? No QUESTIONED COSTS Undetermined Amount 45 C.F.R. Section 75.403 establishes uniform requirements for allowability of costs for Federal awards provided by the Department of Health and Human Services, including TANF, and states, in part: ? Except where otherwise authorized by statute, costs must meet the following general criteria in order to be allowable under Federal awards: (a) Be necessary and reasonable for the performance of the Federal award and be allocable thereto under these principles. . . (c) Be consistent with policies and procedures that apply uniformly to both federally-financed and other activities of the non-Federal entity. . . (g) Be adequately documented. . . ?45 C.F.R. Section 260.31(a) defines the term ?assistance?, and states, in part: ? (2) It includes such benefits even when they are: (i) Provided in the form of payments by a TANF agency, or other agency on its behalf, to individual recipients; and (ii) Conditioned on participation in work experience or community service (or any other work activity under ??261.30 of this chapter). ? As the lead agency responsible for administering the TANF federal grant award for the State of Ohio, the Department is responsible for providing reasonable assurance that only eligible individuals receive assistance and that documentation maintained is accurate, complete, and properly recorded in the statewide automated eligibility system to ensure appropriate eligibility determinations. The Department is responsible for overall program compliance and must have appropriate oversight and monitoring procedures in place to ensure those they rely on are operating in accordance with all expectations, guidelines, and requirements related to their tasks. As outlined in the State of Ohio Work Verification Plan, the Department establishes program policy, provides technical assistance, defines performance standards, requires continuous improvement activities, collects data and monitors all County Departments of Job and Family Services (CDJFS). Applications, reapplications, and assignment of work activities are processed by the CDJFS. Work participation data is reported by work sites to the CDJFS who then enters the data into the automated eligibility system. The automated eligibility system requires the CDJFS to track weekly hours of participation per activity for each work-eligible individual. Each month work activity data is extracted from the statewide automated eligibility system. It is run through a series of extract programs and the resulting data becomes the statewide work participation reports (which are shared with the CDJFS) and the TANF Data Report file which is sent to the federal grantor agency. However, during an investigation to follow up on a complaint related to the South Central Ohio DJFS for the period September 2014 through September 2015, it was determined that a caseworker entered work participation activities, but there was not appropriate supporting documentation for these activities. Because these activities could not be quantified, we will question costs for an undetermined amount. This amount would likely exceed the $25,000 questioned costs reporting threshold. Additionally, during an investigation to follow up on a complaint related to the Franklin CDJFS for the period December 2014 through February 2016, it was determined a caseworker was entering work participation activities but there was not appropriate documentation for these activities. It was also noted there was no record of the recipients having completed these hours in the CDJFS external third party system nor in the CDJFS case file or notes to provide verification for these hours. Because these activities could not be quantified, we will question costs for an undetermined amount. This amount would likely exceed the $25,000 questioned costs reporting threshold. See finding number 2020-028, TANF ? Work Participation Reviews, which starts on page ## and details a control weakness for the Department?s lack of monitoring of work participation hours non-sanctioned case reviews for the TANF program. Without monitoring procedures in place to ensure the CDJFS are meeting the TANF program requirements, there is an increased risk that benefits paid to or on behalf of recipients will be inaccurate or unallowable. This could result in fines, penalties, or repayment of funds to the federal grantor agency. In addition, without ensuring the CDJFS are accurately documenting and maintaining work participation activities, there is an increased risk the work participation rate is not accurate as reported to the federal grantor agency, thereby impacting the State?s reporting of this performance measurement. Based on discussions with management, the CDJFS is responsible for entering, verifying, and ensuring the accuracy of the information placed in the automated eligibility system. In addition, the current monitoring procedures in place by the Department provide them confidence in meeting the TANF program requirements. We recommend the Department work with the counties to reinforce and strengthen existing control policies and procedures to reasonably ensure supporting documentation is obtained and maintained and agrees with the information input into the statewide automated eligibility system. These procedures must include periodic and timely reviews by the appropriate supervisory personnel (through the statewide automated eligibility system) to monitor the compliance of these recipients. Such requirements should be explicitly identified in the subgrant agreements with the counties and include appropriate ramifications for noncompliance with the stated requirements. We also recommend the Department, as the pass-through entity, implement stronger monitoring controls over the activities of its county subrecipients to determine if they are following the established controls and are complying with the work participation and verification requirements. Furthermore, we recommend the Department implement more in-depth training for county case workers to ensure proper verification documentation is obtained and maintained by the counties. Finally, we recommend the Department determine the impact on prior reports submitted to the federal grantor agency which may include inaccurate work participation rates.

UNEMPLOYMENT INSURANCE (UI) ? PANDEMIC UNEMPLOYMENT ASSISTANCE (PUA) Finding Number: 2020-016 State Agency Number: JFS-04 CFDA Number and Title: 17.225 ? Unemployment Insurance Federal Award Identification Number/Year: UI-32619-19-55-A-39 / 2019 UI-34070-20-55-A-39 / 2020 UI-34078-20-55-A-39 / 2020 Federal Agency: Department of Labor Compliance Requirements: Activities Allowed or Unallowed, Allowable Costs/Cost Principles, and Eligibility Repeat Finding from Prior Audit? No QUESTIONED COSTS AND MATERIAL WEAKNESS $10,329 15 U.S.C. Section 9021 pertaining to Pandemic Unemployment Assistance, states, in part: (a) Definitions (3) Covered Individual The term ?covered individual? ? (A) means an individual who ? (i) is not eligible for regular compensation or extended benefits under State or Federal law or pandemic emergency unemployment compensation under section 9025 of this title, including an individual who has exhausted all rights to regular unemployment or extended benefits under State or Federal law or pandemic emergency unemployment compensation under section 9025 of this title; ? . . . (c) Applicability (1) In general Except as provided in paragraph (2), the assistance authorized under subsection (b) shall be available to a covered individual? (A) for weeks of unemployment, partial unemployment, or inability to work caused by COVID?19 ? (i) beginning on or after January 27, 2020; and (ii) ending on or before December 31, 2020; and (B) subject to subparagraph (A)(ii), as long as the covered individual?s unemployment, partial unemployment, or inability to work caused by COVID?19 continues. . . . (d) Amount of Assistance . . . (A) (i) the weekly benefit amount authorized under the unemployment compensation law of the State where the covered individual was employed, except that the amount may not be less than the minimum weekly benefit amount described in section 625.6 of title 20, Code of Federal Regulations, or any successor thereto; and (ii) ending on or before December 31, 2020; and (ii) the amount of Federal Pandemic Unemployment Compensation [FPUC] under section 9023 of this title; ? . . . (h) Relationship between pandemic unemployment assistance and disaster unemployment assistance [DUA] Except otherwise provided in this section or to the extent there is a conflict between this section and section?625 of title 20, Code of Federal Regulations, such section?625 shall apply to this section as if: (1) the term ?COVID?19 public health emergency? were substituted for the term ?major disaster? each place it appears in such section?625; and (2) the term ?pandemic? were substituted for the term ?disaster? each place it appears in such section? 625. . . . 20 C.F.R. Section 625.6, pertaining to the weekly amount states, in part: . . . (e) . . . An immediate determination of a weekly amount shall also be made where, in conjunction with the filing of an initial application for DUA, the individual submits documentation substantiating employment or self-employment and wages earned or paid for such employment or self-employment, or, in the absence of documentation, where any State agency records of employment or self-employment and wages earned or paid for such employment or self-employment, justify the determination of a weekly amount. . . . (1) In the case of a weekly amount determined in accordance with paragraph (e) of this section, based only on the individual's statement of earnings, the individual shall furnish documentation to substantiate the employment or self-employment or wages earned from or paid for such employment or self-employment or documentation to support that the individual was to commence employment or self-employment on or after the date the major disaster began. In either case, documentation shall be submitted within 21 calendar days of the filing of the initial application for DUA. (2) Any individual who fails to submit documentation to substantiate employment or self-employment or the planned commencement of employment or self-employment in accordance with paragraph (e)(1) of this section, shall be determined ineligible for the payment of DUA for any week of unemployment due to the disaster. Any weeks for which DUA was already paid on the application prior to the date of the determination of ineligibility under this paragraph (e)(2) are overpaid and a determination shall be issued in accordance with ? 625.14(a). In addition, the State agency shall consider whether the individual is subject to a disqualification for fraud in accordance with the provisions set forth in ? 625.14(i). . . . It is management?s responsibility to implement controls, processes, and procedures to provide reasonable assurance over the reliability of financial reporting, effectiveness and efficiency of operations, and compliance with these regulations. When automated systems are utilized to perform certain functions related to this compliance, management must ensure the systems are properly designed and operating effectively. Additionally, when the system is not directly administered by the entity, such as when utilizing a service organization, it is critical the appropriate monitoring controls are designed and implemented to reasonably ensure the service organization has adequate controls to achieve management?s goals and objectives and complies with applicable laws and regulations. Attestation standard (AT-C 320) Reporting on an Examination of Controls at a Service Organization Relevant to User Entities? Internal Control Over Financial Reporting, prescribes standards for reporting on service organizations. During state fiscal year 2020, the Department disbursed more than $9.7 billion in unemployment benefits, which were recorded in the Unemployment Compensation opinion unit in the State of Ohio?s financial statements. Approximately $3 billion of the total disbursed related to PUA and FPUC benefit payments issued from May 14, 2020 through June 30, 2020, through the Unemployment Framework for Automated Claim & Tax Services (uFACTS) system. The Department contracted with a service organization to utilize the uFACTS system and maintain key functions of the benefit claims processing, which were customized to fit Ohio?s needs. This service organization contracted with a subservice organization to provide cloud services. The service organization provided a Report on Management?s Description of a Service Organization?s System and a Service Auditor?s Report on that Description and on the Suitability of the Design and Operating Effectiveness of Controls (SOC1 Type 2) specific to the cloud based security and data managed by a subservice organization, as required by the service organization?s contract with the subservice organization. However, this report was not provided to the Department until after the auditors inquired as to whether a SOC1 Type 2 report was obtained for the service organization/uFACTS system. Furthermore, the Department did not establish procedures to determine whether the service organization had sufficient controls in place and operating effectively, or obtain a SOC1 Type 2 report in accordance with AT-C 320 specific to the uFACTS system design and implementation, or to verify the service organization had implemented the complimentary user entity controls required by the subservice organization, to ensure pandemic unemployment benefits were paid to eligible claimants and processed completely and accurately. Additionally, the Department provided us with documentation that allowed us to complete general controls testing related to its procurement and implementation of the uFACTS system as well as certain application controls related to the uFACTS system functionality. Application control testing was performed in a test environment subsequent to the end of the fiscal year. Test environment functionality at the time of testing may not mirror production environment functionality during the fiscal year due to the time that had elapsed and potential changes to the system. The Department was unable to provide sufficient documentation to allow us to perform audit procedures over its general controls for security, program change management, and IT operations. Claimants were to submit a PUA application within uFACTS and complete the identity verification, COVID-19 attestation, and enter any relevant wage verification information. Upon initial submission, claimant eligibility was verified within the Ohio Job Insurance (OJI) system used to process regular unemployment benefit payments. If the claimant was not receiving regular unemployment, extended benefits, or pandemic emergency unemployment compensation within OJI and met the remaining PUA program requirements, PUA benefit payments were approved and paid based on the wage information entered by the claimant (or the minimum weekly benefit amount of $189 if no wages entered) in uFACTS. Claimants eligible for PUA benefits were automatically eligible for an additional $600 in weekly FPUC benefits, which were paid with the PUA benefits. Weekly, the claimant confirmed their unemployment status and completed the COVID-19 self-attestation questionnaire within uFACTS. If additional review was required, an issue was flagged on the claim within the uFACTS queue module and routed to an adjudicator for further fact finding for either monetary or nonmonetary issues. The claimant continued to receive weekly benefit payments until the adjudicator completed the issue and confirmed the claimant was ineligible. If fraud was suspected during fact finding, the adjudicator assigned the issue to the Benefit Payment Control (BPC) unit for further investigation. BPC performed fact finding to determine if the benefit payment was fraudulent and/or created the overpayment within uFACTS. However, these control procedures did not detect or prevent payments to ineligible claimants resulting in questioned costs totaling $10,329 (projects to an amount greater than $25,000), as detailed below. ? For four of 60 (6.7%) benefit payments selected for testing, the claimant was not eligible to receive benefits (in part or in total) for the weeks claimed. For three benefit payments, the weekly benefit amount was corrected once additional wage documentation was submitted, resulting in a partial overpayment. For one benefit payment, the adjudicator voided the issue; however, the claimant was not unemployed due to a COVID-19 issue, resulting in complete overpayment. As a result, we will question all ineligible benefits paid to these claimants during the audit period, totaling $2,379. ? Claimants with benefit payments in OJI and uFACTS totaled $780,179. For 15 of 15 (100%), benefit payments selected for testing that were included within OJI and uFACTS, the claimant improperly received PUA/FPUC benefits because they were eligible for and received regular unemployment benefits, thus making them ineligible for PUA/FPUC benefits. As a result, we will question all PUA/FPUC benefits paid to these claimants, totaling $7,950. Without adequate monitoring controls, management cannot be reasonably assured the service organization is complying with applicable laws and regulations and contract requirements, as well as meeting management?s goals and objectives. Additionally, without maintenance of documentation and procedures over the PUA eligibility system, there is an increased risk benefit payments will be inaccurate or unallowable. The risk is increased if the system contains significant flaws or eligibility redeterminations are not made timely or accurately. Overpayments to ineligible claimants may subject the Department to penalties or sanctions which may jeopardize future funding and limit its ability to fulfill program requirements to provide benefits to those in need. Based on discussions with management, these errors and system issues were due to the significant workload increase because of the impact the pandemic had on the program. We recommend the Department strengthen current internal control procedures over the UI program and the uFACTS system which should include, but not be limited to: ? Amending the contract with the service organization to require an annual SOC 1 audit or similar independently performed procedures to ensure the service organization has control procedures in place and operating effectively and that any Ohio-specific requirements are operating as intended. ? Requiring appropriate Department management perform a timely review of the SOC 1 report and other procedures to identify any weaknesses, issues, or required complimentary user entity controls (CUECs), and ensuring the Department implement sufficient controls to address these items. ? Implementing appropriate control procedures to monitor service organization activities to ensure benefits are processed accurately and are paid to eligible claimants. This includes maintaining documentation in an orderly fashion to be provided to external parties for additional review. ? Implementing monitoring procedures to coordinate and track any system changes or issues submitted to the service organization. Specifically, the Department should perform procedures to identify and correct system errors to prevent duplicate benefit payments within the uFACTS and OJI systems. ? Requiring management continually monitor these procedures of both the service organization and Department to ensure the compliance requirements of the program management?s objectives are being met. If not, management should implement additional procedures or revise the requirements of the service organization contract agreement or Department policies and procedures, as necessary. Management should periodically monitor and update internal procedures to ensure management?s objectives are being met. In addition, management should evaluate and seek reimbursement or offset future benefits for all benefits that were paid to ineligible claimants. See Finding 2020-002, UNEMPLOYMENT INSURANCE (UI) ? PANDEMIC UNEMPLOYMENT ASSISTANCE (PUA), which is summarized in section 2 above on page ##. Government Auditing Standards also requires us to report the material weakness portion of this finding in Section 2 of this Schedule.

UNEMPLOYMENT INSURANCE (UI) ? BENEFIT YEAR END OVERPAYMENTS Finding Number: 2020-017 State Agency Number: JFS-05 CFDA Number and Title: 17.225 ? Unemployment Insurance Federal Award Identification Number/Year: UI-32619-19-55-A-39 / 2019 UI-34070-20-55-A-39 / 2020 UI-34078-20-55-A-39 / 2020 Federal Agency: Department of Labor Compliance Requirements: Activities Allowed or Unallowed, Allowable Costs/Cost Principles, Eligibility Repeat Finding from Prior Audit? No QUESTIONED COSTS $2,574 2 C.F.R. Section 2900.4 gives regulatory effect to the Department of Labor (DOL) for 2 C.F.R. Section 200.53 (in the January 1, 2020 edition and 2 C.F.R. Section 200.1 in the August 13, 2020 edition) which states, in part: (a) Improper payment means any payment that should not have been made or that was made in an incorrect amount (including overpayments and underpayments) under statutory, contractual, administrative, or other legally applicable requirements; ... Additionally, the Ohio Revised Code (ORC) explains only claims for benefits filed regarding weeks within the benefit year may be allowed. Specifically, ORC Section 4141.01(R)(1) states, in part: "Benefit year" with respect to an individual means the fifty-two week period beginning with the first day of that week with respect to which the individual first files a valid application for determination of benefit rights, and thereafter the fifty-two week period beginning with the first day of that week with respect to which the individual next files a valid application for determination of benefit rights after the termination of the individual's last preceding benefit year. . . . . . The "benefit year" of a combined wage claim, as described in division (H) of section 4141.43 of the Revised Code, shall be the benefit year prescribed by the law of the state in which the claim is allowed. It is management?s responsibility to implement controls, processes, and procedures to provide reasonable assurance over the effectiveness and efficiency of operations, and compliance with these regulations. When automated systems are utilized to perform certain functions related to this compliance, management must ensure the systems are properly designed and operating effectively. During state fiscal year 2020, the Department disbursed more than $9.7 billion in regular and pandemic unemployment benefits, with approximately $6.7 billion in regular unemployment payments processed through the Ohio Job Insurance (OJI) benefit system. The OJI system includes automated controls to ensure benefits are not paid in excess of the maximum allowable amount or outside of the benefit year end (BYE). Additionally, the Department performs a daily review to identify any potential improper warrants with a week ending date greater than thirty days past the BYE date. This includes warrants with a week ending date prior to the current claim date and any warrant with a week ending date sixty days prior to the issuance date. A query is run daily and the results are exported to Excel to be filtered and for the creation of the Potential Improper Issuance spreadsheet. However, the potential improper warrants identified from the query were not investigated for May or June. Additionally, seven of 25 (28%) benefit payments selected for testing, were made past the BYE. As a result, we will question these payments, totaling $2,574 (projected to an amount greater than $25,000). The days past the BYE ranged from 41 to 6,690 days, with an average of 1,997 days. Once these errors were brought to management?s attention, an adjustment was made in the OJI system to recoup the overpayment. Without adequate monitoring controls, there is an increased risk inaccurate benefit payments could go undetected or that program objectives may not be achieved. By paying benefits to claimants outside of the BYE, inaccurate eligibility determinations could be made or recipient benefit payment amounts may be miscalculated. This could result in additional improper payments, questioned costs, or sanctions imposed by the federal grantor agency. Based on discussions with management, these errors were due to the significant workload increase because of the impact the COVID-19 pandemic had on the program. Additionally, the timing of the workload increase limited management?s ability to perform existing monitoring procedures during May and June. We recommend the Department review existing controls and/or update policies and procedures to ensure unemployment benefit payments are in accordance with applicable laws and regulations. Specifically, we recommend the Department implement appropriate control procedures to monitor activities and potential improper payments to ensure benefits are processed accurately and are paid to eligible claimants within the applicable BYE. Additionally, we recommend management continually monitor these procedures to ensure compliance with program requirements and that management?s objectives are being met. If not, management should implement additional procedures or revise the Department policies and procedures, as necessary.

CCDF CLUSTER ? PANDEMIC PROVIDER PAYMENTS Finding Number: 2020-018 State Agency Number: JFS-06 CFDA Number and Title: 93.575/93.596 ? CCDF Cluster Federal Award Identification Number / Year: 1901OHCCDF / 2019 2001OHCCDF / 2020 2001OHCCC3 / 2020 (CARES) Federal Agency: Department of Health and Human Services Compliance Requirement: Activities Allowed or Unallowed/ Allowable Costs/Cost Principles Repeat Finding from Prior Audit? No QUESTIONED COSTS $658 45 C.F.R. Section 75.403, pertaining to factors affecting allowability of costs for federal awards provided by the Department of Health and Human Services, including the Child Care Development Fund (CCDF) Cluster, states in part: ? Except where otherwise authorized by statute, costs must meet the following general criteria in order to be allowable under Federal awards: (a) Be necessary and reasonable for the performance of the Federal award and be allocable thereto under these principles. . . (c) Be consistent with policies and procedures that apply uniformly to both federally-financed and other activities of the non-Federal entity. . . (g) Be adequately documented. 45 C.F.R. Section 75.2 states, in part: . . . Improper payment: (1) Means any payment that should not have been made or that was made in an incorrect amount (including overpayments and underpayments) under statutory, contractual, administrative, or other legally applicable requirements; . . . It is management?s responsibility to design and implement internal controls to reasonably ensure compliance with federal and state laws and regulations. During state fiscal year (SFY) 2020, the Department disbursed approximately $166.5 million in pandemic and emergency assistance payments to eligible child care providers from the CCDF Cluster. Beginning March 26, 2020 through May 31, 2020, all child care programs were closed due to the COVID-19 pandemic. Only those programs issued a temporary pandemic child care license were permitted to operate during this period of time. Temporary Pandemic Child Care Programs that were previously licensed/certified child care programs received both closure payments and pandemic child care payments for children determined eligible for publicly funded child care (PFCC). Temporary Pandemic Programs were issued weekly PFCC Pandemic payments, as outlined in the temporary pandemic provider license agreement, which were based on the 5-state rates for the providers? county and the number and ages of enrolled children whose parents were providing health, safety, or essential services and determined eligible for PFCC. In order to receive pandemic child care payments, providers use the spreadsheet template provided by the Department and submit enrollment forms and verification of the parents? employment as providing health, safety, or essential services. Upon receipt of the request for a pandemic payment, Department personnel review the spreadsheet, enrollment forms, and any other supporting documentation and manually perform the payment calculation. A closure payment was also remitted to all licensed programs who were previously licensed/certified child care programs prior to the emergency declaration. All providers were paid a weekly flat payment based on the services provided the week of January 26 through February 1, 2020 (or service week as determined by the Department) for PFCC providers operating that week. The first closure payment was manually calculated by the Department based on the enrollment paid for the service week and then the child care program was paid that same payment amount each week. However, no review or approval of the manual calculation was performed by Department personnel for accuracy prior to entering the calculated pandemic child care or closure payment amounts into the Time, Attendance, and Payment (TAP) system for processing. As a result, three of 25 (12%) pandemic child care/closure payments selected for testing were not calculated accurately. This resulted in underpayments of $293 and $265 for two of the three payments and an overpayment of $658 for one payment. Therefore, we will question costs of $658 for the pandemic provider overpayment (projected to an amount greater than $25,000). Without reviewing the documentation on file and ensuring the accuracy of calculations before entering payments into the system, the Department may not be able to fully support or ensure pandemic provider payments are made for the proper amounts. This could result in fines, penalties, or other sanctions imposed by the federal grantor agency or underpayments to providers who are in need of benefits. Based on discussions with management, the overpayment/underpayments were due to calculation errors in child enrollment. We recommend management evaluate and strengthen existing controls to identify where improvements can be made to minimize the risks of inaccurate pandemic provider payments. We also recommend the Department periodically monitor the established controls to determine if they are working as intended by management. In addition, management should perform reviews of provider pandemic payments to reasonably ensure payment information is accurately calculated and entered into the system. Finally, we recommend the Department consider reviewing previous pandemic payments to ensure accuracy of the payments made.

UNEMPLOYMENT INSURANCE (UI) ? PUA OVERPAYMENTS AND REPORTING Finding Number: 2020-019 State Agency Number: JFS-07 CFDA Number and Title: 17.225 ? Unemployment Insurance Federal Award Identification Number/Year: UI-34078-20-55-A-39 / 2020 Federal Agency: Department of Labor Compliance Requirements: Reporting, Special Tests and Provisions ? UI Program Integrity ? Overpayments Repeat Finding from Prior Audit? No NONCOMPLIANCE AND MATERIAL WEAKNESS NOTE: Finding numbers 2020-002 and 2020-016 contain additional information over the Unemployment Framework for Automated Claim & Tax Services (uFACTS) system used for the Pandemic Unemployment Assistance (PUA) program which is integral to and should be read in conjunction with this finding. 15 U.S.C. Section 9021 pertaining to PUA, states, in part: . . . (h) Relationship between pandemic unemployment assistance and disaster unemployment assistance [DUA] Except otherwise provided in this section or to the extent there is a conflict between this section and section?625 of title 20, Code of Federal Regulations, such section?625 shall apply to this section as if: (1) the term ?COVID?19 public health emergency? were substituted for the term ?major disaster? each place it appears in such section?625; and (2) the term ?pandemic? were substituted for the term ?disaster? each place it appears in such section?625. 20 C.F.R. Section 625.14 pertaining to overpayments and disqualifications for fraud, states, in part: . . . (h) Fraud Detection and prevention. Provisions in the procedures of each State with respect to detection and prevention of fraudulent overpayments of DUA shall be, as a minimum, commensurate with the procedures adopted by the State with respect to regular compensation and consistent with the Secretary's ?Standard for Fraud and Overpayment Detection,? . . . Additionally, the Unemployment Program Insurance Letter (UIPL) No. 23-20 provides additional guidance to states regarding program integrity for the regular UI program and for the UI programs authorized by the CARES Act enacted on March 27, 2020. UIPL 23-20, (4)(b) Program integrity functions for the regular UI programs and CARES Act programs, states, in part: ? The following BPC [Benefit Payment Control] activities are mandatory for states to implement for the regular UI programs on an ongoing basis. States must implement these functions for the Pandemic Unemployment Emergency Compensation (PUEC) and PUA programs in the same manner as for the regular UI programs. ? National Directory of New Hires Cross-match (UIPL Nos. 13-19 and 19-11). UIPL 13-19 provides detailed, recommended operating procedures for cross-matching with state and national directories of new hire data; ? Quarterly Wage Records Cross-match (20 CFR Section 603.23); and ? Systematic Alien Verification for Entitlement (SAVE) (Section 1137(d) of the Social Security Act (SSA) (42 U.S.C. Section1320b-7). ? Furthermore, UI Reports Handbook No. 401 contain instructions for completing and submitting various reports for the UI program. Included in the handbook is the ETA 902P Pandemic Unemployment Assistance Activities report, described in section IV-4 of the Handbook, which states, in part: The ETA 902P report contains monthly data on PUA activities provided by the Coronavirus Aid, Relief, and Economic Security (CARES) Act of 2020 (Pub. Law 116-136), enacted on March 27, 2020. PUA is a temporary Federal program created under the CARES Act to provide relief for workers affected by the coronavirus who do not qualify for other Federal benefits such as regular unemployment insurance or extended benefits. ? Reports shall be submitted electronically each month providing PUA activities performed during the preceding calendar month. It is management?s responsibility to establish and implement internal control procedures to reasonably ensure program objectives and requirements are met and information (both financial and non-financial) is accurately and completely processed and maintained. Additionally, outsourcing critical functions of an entity?s IT architecture and systems can have a significant impact on an agency?s internal control. Effective management of these risks requires implementation of monitoring controls to ensure manual and automated controls are operating effectively. It is imperative management verify the underlying data and related program documentation required to prepare and support the ETA 902P report. During state fiscal year (SFY) 2020, the Department disbursed more than $9.7 billion in unemployment benefits using the Ohio Job Insurance (OJI) and uFACTS systems for the regular unemployment and PUA programs, respectively. Approximately $1 billion and $2 billion of the total disbursed related to PUA and Federal Pandemic Unemployment Compensation benefit payments, respectively, that were issued from May 14, 2020 through June 30, 2020 through the uFACTS system. The Department reported PUA activities using the monthly ETA 902P report which reported approximately $2 million in overpayments. The Department?s Office of Unemployment Operations (OUIO) obtains the uFACTS data for the report from the service organization and the appeals data from the Unemployment Compensation Review Commission (UCRC). Once all data is received, OUIO Systems Support sorts the data based on the required report parameters and populates each section of the report. The Accounting Unit then obtains and submits the report to the Department of Labor (DOL) via the Unemployment Insurance Data Base (UIDB) system for data validation. If there are no errors, the report is transmitted to the DOL. However: ? In May 2020, the Department completed initial testing of the uFACTS data elements for the ETA 902P report as part of initial user acceptance testing. As part of this testing, any discrepancies were provided to the service organization for correction. However, the Department did not verify the monthly data reported from the uFACTS system and UCRC was complete and accurate prior to submission. Additionally, there was no output from the UIDB system since PUA is a new program with no comparative data, thereby increasing the Department?s reliance on data validation prior to submission. ? For two of two (100%) ETA 902P reports selected for testing, the total benefit payments and claimant overpayments did not trace and agree to the underlying records. For 60 of the claimants selected for testing from the two reports, two (3.3%) had overpayments requiring reporting in the overpayment category of the ETA 902P. However, neither claimant was included in the claimant data reported for overpayments. Additionally, the uFACTS system performs an interface on wage data and the OJI system upon initial application for claimants. The Department also performs data analytics, solicits external tips/alerts, or cases referred from internal areas to prevent and detect improper payments processed through uFACTS and OJI. However, the Department did not implement the BPC cross-matches for the PUA benefit payments in uFACTS as required by UIPL 23-30 or the cross-matching used for the regular UI program in OJI as required by 20 C.F.R. Section 625.14. Additionally, the uFACTS system did not include adequate output reports for the Department to monitor potential overpayments, including potential fraud. This resulted in noncompliance with the program requirements to promptly detect and recover fraudulent overpayments for the PUA program. By not complying with the program requirements, management cannot be reasonably assured benefit payments were allowable and paid to eligible claimants and any fraudulent overpayments were prevented and/or detected in a timely manner and properly reported on the ETA 902P report. Additionally, the lack of adequate internal controls over reporting increase the risk that reports submitted to the federal grantor agency are inaccurate. If the underlying data for the submitted reports cannot be readily verified, the Department and the federal government may not be reasonably assured the information is accurate and complete. Reporting inaccurate or incomplete information could subject the Department to federal sanctions, limiting the amount of funding for program activities. Based on discussions with management, the program changes for the ETA 902P report and BPC cross-matches were delayed due to prioritized system enhancements required to process the volume of claims during the COVID-19 pandemic. We recommend the Department work with the service organization to implement/update system programming and/or implement additional controls to address the weaknesses within the uFACTS system. These changes/updates should include, but not be limited to: ? Designing and implementing appropriate and effective control procedures to ensure the required BPC cross-matches are performed, as established within the OJI system. Management should periodically review this documentation to ensure the control procedures are being performed timely and as intended. ? Enhancing system reporting capabilities to allow the Department to more readily identify and detect potentially fraudulent overpayments. This would help focus the resources of the Department personnel during times of increased workloads. ? Designing and implementing control procedures to provide assurance the ETA 902P reports are accurate, complete, and in compliance with federal requirements. At a minimum, the procedures should include a review of the report and verifying all amounts prior to submission. Specifically, the Department should evaluate the cause of the error identified above for the claimant overpayments not included on the ETA 902P report. ? Management continually monitoring procedures to ensure compliance with program requirements and that management?s objectives are being met. If not, management should implement additional procedures or revise the Department policies and procedures, as necessary.

IEVS ALERTS ? SNAP CLUSTER AND TANF Finding Number: 2020-020 State Agency Number: JFS-08 CFDA Number and Title: 10.551/10.561 SNAP Cluster 93.558 Temporary Assistance for Needy Families (TANF) Federal Award Identification Number / Year: 182OH102S2514 / 2018 (SNAP Cluster) 182OH102S6018 / 2018 (SNAP Cluster) 192OH102S2514 / 2019 (SNAP Cluster) 192OH102S6018 / 2019 (SNAP Cluster) 202OH102S2514 / 2020 (SNAP Cluster) 202OH102S6018 / 2020 (SNAP Cluster) 1801OHTANF / 2018 (TANF) 1901OHTANF / 2019 (TANF) 2001OHTANF / 2020 (TANF) Federal Agencies: Department of Agriculture Department of Health and Human Services Compliance Requirements: Eligibility, Special Tests and Provisions ? Income Eligibility Verification System Repeat Finding from Prior Audit? Yes Prior Audit Finding Number: 2019-018 NONCOMPLIANCE AND MATERIAL WEAKNESS NOTE: Finding numbers 2020-001, 2020-004, and 2020-027 contain additional information which is integral to and should be read in conjunction with this finding. 7 C.F.R. Section 272.8(c), states the following regarding the Supplemental Nutrition Assistance Program (SNAP) Cluster: (1) State agency action on information items about recipient households shall include: (i) Review of the information and comparison of it to case record information; (ii) For all new or previously unverified information received, contact with the households and/or collateral contacts to resolve discrepancies as specified in ???273.2(f)(4)(iv) and 273.2 (f)(9)(iii) and (f)(9)(iv); and (iii) If discrepancies warrant reducing benefits or terminating eligibility, notices of adverse action. (2) State agencies must initiate and pursue the actions on recipient households specified in paragraph (c)(1) of this section so that the actions are completed within 45 days of receipt of the information items. Actions may be completed later than 45 days from the receipt of information if: (A) The only reason that the actions cannot be completed is the nonreceipt of verification requested from collateral contacts; and (B) The actions are completed as specified in ? 273.12 of this chapter when verification from a collateral contact is received or in conjunction with the next case action when such verification is not received, whichever is earlier. (3) When the actions specified in paragraph (c)(1) of this section substantiate an over issuance, State agencies must establish and take actions on claims as specified in ??273.18 of this chapter. (4) State agencies must use appropriate procedures to monitor the timeliness requirements in paragraph (c)(2) of this section. 45 C.F.R. Section 205.56(a)(1)(iv) states the following regarding the Temporary Assistance for Needy Families (TANF) program: For individuals who are recipients when the information is received or for whom a decision could not be made prior to authorization of benefits, the State agency shall within forty-five (45) days of its receipt, initiate a notice of case action or an entry in the case record that no case action is necessary, except that: Completion of action may be delayed beyond forty-five (45) days on no more than twenty (20) percent of the information items targeted for follow-up, if: (A) The reason that the action cannot be completed within forty-five (45) days is the nonreceipt of requested third-party verification; and (B) Action is completed promptly, when third party verification is received or at the next time eligibility is redetermined, whichever is earlier. If action is completed when eligibility is redetermined and third party verification has not been received, the State agency shall make its decision based on information provided by the recipient and any other information in its possession. It is management?s responsibility to implement controls, processes, and procedures to ensure compliance with these regulations. When automated systems are utilized to perform certain functions related to this compliance, management must ensure the system is properly designed and operating effectively. The Ohio Benefits system is utilized for processing eligibility for the SNAP Cluster and TANF programs with total expenditures to recipients of approximately $2.4 billion and $238 million, respectively, in state fiscal year (SFY) 2020. The Ohio Benefits system, administered by the Ohio Department of Administrative Services (DAS) for various public assistance programs, includes an Income Eligibility Verification System (IEVS) which compares income, as reported by the recipients, to information maintained by outside sources. Information that does not agree is communicated in the form of an Ohio Benefits system alert, which is forwarded to the appropriate county for investigation and resolution. Each alert has a defined due date, which is unique based on the priority level and other policy and process related factors. During SFY 2020, more than 9.1 million alerts were issued (5.9 million related to IEVS alerts and 3.2 million to non-IEVS alerts) for the SNAP Cluster and TANF programs. System design weaknesses and defects identified within Ohio Benefits caused a large increase in alerts, including multiple and repetitive alerts, irrelevant alerts, additional steps required to complete an alert, and alerts being received for persons not receiving public assistance. This created an overwhelming volume of information being sent to the counties, resulting in an unmanageable workload and ineffective application of the alert process. As a result of the extremely high number of alerts and defects detected, the Department suspended their Fraud Control Triad Reviews until the defects can be corrected within the Ohio Benefits system. While the Department began to implement monthly IEVS reviews, these were suspended in March 2020 due to the COVID-19 pandemic. However, the Department encouraged counties to continue working alerts for the SNAP Cluster and TANF programs, even during the COVID-19 pandemic. The Department created training resources and guides for county caseworkers to utilize when managing and clearing these alerts, but they were not formally adopted until October 2020. Therefore, the Department did not have controls or procedures in place to review and monitor the IEVS alerts generated and processed by the Ohio Benefits system to ensure they were being completed by the counties in accordance with the requirements and timeframes established in 7 C.F.R. Section 272.8, and 45 C.F.R. Section 205.56. Furthermore, an Ohio Benefits report showed 1,696,781 of the 3,546,669 (48%) IEVS alerts sent to the counties during the audit period were not cleared within 45 days as required. The alerts were cleared between one and 739 days beyond the 45-day requirement, for an average of 150 days late. Failure to correct system design weaknesses and defects, provide counties with guidance/procedures for working IEVS alerts, perform monitoring activities, and complete IEVS alerts within the established timeframes increases the risk benefits given to ineligible recipients or for inappropriate amounts will not be identified timely. This condition could adversely affect the Department?s ability to comply with requirements of these federal programs. Failure to comply with the requirements related to IEVS could also result in federal sanctions or penalties. Based on discussions with management, the time necessary to develop and test system enhancements and the workload increase due to the COVID-19 pandemic caused a delay in the roll-out of system enhancements and making updates to and distributing training curriculum to the appropriate personnel. We recommend Department management continue to work collectively with the related state agencies to implement/update robust processes, procedures, and system controls to address the weaknesses associated with the IEVS process within the Ohio Benefits system. These changes/updates should include, but not be limited to: ? Performing periodic and timely reviews at the Department level to monitor the status and completion of IEVS alerts. Such procedures should also include required monitoring by each County IEVS Coordinator or other supervisory personnel (through the eligibility system), which should be explicitly identified in the sub-grant agreements with the counties and include appropriate ramifications for noncompliance with the stated requirements. ? Including a more centralized evaluation of alert activity and/or better use of automated tools to vet and prioritize items requiring follow-up at the county level. This would allow Department level personnel to become more experienced and adept at identifying and investigating anomalies and help focus the resources of both Department and county personnel. ? Monitoring the IEVS alert processing procedures guide for the alerts issued by the Ohio Benefits system to ensure alerts are properly documented within the system, worked within the proper timeframes, and proper verification documentation is obtained and maintained by the counties for resolved alerts. ? Determining if the IEVS training for county caseworkers is working as intended to ensure they have the knowledge to properly document and resolve IEVS alerts generated by the Ohio Benefits system. We also recommend Department management monitor the status of system enhancements and roll-out of resources to the appropriate personnel to ensure they are implemented timely and as planned.

FEDERAL REPORTING ? WIOA CLUSTER AND TANF Finding Number: 2020-021 State Agency Number: JFS-09 CFDA Number and Title: 17.258/17.259/17.278 WIOA Cluster 93.558 Temporary Assistance for Needy Families (TANF) Federal Award Identification Number / Year: AA32186H90 / 2019 (WIOA Cluster) 1901OHTANF / 2019 (TANF) 1801OHTANF / 2018 (TANF) Federal Agencies: Department of Labor Department of Health and Human Services Compliance Requirement: Reporting Repeat Finding from Prior Audit? Yes Prior Audit Finding Number: 2019-019 NONCOMPLIANCE AND MATERIAL WEAKNESS 45 C.F.R. Section 75.302 contains the Department of Health and Human Services uniform administrative requirements for grants to state and local governments relating to financial administration and standards for financial management systems. Specifically, 45 C.F.R. Section 75.302 states, in part: (a) Each state must expend and account for the Federal award in accordance with state laws and procedures for expending and accounting for the state?s own funds. In addition, the state?s and the other non-Federal entity?s financial management systems, including records documenting compliance with Federal statutes, regulations, and the terms and conditions of the Federal award, must be sufficient to permit the preparation of reports required by general and program-specific terms and conditions; and the tracing of funds to a level of expenditures adequate to establish that such funds have been used according to the Federal statutes, regulations, and the terms and conditions of the Federal award. (b) The financial management system of each non-Federal entity must provide for the following (see also Sections 75.361, .362, .363, .364, and .365): ? (2) Accurate, current, and complete disclosure of the financial results of each Federal award or program in accordance with the reporting requirements set forth in Section 75.341 and .342? (3) Records that identify adequately the source and application of funds for federally-funded activities. These records must contain information pertaining to Federal awards, authorizations, obligations, unobligated balances, assets, expenditures, income and interest and be supported by source documentation. The Department of Labor implemented similar uniform administrative requirements in 29 C.F.R. Section 97.20 which states, in part: (a) A State must expand and account for grant funds in accordance with State laws and procedures for expending and accounting for its own funds. Fiscal control and accounting procedures of the State, as well as its subgrantees and cost-type contractors, must be sufficient to - (1) Permit preparation of reports required by this part and the statutes authorizing the grant, and (2) Permit the tracing of funds to a level of expenditures adequate to establish that such funds have not been used in violation of the restrictions and prohibitions of applicable statutes. (b) The financial management systems of other grantees and sub grantees must meet the following standards: (1) Financial reporting. Accurate, current, and complete disclosure of the financial results of financially assisted activities must be made in accordance with the financial reporting requirements of the grant or subgrant. (2) Accounting records. Grantees and sub grantees must maintain records which adequately identify the source and application of funds provided for financially-assisted activities. These records must contain information pertaining to grant or subgrant awards and authorizations, obligations, unobligated balances, assets, liabilities, outlays or expenditures, and income. . . . It is management?s responsibility to implement control policies and procedures to reasonably ensure the federal reports they submit are accurate, complete, and in compliance with program requirements. It is imperative that management be able to provide the underlying data and related program documentation required to prepare and support these reports. The Department?s Bureau of Grants Management and Federal Reporting Services (the Bureau) is responsible for the preparation of various federal financial expenditure reports, including the annual TANF ACF-204 and the quarterly WIOA Cluster ETA-9130. The Bureau runs reports from various computer systems, transfers this information to the applicable federal reports, and submits them for a two level review process prior to submitting them to the federal grantor agency. However, the Bureau?s review of federal reports was not adequate and/or operating effectively. As a result, the following errors were identified in the reports tested during state fiscal year 2020: ? For the annual TANF ACF-204 report: o The Total Number of Families Served Under the Ohio Association of Second Harvest Foodbanks during the fiscal year was incorrectly reported as 1,484,729 instead of 1,479,407, resulting in a 5,322 overstatement. The Bureau incorrectly used 2016 documentation to complete that line of the report. o The Total State Expenditures and Total State MOE (maintenance of effort) expenditures for Ohio Department of Education?s Early Childhood Care grants was incorrectly reported as $6,238,871 instead of $62,388,471, resulting in a $56,149,600 understatement. The Bureau modified the report and inadvertently deleted one of the digits in the number. ? For one of the four (25%) WIOA Cluster ETA-9130 report submissions selected for testing (September 2019 WIOA Local): o The Bureau incorrectly calculated the cumulative balance for Line 11.c Expenditure of Adult Funds on the Dislocated Worker Program for the following grant by including the current activity twice: ? JFSCDF19 / AA32186H90 ? Local Dislocated Worker ? Overstated by $1,746,736. o The Bureau incorrectly calculated the cumulative balance for Line 11.g Incumbent Worker Training Expenditures for the following grant by including the current activity twice: ? JFSCDF19 / AA32186H90 ? Local Dislocated Worker ? Overstated by $83,825. A lack of adequate internal controls over federal reporting increases the risk that reports submitted to the federal grantor agency are inaccurate. If the underlying data for the submitted reports cannot be readily verified, the Department and the federal government may not be reasonably assured the information is accurate and complete. Reporting inaccurate or incomplete information could subject the Department to federal sanctions, limiting the amount of funding for program activities. Based on discussions with management, these errors were due to transferring incorrect information, utilizing incorrect documentation, and oversight. We recommend the Department evaluate current procedures and implement additional policies and procedures as necessary to provide reasonable assurance the data being reported for all federal programs is reasonable and accurate, documentation is for the reporting period, and agrees to supporting documentation. Specifically, the Department should implement procedures to ensure the various subtotals are complete and accurate and the amounts included in the report are properly classified. The Department should ensure all reports (and any necessary corrections to reports) are reviewed and approved by the appropriate level of management.

CASH MANAGEMENT ? VARIOUS PROGRAMS Finding Number: 2020-022 State Agency Number: JFS-10 CFDA Number and Title: 17.207/17.801/17.804 ? Employment Services (ES) Cluster 93.558 ? Temporary Assistance for Needy Families (TANF) 93.667 ? Social Services Block Grant (SSBG) Federal Award Identification Number / Year: DV342252055539 / 2019 (ES Cluster) 1901OHTANF / 2019 (TANF) 1901OHSOSR / 2019 (SSBG) Federal Agencies: Department of Labor Department of Health and Human Services Compliance Requirement: Cash Management Repeat Finding from Prior Audit? Yes Prior Audit Finding Number: 2019-020 NONCOMPLIANCE AND MATERIAL WEAKNESS ? TANF AND SSBG NONCOMPLIANCE AND SIGNIFICANT DEFICIENCY ? ES CLUSTER U.S. Treasury regulations, 31 C.F.R. Part 205, which implemented the Cash Management Improvement Act of 1990 (CMIA), require state recipients enter into agreements that prescribe specific methods of drawing down Federal funds (funding techniques) for selected large programs. The Department's TANF and SSBG programs are covered by such an agreement. The state fiscal year (SFY) 2020 CMIA Agreement between the State of Ohio and the United States Department of the Treasury specifically requires the State use the Modified Pre-Issuance technique of drawing federal funds for certain types of draws related to these programs. Paragraph 6.2.4 of the CMIA agreement requires the following for the Modified Pre-Issuance funding technique: The State of Ohio?s accounting system requires funding to be available prior to initiating a disbursement. In addition, disbursements take two business days to produce a payment. Given this fact pattern, State of Ohio agencies are typically unable to meet the three business day requirement and an eight business day requirement is necessary for agency compliance with this agreement. The State shall request funds such that they are deposited in a State account not more than eight business days prior to the day the State makes a disbursement. The request shall be made in accordance with the appropriate Federal agency cut-off time specified in Exhibit I. The amount of the request shall be the amount the State expects to disburse. This funding technique is not interest neutral. The ES Cluster was not included in the SFY 2020 CMIA Agreement; therefore, 31 C.F.R. Section 205.33(a) sets guidelines which state the following: A State must minimize the time between the drawdown of Federal funds from the Federal government and their disbursement for Federal program purposes. A Federal Program Agency must limit a funds transfer to a State to the minimum amounts needed by the State and must time the disbursement to be in accord with the actual, immediate cash requirements of the State in carrying out a Federal assistance program or project. The timing and amount of funds transfers must be as close as is administratively feasible to a State's actual cash outlay for direct program costs and the proportionate share of any allowable indirect costs? The Department draws federal funds for the ES Cluster similarly to those which follow the Modified Pre- Issuance funding technique and considers eight business days a reasonable amount of time to disburse the drawn federal funds for program expenses. It is management?s responsibility to implement control policies and procedures to reasonably ensure draws of federal funds are for immediate cash needs, processed accurately, and disbursed timely in accordance with applicable laws and regulations. During SFY 2020, the Department drew down approximately $836 million for the ES Cluster, SSBG, and TANF federal programs. The Department has partnered with the Ohio Office of Budget and Management (OBM)'s Office of Shared Services (OSS) to process transactions. OSS enters the information for these transactions into the Ohio Administrative Knowledge System (OAKS), after which the Department and OBM review and approve them. The Department then draws down the funds to pay these expenditures. Generally, a Fiscal Specialist in the Federal Cash Draw Unit of the Bureau of Cash and Cost Reporting Services calculates the amount of funds to be drawn down based on the Department's cash needs (payroll, administrative costs, county advances, etc.) and the current cash on hand. In addition, the Cash Management Section Supervisor reviews and investigates any discrepancies on the Summary Tracking Report, which lists the grant activities (award amounts, revenue draws, expenditures, and remaining balances) for the federal programs monthly. This document provides a mechanism for the Department to monitor its draws with expenditures on a cumulative basis although it does not match up specific draws and expenditures. However, the Department's controls did not prevent noncompliance with the cash management requirements, as follows: ? Of 25 disbursements tested from 25 draws, the Department did not disburse four TANF payments (16%) within eight business days of the receipt of federal funds, as required by the CMIA Agreement. The Department disbursed the funds one to three days after the required disbursement date. ? Of 25 disbursements tested from 25 draws, the Department did not disburse two SSBG payments (8%) within eight business days of the receipt of the federal funds, as required by the CMIA Agreement. The Department disbursed the funds one and two days after the required disbursement date. ? Of 25 disbursements tested from 25 draws, the Department did not disburse one ES Cluster payment (4%) within eight business days of the receipt of federal funds, as required by 31 CFR Section 205.33(a). The Department disbursed the funds one day after the required disbursement date. Not having effective controls over the timely disbursement of federal funds could lead to the Department not limiting draws to immediate cash needs and not expending funds timely. This could result in noncompliance with the CMIA Agreement and 31 C.F.R. Section 205.33(a). These conditions could subject the Department to sanctions or other penalties and a repayment of part of the grant award amounts. In addition, noncompliance could subject the Department to paying interest charges on these draws. Based on discussions with management and review of supporting documents, the errors were due to processing and approval delays. We recommend the Department evaluate its existing cash management control procedures and update them as necessary to reasonably ensure all federal draw requests are disbursed timely and are drawn only for immediate cash needs, based on the funding technique established for each federal program in the CMIA Agreement or in accordance with 31 C.F.R. Section 205.33(a). If delays in the disbursements are caused by external factors, we recommend the Department communicate with other entities to develop reasonable solutions and follow established protocols, including reinforcing the time period in which payments should be entered, approved, and paid. We also recommend the Department establish procedures to periodically monitor its compliance with the cash management requirements and initiate necessary actions to resolve any noncompliance that results.

SUBRECIPIENT MONITORING ? VARIOUS PROGRAMS Finding Number: 2020-023 State Agency Number: JFS-11 CFDA Number and Title: 10.551/10.561 ? SNAP Cluster 17.258/17.259/17.278 WIOA Cluster 93.558 ? Temporary Assistance for Needy Families (TANF) 93.563 ? Child Support Enforcement 93.575/93.596 ? CCDF Cluster 93.667 ? Social Services Block Grant (SSBG) Federal Award Identification Number / Year: 192OH102S2514 / 2019 (SNAP Cluster) 192OH102S6018 / 2019 (SNAP Cluster) 202OH102S2514 / 2020 (SNAP Cluster) 202OH102S6018 / 2020 (SNAP Cluster) AA307421755A39 / 2018 (WIOA Cluster) AA332491955A39 / 2019 (WIOA Cluster) AA348122055A39 / 2020 (WIOA Cluster) 1901OHTANF / 2019 (TANF) 2001OHTANF / 2020 (TANF) 1904OHCSES / 2019 (Child Support) 2001OHCSES / 2020 (Child Support) 1801OHCCDF / 2018 (CCDF Cluster) 1901OHCCDF / 2019 (CCDF Cluster) 2001OHCCDF / 2020 (CCDF Cluster) 1901OHSOSR / 2019 (SSBG) 2001OHSOSR / 2020 (SSBG) Federal Agencies: Department of Agriculture Department of Labor Department of Health and Human Services Compliance Requirement: Subrecipient Monitoring Repeat Finding from Prior Audit? Yes Prior Audit Finding Number: 2019-021 NONCOMPLIANCE AND MATERIAL WEAKNESS 45 C.F.R. Section 75.521 gives regulatory effect to the Department of Health and Human Services uniform administrative requirements for grants to states and local governments relating to financial administration and standards for financial management systems. In addition, similar administrative requirements were implemented for the Department of Labor in 2 C.F.R. Section 2900.4 and the Department of Agriculture implemented 2 C.F.R. Section 400.1. Specifically, 2 C.F.R. Section 200.521 and 45 C.F.R. Section 75.521 state, in part: (c) . . . the pass-through entity must be responsible for issuing a management decision for audit findings that relate to Federal awards it makes to subrecipients. (d) The Federal awarding agency or pass-through entity responsible for issuing a management decision must do so within six months of acceptance of the audit report by the FAC [Federal Audit Clearinghouse]. The auditee must initiate and proceed with corrective action as rapidly as possible and corrective action should begin no later than upon receipt of the audit report. . . Additionally, 2 C.F.R. Section 2900.21 states, in part: . . . , ordinarily, a management decision is issued within six months of receipt of an audit from the audit liaison of the Office of the Inspector General and is extended an additional six months when the audit contains a finding involving a subrecipient of the pass-through entity being audited. The pass-through entity responsible for issuing a management decision must do so within twelve months of acceptance of the audit report by the FAC. The auditee must initiate and proceed with corrective action as rapidly as possible and should begin corrective action no later than upon receipt of the audit report. (See 2 C.F.R. Part 200.521(d)). It is management's responsibility to develop and implement procedures to ensure a management decision is made on audit findings related to the federal programs it administers within the time requirements outlined by the C.F.R. The Department?s Office of Fiscal and Monitoring Services, Audit Resolution Section (ARS) is responsible for ensuring that subrecipients who expend $750,000 or more in Federal awards during the subrecipient's fiscal year have met the audit requirements of 2 C.F.R. Part 200. ARS maintains three different spreadsheets: County Department of Job and Family Services, Non-County, and Workforce Innovation and Opportunity Act (WIOA) in order to track the receipt, review, and conclusion of audits. The Department?s procedures include: searching the FAC website to identify and obtain subrecipient audit reports; reviewing audit/management letter reports; completing an audit review checklist; submitting corrective action plans to the Pre-Executive Audit Committee (EAC) and EAC workgroups for review and approval; issuing management decision letters to subrecipients within six months of the report being accepted by the FAC; and, issuing closure letters to the subrecipients. During the audit period, the Department reviewed 176 audit reports. However, for one of 20 (5%) audit reports selected for testing, the Department did not issue a management decision within six months of the report being accepted by the FAC; the management decision was 51 days late. Failure to adequately monitor subrecipients and the status of compliance issues noted during their audit increases the risk that subrecipients may not properly utilize federal funds or adhere to program requirements, potentially jeopardizing federal funding. In addition, without appropriate management oversight of the review of subrecipient audit reports, there is an increased risk that audit findings may not be addressed appropriately. Noncompliance by the Department could cause federal funding to be reduced, taken away, or sanctions imposed by the federal grantor agency. Based on discussion with management, the management decision was late in part because of oversight in properly identifying the subrecipient on the FAC website. We recommend the Department evaluate existing policies and procedures related to subrecipient monitoring, and revise where necessary, to ensure they are adequate for ensuring timely management decisions. Procedures performed by the Department should be adequately documented to provide management reasonable assurance they have been performed. Management should periodically monitor these procedures to ensure they are operating as intended.

CCDF CLUSTER ? FAMILY CHILD CARE PROVIDER HOME LICENSING Finding Number: 2020-024 State Agency Number: JFS-12 CFDA Number and Title: 93.575/93.596 ? CCDF Cluster Federal Award Identification Number / Year: 1801OHCCDF / 2018 1901OHCCDF / 2019 2001OHCCDF / 2020 Federal Agency: Department of Health and Human Services Compliance Requirement: Special Tests and Provisions ? Health & Safety Requirements Repeat Finding from Prior Audit? No NONCOMPLIANCE AND MATERIAL WEAKNESS 45 C.F.R. Section 98.41(a) - Health and safety requirements, states ?Each Lead Agency [primary grantee] shall certify that there are in effect, within the State (or other area served by the Lead Agency), under State, local or tribal law, requirements (appropriate to provider setting and age of children served) that are designed, implemented, and enforced to protect the health and safety of children. Such requirements must be applicable to child care providers of services for which assistance is provided under this part." The Department has incorporated its laws and procedures for the application process for Family Child Care (FCC) Provider Homes (Type A and B home providers) within Ohio Administrative Code (OAC) Section 5101:2-13 which contains numerous requirements a provider must meet to be licensed. Specifically, OAC Section 5101:2-13-02(M) relates to the County Departments of Job and Family Services? (CDJFS) responsibility for the application and licensure for a FCC provider and states, in part: . . . The county agency: (1) Shall recommend the application for approval or denial to the ODJFS. [Ohio Department of Job and Family Services] within ninety days of receiving a completed application. . . When administering federal grant awards for the Department, management of each CDJFS is responsible for ensuring the approval or denial recommendations for FCC Provider Home licensure applications are made timely to comply with the applicable OAC. Department management is responsible for monitoring CDJFS activities to help ensure they are in compliance with federal and state requirements. During state fiscal year (SFY) 2020, the Department licensed 7,325 child care programs, which included 4,390 child care centers and 2,935 FCC Providers. Of these child care programs, the Department?s licensing specialists licensed approximately 300 new child care centers and CDJFS specialists licensed approximately 180 new FCC Provider Homes. The Department and CDJFS staff utilize the Ohio Child Licensing and Quality System (OCLQS) to receive applications, perform inspections, and monitor licensed providers. CDJFS personnel verify the FCC Provider Home application is complete, includes all necessary documentation, and recommends the application for approval or denial to the Department. In addition, the CDJFS may maintain support outside of OCLQS to identify the status of applications, including the completion date. However, for four of 15 (26.7%) FCC Provider Home applications selected for testing, the CDJFS did not make a recommendation for approval/denial within the required number of days upon receipt of the application. These recommendations ranged from three to 215 days late, with an average of 61 days late. In addition, OCLQS maintains two submission date fields: the ?original submission date? field never changes from when the application is first submitted; however, the ?submission date? field can be over-written when a change to the application occurs. Therefore, the OCLQS does not identify the completed application date for FCC Provider Home applications to allow the Department a mechanism to ensure compliance with OAC Section 5101:2-13-02(M)(1). Without properly designed systems in place to ensure timely recommendations are made for the approval/denial of FCC Provider Home applications, in accordance with OAC Section 5101:2-13, the Department increases the risk that eligibility determinations will be delayed to the detriment of the program recipients. In addition, if the Department is not complying with rules it implemented to meet federal requirements, the Department risks federal funding being reduced, taken away, or other sanctions imposed by the federal grantor agency. Based on discussions with management, the delays in the application approval/denial submission process were due to the cooperation and timely response of the provider applicants. Management also indicated a system enhancement is scheduled to be implemented in February 2021 to address the date field issue. We recommend the Department work with CDJFS management to ensure they have current policies and procedures and/or implement control procedures to reasonably ensure the recommendations for approval or denial of FCC Provider Home applicants are made timely. We recommend the Department review and consider if any enhancements to OCLQS are necessary to allow for accurate monitoring of the application completion date in accordance with the OAC. In addition, we recommend the Department evaluate and implement a system update to limit or not allow submission dates to be overwritten in order to maintain an accurate case history and audit trail. Furthermore, management should perform periodic reviews of FCC Provider files to reasonably ensure the applications are being recommended for approval or denial timely and procedures are being followed by CDJFS and Department personnel.

FOSTER CARE ? PAYMENT RATE SETTING AND APPLICATION Finding Number: 2020-025 State Agency Number: JFS-13 CFDA Number and Title: 93.658 Foster Care ? Title IV-E Assistance Federal Award Identification Number / Year: 2001OHFOST / 2020 Federal Agency: Department of Health & Human Services Compliance Requirements: Allowable Costs/Cost Principles, Special Tests and Provisions ? Payment Rate Settings and Application Repeat Finding from Prior Audit? No NONCOMPLIANCE AND MATERIAL WEAKNESS 42 U.S.C. Section 671(a) (also known as section 471 of the Social Security Act) states, in part: In order for a State to be eligible for payments under this part, it shall have a plan approved by the Secretary which? ? (11) Provides for periodic review of the standards?and amounts paid as foster care maintenance payments and adoption assistance to assure their continuing appropriateness; . . . 45 C.F.R. Section 1356.21(m) states, in part: Review of payments and licensing standards. In meeting the requirements of section 471(a)(11) of the Act, the Title IV-E agency must review at reasonable, specific, time-limited periods to be established by the agency: (1) The amount of the payments made for foster care maintenance and adoption assistance to assure their continued appropriateness; . . . The Department oversees statewide foster care services which are provided through foster care agencies, as defined in Ohio Administrative Code Section 5101:2-1-01(12). During state fiscal year 2020, the Department reviewed and approved the maintenance and administrative reimbursement ceiling rates for 148 providers. The Department determines maintenance and administrative reimbursement ceiling rates for the agencies through the use of a survey or cost report depending on the type of agency. During the course of reviewing the survey or cost report, the Department identifies if the inflation rate should be included or excluded. However, one of the 15 (6.7%) providers selected for testing did not include the inflation factor in the calculation for the maintenance and administration ceiling rates even though it was marked as applicable in the survey or cost report. As a result, the provider was approved for a maintenance rate of $292 and an administration rate of $21 instead of $300 and $22, respectively. These errors did not result in any underpayments for maintenance, but did result in an underpayment of $172 for administrative costs. This underpayment was corrected once it was brought to management?s attention. Without properly including or excluding the inflation rate in the calculation for reimbursement ceilings, providers might not receive the appropriate reimbursement. This could result in underpayments, restricting the services provided or causing them to discontinue current programs. This could also result in overpayments, subjecting the Department to fines, penalties, or repayment of funds by the federal grantor agency. Based on our review of documents and discussions with management, it appears the report reviewer correctly marked 'yes' on the cost report to include the inflation rate in the effective rate for the period, but when the report was finalized the inflation rate was inadvertently left out of the calculation. We recommend the Department reinforce its existing procedures to adequately ensure all Foster Care reimbursement rates are properly calculated. We further recommend management periodically monitor and evaluate these procedures to ensure they are operating as intended.

IT ? UI FUTA CERTIFICATION MATCH Finding Number: 2020-026 State Agency Number: JFS-14 CFDA Number and Title: 17.225 ? Unemployment Insurance Federal Award Identification Number / Year: UI-32619-19-55-A-39 / 2019 UI-34070-20-55-A-39 / 2020 UI-34078-20-55-A-39 / 2020 Federal Agency: Department of Labor Compliance Requirement: Special Tests and Provisions - Match with IRS 940 FUTA Tax Form Repeat Finding from Prior Audit? No NONCOMPLIANCE AND SIGNIFICANT DEFICIENCY 26 C.F.R. Section 31.3302(a)-3(a), pertaining to proof of credit states, in part: Credit against the tax for any calendar year for contributions paid into State unemployment funds shall not be allowed unless there is submitted to the district director: (a) A certificate of the proper officer of each State (the laws of which required the contributions to be paid) showing, for the taxpayer: (1) The total amount of contributions required to be paid under the State law with respect to such calendar year (exclusive of penalties and interest) which was actually paid on or before the date the Federal return is required to be filed; and (2) The amounts and dates of such required payments (exclusive of penalties and interest) actually paid after the date the Federal return is required to be filed. (b) A statement by the taxpayer that no part of any payment made by him into a State unemployment fund for such calendar year, which is claimed as a credit against the tax, was deducted or is to be deducted from the remuneration of individuals in his employ. Such statement shall contain or be verified by a written declaration that it is made under the penalties of perjury. (c) Such other or additional proof as the Commissioner or the district director may deem necessary to establish the right to the credit provided for under section 3302(a). States are required to annually certify for each taxpayer the total amount of contributions required to be paid under the State law for the calendar year and the amounts and dates of such payments in order for the taxpayer to be allowed the credit against the FUTA tax (26 C.F.R. Section 31.3302(a)-3(a)). In order to accomplish this certification, States annually perform a match of employer tax payments with credit claimed for these payments on the employer?s IRS 940 FUTA tax form. The ERIC system is the web-based system used to collect and process Ohio unemployment taxes and store and report wage information for Ohio employers. During state fiscal year 2020, approximately $1.08 billion in unemployment compensation taxes were collected and processed by the ERIC system. However, one of 60 (1.7%) sampled certifications from the IRS_CERT table did not match the payments included in the ERIC system. Further analysis and inquiry with the client indicated a bug within the source code of the ERIC system caused unemployment tax payment information to not be properly populated in the IRS_CERT table for transactions with a Form Type Indicator of 4. The Department?s FUTA certification process controls did not identify this exception. For state fiscal year 2020, unemployment tax payment transactions with a Form Type Indicator 4 represented 4,818 (2.4%) of the 204,582 total transactions. Wage reports provide the basis for possible benefit claim awards. Inaccurate and untimely reporting Increases the risk taxpayers may not be able to properly claim credit against FUTA taxes. Error or discrepancies in reporting may also require additional reporting for the employer. The Department indicated it was not aware of this programming oversight. We recommend the Department review existing FUTA certification controls and/or update policies and procedures to ensure tax payments met the stated criteria for FUTA tax credits allowance (e.g., timely state unemployment tax filings and payments). Additionally, we recommend the Department?s Management continually monitor these procedures to ensure the compliance requirements of the program management?s objectives are being met.

SNAP CLUSTER AND TANF ? ELIGIBILITY SYSTEM Finding Number: 2020-027 State Agency Number: JFS-15 CFDA Number and Title: 10.551/10.561 ? SNAP Cluster 93.558 ? Temporary Assistance for Needy Families (TANF) Federal Award Identification Number / Year: 182OH102S2514 / 2018 (SNAP Cluster) 182OH102S6018 / 2018 (SNAP Cluster) 192OH102S2514 / 2019 (SNAP Cluster) 192OH102S6018 / 2019 (SNAP Cluster) 202OH102S2514 / 2020 (SNAP Cluster) 202OH102S6018 / 2020 (SNAP Cluster) 1801OHTANF / 2018 (TANF) 1901OHTANF / 2019 (TANF) 2001OHTANF / 2020 (TANF) Federal Agencies: Department of Agriculture Department of Health and Human Services Compliance Requirement: Eligibility Repeat Finding from Prior Audit? Yes Prior Audit Finding Number: 2019-017 MATERIAL WEAKNESS NOTE: Finding numbers 2020-001 , 2020-XXX, 2020-XXX, and 2020-XXX contain additional information which is integral to and should be read in conjunction with this finding. 7 C.F.R. Section 272.10(b)(1)(i), pertaining to the SNAP Cluster, states in part, that a State?s system should: Determine eligibility and calculate benefits or validate the eligibility worker?s calculations by processing and storing all casefile information necessary for the eligibility determination and benefit computation (including but not limited to all household members? names, addresses, dates of birth, social security numbers, individual household members? earned and unearned income by source, deductions, resources and household size)? 45 C.F.R. Section 206.10(a), pertaining to public assistance programs, including TANF, states in part: ? (8) Each decision regarding eligibility or ineligibility will be supported by facts in the applicant?s or recipient?s case record? ? (12) The State agency shall establish and maintain methods by which it shall be kept currently informed about local agencies' adherence to the State plan provisions and to the State agency's procedural requirements for determining eligibility, and it shall take corrective action when necessary. As the lead agency responsible for administering the SNAP and TANF federal grant awards for the State of Ohio, the Department is responsible for providing reasonable assurance only eligible individuals receive assistance and documentation maintained is accurate, complete, and properly recorded in the Ohio Benefits system to ensure appropriate eligibility determinations. It is the Department?s responsibility to implement sufficient controls, systems, processes, and procedures to reasonably ensure compliance with the rules and regulations associated with these programs and only eligible recipients receive benefits. The Department is responsible for overall program compliance and must have appropriate oversight and monitoring procedures in place to ensure those they rely on are operating in accordance with all expectations, guidelines, and requirements related to their tasks. During state fiscal year (SFY) 2020, the Department disbursed a combined total of nearly $2.7 billion in public assistance payments, to recipients processed through the Ohio Benefits system related to the following programs: See Schedule of Findings and Questioned Costs for chart/table The information below summarizes Finding 2020-001 as it relates to the control process and weaknesses identified related to eligibility for the SNAP Cluster. These issues also apply to the TANF program and additional information was added, where necessary, to identify any errors related to the TANF program. These programs are administered using a multi-agency approach, as follows: overall compliance and administration of the SNAP Cluster and TANF program fall under the Department, and programming and administration of the State?s eligibility determination computer system, Ohio Benefits, falls under the Ohio Department of Administrative Services (DAS). In August 2018, the SNAP Cluster and TANF program were added to the Ohio Benefits system. The Department also utilizes the 88 Ohio counties in the eligibility determination process to work with applicants, receive/enter eligibility documentation into the Ohio Benefits system, and follow up on alerts issued by the system. Currently, individuals applying to receive public assistance benefits complete an application through various methods. The County Departments of Job & Family Services (CDJFS) offices collect and maintain any documentation provided by the individual either in a paper case file or in the OnBase Enterprise Documentation Management System (EDMS) maintained under contract by DAS and utilized by the Department. After collecting documentation, the county caseworker enters the individual?s information into the Ohio Benefits system which determines the initial eligibility benefit amount and assigns the benefit aid category, where applicable. Once the determination is made, the Ohio Benefits system uploads the eligibility information to the Department?s payment system to process the payment. During SFY 2020, we noted several weaknesses/defects in the eligibility process, as listed below: ? Alerts ? The Ohio Benefits system is designed to issue alerts to county caseworkers for a variety of items which require review, evaluation, follow-up, and a determination about the impact on the related case and/or program benefits. During SFY 2020, more than 26.3 million alerts were issued according to DAS records (more than 17 million related to Income Eligibility Verification Systems (IEVS) alerts and 9.28 million to non-IEVS alerts). This created an overwhelming volume of information being sent to the counties resulting in an unmanageable workload and ineffective application of the alert process. As a result of the extremely high number of alerts and defects detected (see below) in the Ohio Benefits system, JFS suspended their Fraud Control Triad Reviews until the defects can be corrected. JFS did, however, encourage counties to continue working alerts for the SNAP Cluster and TANF program, even during the COVID-19 pandemic. ? Overwriting ? The Ohio Benefits system maintains several pieces of key information related to a recipient?s eligibility (income, household size, age, etc.). If new or updated information is identified, the county caseworker is expected to add this information to the system. Based on our testing, in some cases, the caseworker is replacing/overwriting the existing information with new information instead of adding this new data to the case record. However, there is no system warning or other control in place to identify or prevent this overwrite. ? Caseworker Reliance/Training ? The current process relies heavily on the knowledge and judgement of county caseworkers in the eligibility process. Although on-line job aids are made available and various trainings are provided by the state agencies for these caseworkers, this training is typically optional and/or attended by a representative of the county who is expected to relay the information to others. ? Multi-program Info ? There are certain pieces of key information (i.e. name, income, age, etc.) maintained in the Ohio Benefits system which impact all public assistance programs. However, due in part to the complexities/variations of the requirements for each federal program, the system currently does not link this information between programs. Therefore, the county caseworker must manually adjust each affected program separately when a change occurs. ? System Design Weaknesses/Defects ? Our testing and inquiry with both State and county personnel identified the following system design weaknesses or defects in the Ohio Benefits system related to alerts: ? Multiple and repetitive alerts (redundancy). ? Irrelevant alerts (zero or small dollar amounts). ? Additional steps required to complete an alert (having to leave the alert window, opening an Ohio Benefits window, and then having to go back through the Alert Inventory to clear the alert). ? Alerts being received on persons not receiving public assistance. We noted several weaknesses/issues regarding the contract and monitoring related to the Ohio Benefits system in Finding Number 2020-004 for the Department of Administrative Services. These issues, which impact the Department?s responsibilities regarding monitoring, updates, and program compliance, are summarized below: ? The signed agreements/amendments did not separately require signatures from the Ohio Department of Medicaid and the Ohio Department of Job and Family Services was not included on amendments. ? Signed interagency agreements defining each agency?s responsibilities and the data governance structure have not been completed. ? No evidence of monitoring procedures related to the Independent Verification and Validation (IV&V) reports prepared by a third-party evaluator. ? No formalized documentation/tracking of reviews/evaluations/certifications performed or required for the Ohio Benefits system by outside or internal reviewers. Without proper controls for entering, processing, and maintaining recipient information and system alerts, there is an increased risk that benefits paid to or on behalf of recipients will be inaccurate or unallowable. This risk is substantially increased if the State?s eligibility determination system, Ohio Benefits, contains design or operational flaws that could impact a recipient?s eligibility and, as a result, could have a material impact on the amounts reimbursed by the federal government. These weaknesses/defects could allow undue subjective decisions, jeopardize accurate eligibility processing, and/or result in improper payments or federal reimbursements. Overpayments or payments to or on behalf of ineligible recipients may subject the Department to penalties or sanctions which may jeopardize future funding and limit its ability to fulfill program requirements to provide benefits to those in need. Based on discussions with management, human error and systemic issues led to the issues identified. Management also indicated they have been and are continuing to make corrections and enhancements to the Ohio Benefits system to address the weaknesses and defects identified in the previous and current audit findings. We recommend Department management continue to work collectively with the related state agencies to implement/update robust processes, procedures, and system programming to address the weaknesses in the overall eligibility process, including those associated with the Ohio Benefits system. These changes/updates should include, but not be limited to: ? Redesigning the alert process to be more effective and efficient. This could include a more centralized evaluation of alert activity and/or better use of automated tools to vet and prioritize items requiring follow-up. This would allow agency level personnel to become more experienced and adept at identifying and investigating anomalies and help focus the resources of both State and county personnel. ? Implementing program changes to address the system design weaknesses/defects identified above, including the issues with overwriting data and making all data stored in the system available/viewable by users. Program changes which could directly impact the eligibility determinations or benefit amounts should be given the highest priority by the State and corrected in a timely manner to prevent and detect further improper payments. ? Implementing program logic to ensure changes made to recipient information in one public assistance program are carried through in Ohio Benefits to other applicable public assistance programs for that recipient without caseworker initiation. ? Requiring mandatory training for all CDJFS employees who are entering the assistance group information into Ohio Benefits to help ensure proper and complete information is being collected, entered, and verified prior to an individual?s eligibility determination being made. The State should provide this training initially to ensure all users are knowledgeable of the process, procedures, and impacts of the work they do. As changes occur to the rules/regulations, system, or process, detailed training should be required of all users on those changes. ? Regularly evaluating selected benefit payments for all programs to verify the recipient?s eligibility, verify the recipient information entered into Ohio Benefits by the CDJFS is accurate and the information is being maintained to support the State?s eligibility decision, and ensure initial eligibility determinations and redeterminations are completed timely. Any problems noted should be promptly corrected to reduce the risk of benefit payments being made on behalf of ineligible individuals and additional training provided to the State and/or county employees affected. ? Ensuring that vendor contacts/amendments, and interagency agreements are formalized, contain all parties of the agreements, and fully and clearly define the roles, responsibilities, and expectations related to each party. ? Ensuring that appropriate and coordinated monitoring and tracking procedures are in place regarding reviews and the timely remediation of issues identified, including, but not limited to: ? A data governance structure designed to ensure data quality and reliability for management, the grantor agencies, and other users of this information. This should include data subject matter experts from each related agency to help ensure quality of data requests before external and internal users rely on the data, issues are addressed with a clear escalation path, and establishing accountabilities and alignment between the related agencies. ? Appropriate monitoring procedures related to the IV&V reports prepared by the third-party evaluator. ? Coordinating and managing the contract contents with the developing vendor to help ensure all contract and amendment deliverables are being met. ? A formalized documentation/tracking process of reviews/evaluations/certifications performed or required for the OB system.

TANF ? WORK PARTICIPATION REVIEWS Finding Number: 2020-028 State Agency Number: JFS-16 CFDA Number and Title: 93.558 ? Temporary Assistance for Needy Families (TANF) Federal Award Identification Number / Year: 1801OHTANF / 2018 1901OHTANF / 2019 2001OHTANF / 2020 Federal Agency: Department of Health and Human Services Compliance Requirements: Eligibility; Special Tests and Provisions ? Work Verification Plan Repeat Finding from Prior Audit? No MATERIAL WEAKNESS 45 C.F.R. Section 261.62 states, in part: (a) To ensure accuracy in the reporting of work activities by work-eligible individuals on the TANF Data Report, each State must: . . . (4) Establish and employ internal controls to ensure compliance with the procedures; and (5) Submit to the Secretary for approval the State's Work Verification Plan ? (b) A State's Work Verification Plan must include the following: . . . (5) A description of the internal controls that the State has implemented to ensure a consistent measurement of the work participation rates, including the quality assurance processes and sampling specifications it uses to monitor adherence to the established work verification procedures by State staff, local staff, and contractors. . . . As the lead agency responsible for administering the TANF federal grant award for the State of Ohio, the Department is responsible for providing reasonable assurance only eligible individuals receive assistance and documentation maintained is accurate, complete, and properly recorded in the statewide automated eligibility system to ensure appropriate eligibility determinations. It is the Department?s responsibility to implement sufficient controls, systems, processes, and procedures to reasonably ensure compliance with the rules and regulations associated with the program and only eligible recipients receive benefits. The Department is responsible for overall program compliance and must have appropriate oversight and monitoring procedures in place to ensure those they rely on are operating in accordance with all expectations, guidelines, and requirements related to their tasks. As outlined in the State of Ohio Work Verification Plan, the Department establishes program policy, provides technical assistance, defines performance standards, requires continuous improvement activities, collects data and monitors all County Departments of Job and Family Services (CDJFS). Applications, reapplications, and assignment of work activities are processed by the CDJFS. Also within the Work Verification Plan, the Department identifies monitoring activities which include: training, case reviews, monitoring county performance, review of work-eligible individual status, and reviews of the data prior to submission to federal regulators. Monthly, the Department generates preliminary TANF data reports for review by the CDJFS to be reviewed for accuracy and completeness. In addition, the Department maintains a TANF Federal Reporting team to ensure all data elements and accurate data reporting occurs per federal regulations. The Department?s Quality Control staff also perform reviews over individual cases that were sanctioned for failing to meet work-eligible requirements to ensure the CDJFS came to the proper conclusion. Additionally, eligibility reviews are completed for publicly funded child care cases that may include individuals who receive TANF and in these instances, the Department also verifies that work participation hours are accurate. However, in September 2018, the Department made a business decision to no longer perform specific TANF work participation hour reviews over the non-sanctioned work-eligible cases. As a result, the Department does not have monitoring procedures in place over non-sanctioned work-eligible individuals to validate the reported work participation status and related eligibility information in the statewide automated eligibility system and the county case file, but instead places a heavy reliance on the CDJFS. See finding number 2020-014, TANF ? Unsupported Work Participation Activities which starts on page ##, for questioned costs related to possible overpayments of TANF program benefits due to unsupported work participation hours/activities entered in the statewide automated eligibility system. Without monitoring procedures in place to ensure the CDJFS are meeting the TANF program requirements, there is an increased risk that benefits paid to or on behalf of recipients will be inaccurate or unallowable. This could result in fines, penalties, or repayment of funds to the federal grantor agency. In addition, without ensuring the CDJFS are accurately documenting and maintaining work participation activities, there is an increased risk the work participation rate is not accurate as reported to the federal grantor agency thereby impacting the State?s reporting of this performance measurement. Based on discussion with management, a business decision was made to cease completion of non-sanctioned review cases. In addition, the current monitoring procedures in place by the Department provide them confidence in meeting the TANF program requirements. We recommend the Department, as the pass-through entity, implement stronger monitoring controls over the activities of its county subrecipients to determine if they are following the established controls and are complying with the work participation and verification requirements. Also, we recommend the Department evaluate its business decision to cease work participation hour non-sanctioned case reviews and determine if these should be completed going forward or if other monitoring procedures should be implemented to meet these objectives.

MEDICAID/CHIP ? ELIGIBILITY Finding Number: 2020-029 State Agency Number: MCD-02 CFDA Number and Title: 93.767 ? Children?s Health Insurance Program (CHIP) 93.775/93.777/93.778 ? Medicaid Cluster Federal Award Identification Number / Year: 1905OH5021 / 2019 (CHIP) 2005OH5021 / 2020 (CHIP) 1905OH5MAP / 2019 (Medicaid) 2005OH5MAP / 2020 (Medicaid) Federal Agency: Department of Health and Human Services Compliance Requirements: Activities Allowed or Unallowed, Allowable Costs/Cost Principles, Eligibility Repeat Finding from Prior Audit? Yes Prior Audit Finding Number: 2019-022 QUESTIONED COSTS, NONCOMPLIANCE, AND MATERIAL WEAKNESS (CHIP) $129,308 QUESTIONED COSTS, NONCOMPLIANCE, AND MATERIAL WEAKNESS (MEDICAID CLUSTER) $109,391 NOTE: Finding numbers 2020-001 , 2020-004, and 2020-030 contain additional information which is integral to and should be read in conjunction with this finding. 42 C.F.R. Section 435.10, State Plan requirements, pertaining to the Medicaid Cluster states in part: A State plan must--- (a) Provide that the requirements of this part are met; and (b) Specify the groups to whom Medicaid is provided, as specified in subparts B, C, and D of this part, and the conditions of eligibility for individuals in those groups. 42 C.F.R. Section 435.912 Timely determination of Eligibility, states in part: (3) . . . the determination of eligibility for any applicant may not exceed? (i) Ninety days for applicants who apply for Medicaid on the basis of disability; and (ii) Forty-five days for all other applicants. 42 C.F.R. Section 435.914, Case documentation, pertaining to the Medicaid Cluster states in part: (a) The agency must include in each applicant's case record facts to support the agency's decision on his application. 42 C.F.R. Section 435.916, Periodic renewal of Medicaid eligibility, states in part: (a) Renewal of individuals whose Medicaid eligibility is based on modified adjusted gross income methods (MAGI). (1) Except as provided in paragraph (d) of this section, the eligibility of Medicaid beneficiaries whose financial eligibility is determined using MAGI-based income must be renewed once every 12 months, and no more frequently than once every 12 months. (b) Redetermination of individuals whose Medicaid eligibility is determined on a basis other than modified adjusted gross income. The agency must redetermine the eligibility of Medicaid beneficiaries excepted from modified adjusted gross income . . . for circumstances that may change, at least every 12 months. 42 U.S.C. Section1397bb (b), pertaining to the Children?s Health Insurance Program (CHIP) states, in part: (1) Eligibility Standards (A) The plan shall include a description of the standards used to determine the eligibility of targeted low-income children for child health assistance under the plan. 42 C.F.R. Section 457.343, Periodic renewal of CHIP eligibility, states in part: The renewal procedures described in 435.916 of this chapter apply equally to the State in administering a separate CHIP. . . The Medicaid and CHIP State Plan outlines the specific eligibility conditions and standards within Sections 2.2 ? Coverage and Conditions of Eligibility and 2.6 A ? Financial Eligibility, Eligibility Conditions and Requirements for Medicaid and Section 4 ? Eligibility Standards and Methodology for CHIP. It is management?s responsibility to implement policies and procedures to provide reasonable assurance they have complied with these requirements. As the lead agency responsible for administering the CHIP and Medicaid federal grant awards for the State of Ohio, the Department is responsible for providing reasonable assurance only eligible individuals receive assistance and documentation maintained is accurate, complete, and properly recorded in the Ohio Benefits system to ensure appropriate eligibility determinations. It is also the Department?s responsibility to implement sufficient controls, systems, processes, and procedures to reasonably ensure compliance with the rules and regulations associated with these programs and only eligible recipients receive benefits. The Department is responsible for overall program compliance and must have appropriate oversight and monitoring procedures in place to ensure those they rely on are operating in accordance with all expectations, guidelines, and requirements related to their tasks. During state fiscal year (SFY) 2020, the Department disbursed a combined total of $24.2 billion in public assistance payments, to recipients processed through the Ohio Benefits system related to the following programs: See Schedule of Findings and Questioned Costs for chart/table. The information below summarizes Finding 2020-001 as it relates to the control process and weaknesses identified related to eligibility for the Medicaid Cluster. These issues also apply to CHIP and additional information was added, where necessary, to identify errors related to CHIP. These programs are administered using a multi-agency approach, as follows: overall compliance and administration of CHIP and the Medicaid Cluster fall under the Department, and programming and administration of the State?s eligibility determination computer system, Ohio Benefits, falls under the Ohio Department of Administrative Services (DAS). The Department also, through a Memorandum of Understanding with the Ohio Department of Job & Family Services (ODJFS), utilizes the 88 Ohio counties in the eligibility determination process to work with applicants, receive/enter eligibility documentation into the Ohio Benefits system, and follow up on alerts issued by the system. SYSTEM/CONTROL ISSUES Currently, individuals applying to receive public assistance benefits complete an application through various methods. The County Departments of Job & Family Services (CDJFS) offices collect and maintain any documentation provided by the individual either in a paper case file or in the OnBase Enterprise Documentation Management System (EDMS) maintained under contract by DAS. After collecting documentation, the county caseworker enters the individual?s information into the Ohio Benefits system which determines the initial eligibility benefit amount and assigns the benefit aid category. This process is also used to perform eligibility redeterminations on an annual basis or when prompted through a system alert. Additionally, one of several factors in determining eligibility for the Money Follows the Person federal program, although not being tested as a major program in SFY20, is based upon the recipient?s eligibility for the Medicaid Cluster program. Once the determination is made, the Ohio Benefits system uploads the eligibility information to the Department?s payment system, Medicaid Information Technology System (MITS), to process the payment. During SFY 2020, we noted several weaknesses/defects in the eligibility process, as listed below: ? Alerts ? During SFY 2020, an overwhelming volume of alerts were sent to the counties for investigation and follow-up (more than 17.2 million alerts were issued according to DAS records; 11.2 million related to Income Eligibility Verification Systems (IEVS) alerts and 6 million to non-IEVS alerts). This resulted in an unmanageable workload and ineffective application of the alert process. The Department did obtain approval from the federal awarding agency to suspend the requirement for caseworkers to process negative alerts between March 1, 2020 and May 28, 2020 for the Medicaid/CHIP programs due to the COVID-19 pandemic. Although we were not able to define the full impact of this waiver since the number of negative alerts not processed could not be separately identified, only 1.2 million alerts were generated during the waiver timeframe. ? Overwriting ? the Ohio Benefits system maintains several pieces of key information related to a recipient?s eligibility (income, household size, age, etc.). If new or updated information is identified, the county caseworker is expected to add this information to the system. Based on our testing, in some cases, the caseworker is replacing/overwriting the existing information with new information instead of adding this new data to the case record. However, there is no system warning or other control in place to identify or prevent this overwrite. ? Caseworker Reliance/Training ? The current process relies heavily on the knowledge and judgement of county caseworkers in the eligibility process. Although on-line job aids are made available and various trainings are provided by the state agencies for these caseworkers, this training is typically optional and/or attended by a representative of the county who is expected to relay the information to others. ? Multi-program Info ? There are certain pieces of key information (i.e. name, income, age, etc.) maintained in the Ohio Benefits system which impact all public assistance programs, including SNAP, TANF, Medicaid, and CHIP. However, due in part to the complexities/variations of the requirements for each federal program, the system currently does not link this information between programs. Therefore, the county caseworker must manually adjust each affected program separately when a change occurs. ? System Design Weaknesses/Defects ? Our testing and inquiry with both State and county personnel identified the following system design weaknesses or defects in the Ohio Benefits system: ? Alerts: ? Multiple and repetitive alerts (redundancy). ? Irrelevant alerts (zero or small dollar amounts). ? Additional steps required to complete an alert (having to leave the alert window, opening an Ohio Benefits window, and then having to go back through the Alert Inventory to clear the alert). ? Alerts being received on persons not receiving public assistance. ? For three of 80 (3.8%) Medicaid recipients and five of 80 (6.3%) CHIP recipients selected for testing, a systemic issue within Ohio Benefits that either impacted the eligibility process and/or eligibility determination for the recipient existed. ? Of the three Medicaid cases: - One prevented the renewal packet from being sent to the client, requiring the caseworker to perform additional procedures to properly set the renewal span. - One incorrectly classified household members as fringe members, excluding them from the eligibility determination. - One incorrectly excluded household members for dependent non-filer members and included individuals permanently out of the home in the eligibility determination. ? Of the five CHIP cases: ? Three required additional caseworker procedures to be performed to properly complete parts of the eligibility process. Additionally, one of the cases had a system display issue in which the wrong income threshold was shown in the system; however, the recipient was placed in the correct aid category. ? One was a result of there being no system control in place to prevent or identify a recipient that was marked as ineligible in Ohio Benefits but that ineligible designation did not transfer to MITS. In this instance, MITS still allowed capitation payments to be made on the behalf of the individual since 2016. ? One allowed a caseworker to perform an override that is normally processed via a batch process and allowed Transitional Medicaid for the individual to remain active longer than the allowable 12 months. We noted several weaknesses/issues regarding the contract and monitoring related to the Ohio Benefits system in Finding Number 2020-004 for the Department of Administrative Services. These issues, which impact the Department?s responsibilities regarding monitoring, updates, and program compliance, are summarized below: ? The signed agreements/amendments did not separately require signatures from the Ohio Department of Medicaid and the Ohio Department of Job and Family Services was not included on amendments. ? Signed interagency agreements defining each agency?s responsibilities and the data governance structure have not been completed. ? No evidence of monitoring procedures related to the Independent Verification and Validation (IV&V) reports prepared by a third-party evaluator. ? No formalized documentation/tracking of reviews/evaluations/certifications performed or required for the Ohio Benefits system by outside or internal reviewers. NONCOMPLIANCE ISSUES The following noncompliance was noted related to eligibility for the Medicaid and CHIP programs: ? Six of 80 (7.5%) Medicaid recipients and 16 of 80 (20%) CHIP recipients selected for testing were not eligible to receive benefits on the date services were performed. Since Ohio Benefits is the State?s official eligibility determination system, these items will result in questioned costs for all claims paid for services provided for these individuals during the time they were ineligible, totaling $109,391 for Medicaid and $67,533 for CHIP. The items noted included issues such as: o The recipient failed to timely report an increase in income and/or new employment. o The household size was incorrectly determined. o The recipient was covered by other health insurance. o The recipient was over the age required for eligibility for the federal program. o The recipient exceeded the eligibility period for Transitional Medicaid (see ?System Design Weaknesses/Defects? above). o The recipient was awarded `ineligible? status in Ohio Benefits which did not result in a transition to MITS to end Medicaid eligibility (see ?System Design Weaknesses/Defects? above). ? 14 of 80 (17.5%) Medicaid recipients and 35 of 80 (43.8%) CHIP recipients selected for testing were not placed in the correct benefit aid category. Six of the 14 Medicaid individuals and 16 of the 35 CHIP individuals are included in the preceding bullet as being deemed ineligible. For the other eight Medicaid recipients, although their age and/or income deemed them to be in the incorrect benefit aid category, they were qualified to be placed in another benefit aid category; therefore, the eligibility of the recipient was not questioned. The revised benefit aid category did not affect the Federal Medical Assistance Percentage (FMAP) used to draw down funds from the federal government for the recipient. For the other 19 CHIP recipients, their age and/or income deemed them to be in the incorrect benefit aid category and ineligible for the CHIP program; however, they were qualified to be placed in a Medicaid benefit aid category. Since Ohio Benefits is the State?s official eligibility determination system, these items will result in questioned costs for all claims paid under the CHIP program for services provided for these individuals during the time they were ineligible, totaling $61,775. ? 25 of 80 (31.3%) Medicaid recipient cases and 42 of 80 (52.5%) CHIP recipient cases selected for testing either did not contain adequate documentation to support the Department?s decision on the recipient?s eligibility or incorrect recipient information was entered into Ohio Benefits. However, based on additional information we obtained from other sources, the recipient was still eligible. The items noted generally related to the following documentation categories: o Income verification and documentation o Household size o Tax filing status o Resource verification and documentation o Caseworker processing error o Social Security Number verification and documentation ? Three of 80 (3.8%) Medicaid recipient cases and eight of 80 (10%) CHIP recipient cases selected for testing had an untimely eligibility redetermination. Two of the Medicaid redeterminations were 49 and 204 days beyond the allowed 45 day processing period. One Medicaid redetermination was due in May 2020, but had not been completed as of when testing was completed in November 2020. It was also noted eligibility redeterminations were suspended as of March 21, 2020, due to the pandemic, as identified in the Alerts section above. The CHIP redeterminations ranged from 10 to 137 days beyond the allowed 45 day processing period, with an average of 78 days late. ? One of 13 (7.7%) new Medicaid recipients selected for testing that were not applying based on a disability, had an untimely initial eligibility determination. The determination was completed 52 days beyond the allowed 45 day processing period. Without proper controls for entering, processing, and maintaining recipient information and system alerts, there is an increased risk that benefits paid to or on behalf of recipients will be inaccurate or unallowable. This risk is substantially increased if the State?s eligibility determination system, Ohio Benefits, contains design or operational flaws that could impact a recipient?s eligibility and, as a result, could have a material impact on the amounts reimbursed by the federal government. These weaknesses/defects could allow undue subjective decisions, jeopardize accurate eligibility processing, and/or result in improper payments or federal reimbursements. Furthermore, without an effective process in place to ensure eligibility is being redetermined timely when required, the risk is also increased that a recipient?s benefit amount or aid category has changed or they are ineligible to receive benefits. Additionally, not processing new applications on a timely basis could cause undue harm to an individual that needs health services. Overpayments or payments to or on behalf of ineligible recipients may subject the Department to penalties or sanctions which may jeopardize future funding and limit its ability to fulfill program requirements to provide benefits to those in need. Based on discussions with management, human error and systemic issues led to the issues identified. Management also indicated they have been and are continuing to make corrections and enhancements to the Ohio Benefits system to address the weaknesses and defects identified in the previous and current audit findings. RECOMMENDATIONS We recommend the Department evaluate and seek reimbursement for all claims that were incorrectly paid. We also recommend management continue to work collectively with the related state agencies to implement/update robust processes, procedures, and system programming to address the weaknesses in the overall eligibility process, including those associated with the Ohio Benefits system. These changes/updates should include, but not be limited to: ? Redesigning the alert process to be more effective and efficient. This could include a more centralized evaluation of alert activity and/or better use of automated tools to vet and prioritize items requiring follow-up. This would allow Department level personnel to become more experienced and adept at identifying and investigating anomalies and help focus the resources of both Department and county personnel. ? Implementing program changes to address the system design weaknesses/defects identified above, including the issues with overwriting data and making all data stored in the system available/viewable by users. Program changes which could directly impact the eligibility determinations or benefit amounts should be given the highest priority to ensure they are corrected in a timely manner to prevent and detect further improper payments. ? Implementing program logic to ensure changes made to recipient information for one public assistance program are carried through in Ohio Benefits to other applicable public assistance programs for that recipient without caseworker initiation. ? Requiring mandatory training for all CDJFS employees who are entering the assistance group information into Ohio Benefits to help ensure proper and complete information is being collected, entered, and verified prior to an individual?s eligibility determination being made. An initial training should be provided to ensure all users are knowledgeable of the process, procedures, and impact of the work they do. As changes occur to the rules/regulations, system, or process, detailed training should be required of all users on those changes. ? Regularly evaluating selected benefit payments for all programs to verify the recipient?s eligibility, verify the recipient information entered into Ohio Benefits by the CDJFS is accurate and the information is being maintained to support the State?s eligibility decision, and ensure initial eligibility determinations and redeterminations are completed timely. Any problems noted should be promptly corrected to reduce the risk of benefit payments being made to or on behalf of ineligible individuals and additional training provided to the State and/or county employees affected. ? Ensuring that vendor contracts/amendments, and interagency agreements are formalized, contain all parties of the agreements, and fully and clearly define the roles, responsibilities, and expectations related to each party. ? Ensuring that appropriate and coordinated monitoring and tracking procedures are in place regarding reviews and the timely remediation of issues identified, including, but not limited to: o A data governance structure designed to ensure data quality and reliability for management, the grantor agencies, and other users of this information. This should include data subject matter experts from each related agency to help ensure quality of data requests before external and internal users rely on the data, issues are addressed with a clear escalation path, and establishing accountabilities and alignment between the related agencies. o Reviewing and monitoring the IV&V reports prepared by the third party evaluator and to prioritize and develop a remediation plan, along with DAS and ODJFS, to help track and ensure necessary changes to the Ohio Benefits application are completed accurately and timely, and the system is operating as intended. o Coordinating and managing the contract contents with the developing vendor to help ensure all contract and amendment deliverables are being met. o Ensuring documentation related to all internal and external evaluations and assessments of the Ohio Benefits eligibility environment be tracked, monitored, and maintained to ensure all appropriate monitoring and remediation efforts are completed timely and in compliance with standards.

MEDICAID/CHIP ? IEVS MONITORING Finding Number: 2020-030 State Agency Number: MCD-03 CFDA Number and Title: 93.767 ? Children?s Health Insurance Program (CHIP) 93.775/93.777/93.778 ? Medicaid Cluster Federal Award Identification Number / Year: 1905OH5021 / 2019 (CHIP) 2005OH5021 / 2020 (CHIP) 1905OH5MAP / 2019 (Medicaid) 2005OH5MAP / 2020 (Medicaid) Federal Agency: Department of Health and Human Services Compliance Requirement: Eligibility Repeat Finding from Prior Audit? Yes Prior Audit Finding Number: 2019-023 NONCOMPLIANCE AND MATERIAL WEAKNESS NOTE: Finding numbers 2020-001, 2020-004, and 2020-029 contain additional information which is integral to and should be read in conjunction with this finding. 42 C.F.R. Section 435.945 states, in part, the following regarding the Medicaid Cluster program: (a) Except where the law requires other procedures . . . the agency may accept attestation of information needed to determine the eligibility of an individual for Medicaid . . . without requiring further information (including documentation) from the individual. (b) The agency must request and use information relevant to verifying an individual's eligibility for Medicaid in accordance with ? 435.948 through 435.956 . . . 42 C.F.R. Section 457.380, states, in part, the following regarding the Children?s Health Insurance Program (CHIP): (a) General requirements. Except where law requires other procedures . . . the State may accept attestation of information needed to determine the eligibility of an individual for CHIP. . . without requiring further information (including documentation) from the individual. (b) Status as a citizen, national or a non-citizen. (1) Except for newborns identified in ? 435.406(a)(1)(iii)(E) of this chapter, who are exempt from any requirement to verify citizenship, the agency must? . . . (ii) Provide a reasonable opportunity period to verify such status in accordance with ? 435.956(a)(5) and (b) of this chapter and provide benefits during such reasonable opportunity period to individuals determined to be otherwise eligible for CHIP. Furthermore, 42 U.S.C. Section 1320b?7(a) Requirements of State eligibility systems states, in part: In order to meet the requirements of this section, a State must have in effect an income and eligibility verification system which meets the requirements of subsection (d) and under which? (1) the State shall require, as a condition of eligibility for benefits under any program listed in subsection (b), that each applicant for or recipient of benefits under that program furnish to the State his social security account number (or numbers, if he has more than one such number), and the State shall utilize such account numbers in the administration of that program so as to enable the association of the records pertaining to the applicant or recipient with his account number; (2) wage information from agencies administering State unemployment compensation laws available pursuant to section 3304(a)(16) of the Internal Revenue Code of 1986, wage information reported pursuant to paragraph (3) of this subsection, and wage, income, and other information from the Social Security Administration and the Internal Revenue Service available pursuant to section 6103(l)(7) of such Code, shall be requested and utilized to the extent that such information may be useful in verifying eligibility for, and the amount of, benefits available under any program listed in subsection (b), as determined by the Secretary of Health and Human Services . . . . . . (4) the State agencies administering the programs . . . adhere to standardized formats and procedures . . . under which ? (A) the agencies will exchange with each other information in their possession which may be of use in establishing or verifying eligibility or benefit amounts under any other such program . . . (C) the use of such information shall be targeted to those uses which are most likely to be productive in identifying and preventing ineligibility and incorrect payments. . . In order to comply with 42 C.F.R. Section 435.945 and 42 U.S.C. Section 1320b-7, the State of Ohio codified specific rules related to its Income Eligibility Verification System (IEVS) in the Ohio Administrative Code (OAC). OAC Section 5160:1-1-04 states, in part: (A) This rule describes the requirements in section 1137 of the Social Security Act and in section 42 C.F.R. 435.945. . ., requiring state agencies administering certain federally funded, state administered public assistance programs, to establish procedures for obtaining, using and verifying information relevant to determinations of eligibility. The Ohio Department of Medicaid shall obtain and share income and benefit information with the following sources: (1) The social security administration (SSA). (2) The internal revenue service (IRS). (3) The state wage information collection agency (SWICA). (4) The agencies administering the State unemployment compensation (UC) laws. . . . (C) Administrative agency responsibilities. The administrative agency shall: . . . (3) Within forty-five days of receipt of the information, review and compare against the case record all information received to determine whether it affects the individual's eligibility. Obtain verification, if appropriate, to determine eligibility and initiate appropriate action in accordance with 42 C.F.R. 435.952(c). . . For applicants, if the information is received during the application period, it must be used to the extent possible to make eligibility determinations, in accordance with 42 C.F.R. 435.952(b) . . . (4) Verify the information, in accordance with 42 C.F.R. 435.948 . . . and 42 C.F.R. 435.949? It is management?s responsibility to implement controls, processes, and procedures to ensure compliance with these regulations. When automated systems are utilized to perform certain functions related to this compliance, management must ensure the system is properly designed and operating effectively. During state fiscal year (SFY) 2020, the Department disbursed approximately $23.7 billion and $536.4 million on behalf of recipients who were determined eligible for the Medicaid Cluster and CHIP programs, respectively. The Ohio Benefits (OB) system, administered by the Ohio Department of Administrative Services, determines eligibility for the Medicaid Cluster and CHIP programs. Additionally, one of several factors in determining eligibility for the Money Follows the Person federal program, although not being tested as a major program in SFY20, is based upon the recipient?s eligibility for the Medicaid Cluster program. The OB system also includes the IEVS functionality which compares reported recipient income to income information maintained by outside data sources (i.e. SSA, IRS, etc.). Income information that does not agree to the OB amount is communicated as an IEVS alert and forwarded to the appropriate county for investigation and resolution. Each alert has a defined due date, which is unique based on the priority level and other policy and process related factors. System design weaknesses and defects identified within Ohio Benefits caused a large increase in alerts, creating an overwhelming volume of information being sent to the counties and resulting in an unmanageable workload and ineffective application of the alert process. In addition, the Department relies heavily on the Ohio Department of Job and Family Services to coordinate with and provide training to the counties. See finding 2020-004 for more detailed information regarding the OB weaknesses and defects, as well as the training control weaknesses. The Department?s Medicaid Eligibility Quality Control (MEQC) unit began monitoring the status of IEVS alerts in March 2019 within its standard recipient case reviews. However, the MEQC reviews did not document if alerts were cleared timely, only if they were complete or incomplete and no reports were sent to the counties to communicate the review results. No other monitoring was performed by the Department over IEVS alerts during the audit period. Therefore, it appears the Department did not have sufficient or effective controls or procedures in place to review and monitor the IEVS alerts generated and processed by the Ohio Benefits system during SFY 2020 to ensure they were being completed by the counties in accordance with the requirements and timeframes established in 42 C.F.R. Section 435.945, 42 U.S.C Section 1320b-7, and OAC Section 5160:1-1-04. Furthermore, an OB report showed 4,012,153 of the 6,940,980 (57.8%) IEVS alerts sent to the counties during the audit period were not cleared within 45 days as required. The alerts were cleared between one and 466 days beyond the 45-day requirement, with an average of 234 days late. The Department did obtain approval from the federal awarding agency to suspend the requirement for caseworkers to process negative alerts between March 1, 2020 and May 28, 2020 for the Medicaid/CHIP programs due to the COVID-19 pandemic. Although we were not able to define the full impact of this waiver since the number of negative alerts not processed could not be separately identified, only 1.2 million alerts were generated during the waiver timeframe. A lack of monitoring and ensuring IEVS alerts are completed accurately and timely increases the risk that benefits could be calculated and paid for inappropriate amounts or paid on behalf of ineligible recipients. This could adversely affect the Department?s ability to comply with requirements of these federal programs which could result in federal sanctions or penalties. Based on discussions with management, the time necessary to develop and test system enhancements and the workload increase due to the COVID-19 pandemic caused a delay in the roll-out of system enhancements and making updates to and distributing the training curriculum to the appropriate personnel. We recommend the Department continue to work collectively with the related state agencies to implement/update robust processes, procedures, and system controls to address the weaknesses associated with the IEVS process within the Ohio Benefits system. These changes/updates should include, but not be limited to: ? Designing and implementing appropriate and effective control procedures for monitoring IEVS alerts generated and processed in the Ohio Benefits system to help ensure the counties are completing them properly and timely. These monitoring procedures should be performed frequently, include appropriate follow up with the counties if alerts are not being completed properly and timely, and be documented in some manner. Management should periodically review this documentation to ensure the control procedures are being performed timely and as intended. ? Including a more centralized evaluation of alert activity and/or better use of automated tools to vet and prioritize items requiring follow-up at the county level. This would allow Department level personnel to become more experienced and adept at identifying and investigating anomalies and help focus the resources of both Department and county personnel. ? Monitoring the IEVS alert processing procedures guide for the alerts issued by the Ohio Benefits system to ensure alerts are properly documented within the system, worked within the proper timeframes, and proper verification documentation is obtained and maintained by the counties for resolved alerts. ? Determining if the IEVS training for county caseworkers is working as intended to ensure they have the knowledge to properly document and resolve IEVS alerts generated by the Ohio Benefits system. We also recommend the Department monitor the status of system enhancements and roll-out of resources to the appropriate personnel to ensure they are implemented timely and as planned.

MEDICAID/CHIP ? MANAGED CARE/MYCARE OHIO ? PROVIDER PANEL REPORTS Finding Number: 2020-031 State Agency Number: MCD-04 CFDA Number and Title: 93.767 ? Children?s Health Insurance Program (CHIP) 93.775/93.777/93.778 ? Medicaid Cluster Federal Award Identification Number / Year: 1905OH5021 / 2019 (CHIP) 2005OH5021 / 2020 (CHIP) 1905OH5MAP / 2019 (Medicaid) 2005OH5MAP / 2020 (Medicaid) Federal Agency: Department of Health and Human Services Compliance Requirements: Activities Allowed or Unallowed, Allowable Costs/Cost Principles Repeat Finding from Prior Audit? Yes Prior Audit Finding Number: 2019-026 NONCOMPLIANCE AND MATERIAL WEAKNESS 42 C.F.R. Section 438.206 states, in part, the following regarding availability of services for Managed Care Organizations (MCOs), Prepaid Inpatient Health Plans (PIHPs), and Prepaid Ambulatory Health Plans (PAHPs): (a) Basic rule. Each State must ensure that all services covered under the State plan are available and accessible to enrollees of MCOs, PIHPs, and PAHPs in a timely manner? (b) Delivery network. The State must ensure, through its contracts, that each MCO, PIHP and PAHP, consistent with the scope of its contracted services, meets the following requirements: (1) Maintains and monitors a network of appropriate providers that is supported by written agreements and is sufficient to provide adequate access to all services covered under the contract for all enrollees... Additionally, Ohio Admin. Code (OAC) Section 5160-26-10 states, in part: (A) If a MCO fails to fulfill its duties and obligations under 42 C.F.R. Part 438 ... or the MCO provider agreement, ODM [Ohio Department of Medicaid] will provide timely written notification to the MCO identifying the violations or deficiencies, and may impose corrective actions or sanctions through the provider agreement, or corrective actions or any of the following sanctions in addition to or instead of any actions or sanctions specified in the provider agreement: ? (2) Sanctions that may be imposed on MCOs by ODM include but are not limited to the following: ? (g) Imposition of financial sanctions. ? Furthermore, OAC Section 5160-58-01.1 states MyCare Ohio plans must comply with all of the requirements applicable to managed care plans in the following rules:?(7) Rule 5160-26-10 of the Administrative Code. It is management?s responsibility to maintain internal control procedures to provide reasonable assurance the Managed Care Plans and MyCare Ohio Plans (the Plans) are in compliance with the requirements outlined in the agreements. It is also management?s responsibility to ensure the Plans maintain adequate provider access for Medicaid and CHIP recipients, as well as ensure any noncompliance by the Plans is promptly addressed and sanctions are imposed by the Department when necessary. During state fiscal year (SFY) 2020, the Department disbursed approximately $17.9 billion in Medicaid Cluster and CHIP capitation payments to the Plans which administer the managed care program throughout the state. The Department enters into a new contract with the Plans at the beginning of each state fiscal year and amends the agreement each January to outline the responsibilities of the Department and the Plans. The agreement requires the Plans to provide or arrange for the delivery of all medically necessary, Medicaid-covered health services, as well as ensure compliance with federally defined provider panel access standards, as outlined in the agreement and as required by 42 C.F.R. Section 438.206. The agreement also specifies the minimum number of providers or the maximum distance recipients can be required to travel for each provider type in each county or region of the state that each Plan must maintain. Additionally, the agreement states the Department may assess a $1,000 nonrefundable financial sanction, at least quarterly, for any deficiencies in the Plan?s provider network for each category, for each county. The Managed Care Provider Network (MCPN) developed by Automated Health Systems, the Managed Care Enrollment Contractor, is a database used to track the Plans? provider networks. After the Plan agreements are signed, the MCPN database is updated with the provider requirements by type per the agreement. Prior to subcontracting with a Plan, each provider must enroll with the Department and is then entered into the MCPN database. Quarterly, the Department generates two Provider Panel Reports from the MCPN database, one for the Managed Care Plans and one for MyCare Ohio Plans, which show the number of providers for each provider type by county and/or region, and utilizes them to determine if the Plans are compliant with the requirements outlined in the agreements. If deficient, a non-compliance notice is sent to the Plan which identifies any fine assessed. Beginning with the January 2020 Managed Care Plan Amended Agreement, the Department implemented a new system requiring the Plans to contract with a provider within a maximum time and distance for the average recipient for 19 provider types. The agreement specified a Plan would not be sanctioned for time and distance standards unless the requirements were not met for two consecutive quarters. The Department utilized a Geo Mapping software system to determine if the time and distance requirements were met for the transitioned provider types for the remaining two quarters of SFY 2020. The remaining Managed Care provider types and MyCare Ohio plans continued to be evaluated with the minimum provider requirements. However, the controls were not operating effectively as evidenced by the following: ? Two of six (33.3%) Provider Panel Reports selected for testing indicated the minimum panel requirement was not met and a noncompliance citation was not issued. Within the reports, there were 10 instances in which the Plan did not meet the minimum panel requirements and a noncompliance citation was not issued. Additionally, for one report, certain provider types/categories were not monitored by the Department for time and distance requirements, resulting in 264 instances where it could not be determined if the minimum panel requirement was met. However, in the previous quarter, only 5 instances of time and distance noncompliance were noted; therefore, five is the maximum number of potential sanctions that could have been issued. The above issues could have resulted in a possible $1,000 nonrefundable sanction for each instance, totaling $15,000. ? Two of six (33.3%) Provider Panel Reports selected for testing included information that did not match the requirements listed in the agreements. Within the reports, there were 271 instances (includes the 264 instances noted above) in which no monitoring took place and the minimum requirement on the Provider Panel Report did not agree to the requirements listed in the Plan?s provider agreement. Of the remaining 7 instances, none resulted in the minimum panel requirement not being met so no noncompliance citation was deemed necessary. Without maintaining proper controls to ensure the reporting system is updated when panel standards are modified or added in the Plan agreements or to ensure the provider tables included within the Plan agreements are complete and accurate, there is an increased risk of noncompliance by the Plans that could go undetected or not be detected timely. If a Plan is not meeting the requirements of its agreement, then the population it serves could be in danger of not receiving adequate medical services in their area as required by federal regulations and program rules. Additionally, without proper notice being sent to noncompliant Plans, they may not be able to implement corrective action in a timely manner. Furthermore, by not assessing fines in accordance with the agreement, the Department risks the Plans not making compliance, and timely corrective actions, a priority. Based on discussions with management, the issues were due to clerical and oversight errors and system issues, including the inability to update the MCPN database in time for quarterly reporting. We recommend the Department review its internal control process and ensure procedures are implemented to regularly evaluate the reporting system to ensure it is updated to agree to Plan standards, including any new requirements, mandated in the Plan agreements. Additionally, the Department should reinforce its current process of reviewing the Plan agreements to ensure the provider tables provided within them are complete and accurate. Any problems noted should be promptly corrected to reduce the risk of a Plan not being in compliance with the agreement. The monitoring procedures performed should be documented to provide assurance they are performed consistently and as management intended. Additionally, these procedures should be updated on a regular basis to address any necessary changes in the contract requirements.

IT ? NCCI IMPLEMENTATION AND MONITORING Finding Number: 2020-032 State Agency Number: MCD-05 CFDA Number and Title: 93.767 ? Children?s Health Insurance Program (CHIP) 93.775/93.777/93.778 ? Medicaid Cluster Federal Award Identification Number/Year: 1905OH5021 / 2019 (CHIP) 2005OH5021 / 2020 (CHIP) 1905OH5MAP / 2019 (Medicaid) 2005OH5MAP / 2020 (Medicaid) Federal Agency: Department of Health and Human Services Compliance Requirement: Special Tests and Provisions - Medicaid National Correct Coding Initiative (NCCI) Repeat Finding from Prior Audit? No NONCOMPLIANCE AND MATERIAL WEAKNESS The Center for Medicare & Medicaid Services (CMS) National Correct Coding Initiative (NCCI) promotes national correct coding methodologies and reduces improper coding which may result in inappropriate payments of Medicare Part B claims and Medicaid claims. The coding policies are based on coding conventions defined in the American Medical Association's (AMA) Current Procedural Terminology (CPT) Manual, national Medicare policies, coding guidelines developed by national societies, standard medical and surgical practice, and current coding practice. Effective October 1, 2010, CMS incorporated five initial NCCI methodologies into the state Medicaid programs pursuant to the requirements of Section 6507, Mandatory State Use of NCCI, of the Patient Protection and Affordable Care Act (P.L. 111-148), as amended by the Health Care and Education Recovery Act of 2010 (P.L. 111-152), together referred to as the Affordable Care Act, which amended section 1903(r) of the Social Security Act. CMS has adopted the contents of the NCCI Policy Manual for Medicare Services with minor modifications for state Medicaid programs. Effective in October 2012, CMS implemented a sixth Medicaid NCCI methodology. As such, States are required to implement the six Medicaid NCCI methodologies stated below: 1. NCCI procedure-to procedure (PTP) edits for practitioner and ambulatory surgical center (ASC) claims; 2. NCCI PTP edits for outpatient hospital services including emergency department, observation care, and outpatient hospital laboratory services; 3. Medically Unlikely Edit (MUE) units of service (UOS) edits for practitioner and ASC services; 4. MUE UOS edits for outpatient hospital services including emergency department, observation care, and outpatient hospital laboratory services; 5. MUE UOS edits for durable medical equipment (DME) billed by providers; and, 6. NCCI PTP edits for DME. It is management?s responsibility to implement controls and procedures to comply with these regulations. When automated systems are utilized to perform certain functions related to this compliance, management must ensure the system is properly designed and operating effectively. Additionally, when the system is not directly administered by the entity, such as when utilizing a vendor, appropriate monitoring controls must be designed and implemented to reasonably ensure all tasks and controls performed by the vendor on behalf of the entity comply with applicable laws and regulations. During state fiscal year 2020, the Department disbursed approximately $6.2 billion for Medicaid and $31.2 million for Children?s Health Insurance Program (CHIP) related to fee-for-services claims. The Department administers the Medicaid Information Technology System (MITS), which is an automated application to determine if the services provided to eligible recipients were by an eligible provider and allowable prior to payment. The MITS vendor is responsible for the administration of NCCI for the Department, including obtaining the quarterly documentation from CMS used for implementation of the methodologies. Each quarter, the MITS vendor obtains and shares the NCCI files with the Department management for their review. After the review is complete, the MITS vendor tests the configuration of the files for correctness. Once the MITS vendor?s testing is satisfactory to Department management, they approve the files to be implemented in MITS. However, this process did not identify that the sixth Medicaid NCCI methodology, requiring PTP edits for DME into MITS, was not implemented. In addition, the Department has not implemented monitoring controls over the NCCI quarterly implementation process to ensure all methodologies were completely and correctly implemented. Without adequate monitoring controls over the implementation of NCCI, management cannot be reasonably assured the NCCI compliance requirement is being met. In addition, without PTP edits in place for DME, improper payments of DME services could occur. Based on discussions with the Department and MITS vendor management, PTP edits for DME were not implemented in MITS due to an oversight. We recommend the Department implement monitoring controls over the quarterly implementation process of all NCCI edits to help ensure all information is submitted accurately, completely, and timely, as required. In addition, the Department should implement PTP edits for DME claims to ensure that all NCCI compliance requirements are met and only proper payments are reimbursed.

OPIOID STR ? ELIGIBILITY Finding Number: 2020-033 State Agency Number: MHA-01 CFDA Number and Title: 93.788 ? Opioid STR Federal Award Identification Number / Year: H79TI080261 / 2018 (CURES) H79T1081684 / 2019 (SOR) H79TI081684 / 2020 (SOR) Federal Agency: Department of Health and Human Services Compliance Requirements: Activities Allowed or Unallowed, Allowable Costs/Cost Principles, Eligibility Repeat Finding from Prior Audit? No QUESTIONED COSTS, NONCOMPLIANCE, AND MATERIAL WEAKNESS $157,333 The Substance Abuse and Mental Health Services Administration (SAMHSA) promulgated the Funding Opportunity Announcement (FOA) No. TI-18-015 to seek applicants for the Opioid STR federal program. Page 68 of the FOA states ?Sub-recipient means a non-Federal entity that receives a sub-award from a pass-through entity to carry out part of a Federal award, including a portion of the scope of work or objectives. Grant recipients are responsible for ensuring that all sub-recipients comply with the terms and conditions of the award, per 45 CFR ?75.101.? This provision indicates that 45 C.F.R Section 75.202 applies to all grant agreements, including subawards. 45 C.F.R Section 75.202(b) requires the federal awarding agency must provide certain information about the federal award and states, in part: (5) General Eligibility Requirements: The statutory, regulatory or other eligibility factors or considerations that determine the applicant's qualification for Federal awards under the program (e.g., type of non-Federal entity); . . . It is management?s responsibility to implement control policies and procedures to reasonably ensure only entities that meet specific eligibility requirements are approved as a subrecipient and receive funding, in accordance with the program rules and regulations. These controls must be adequately documented to provide assurance the controls are performed timely and consistently and the documentation should be maintained according to an approved retention schedule. During state fiscal year 2020, the Department disbursed approximately $35.3 million in federal funding for the Opioid STR program, which includes the Ohio Opioid STR Project (CURE) and State Opioid Response Project (SOR) grants, to 191 subrecipients. The Department issued various Requests for Applications (RFA), geared toward specific services or types of entity applicants, which defined specific eligibility requirements and a set of scoring criteria. Once an entity submitted an application in response to an RFA, the Department graded it using a scoring sheet to determine the applicant?s eligibility as a subrecipient. However, for three of 22 (13.6 %) subawards tested, totaling $217,088, the Department could not provide the scoring sheets to evidence its determination of the subrecipient?s eligibility. As a result, we could not determine these subrecipients were eligible for the Opioid STR program and will question the costs for all payments made to them during the audit period, totaling $157,333. By not maintaining appropriate supporting documentation of subrecipient eligibility determinations, management cannot be reasonably assured disbursements are made to only eligible subrecipients. Without proper monitoring by management to ensure control procedures are operating as intended and the documentation of those procedures are maintained, the risk is increased that eligibility determinations are not proper. This could result in a misuse of funds and noncompliance with federal requirements, which could subject the Department to sanctions, other penalties, or having to repay part of the federal grant awards. Based on discussions with management, the documents were missing or they were misfiled. We recommend the Department evaluate its current control processes related to determining subrecipient eligibility and enforce or change them, if needed, to achieve the intended control objectives. Management should stress the importance of completing the required reviews of documents and the conclusions made and maintaining evidence of such. We also recommend the Department establish procedures to periodically monitor its compliance with the related controls and initiate necessary actions to resolve any noncompliance that results. The Department should maintain evidence of such monitoring procedures to provide management with assurance the controls are operating consistently and effectively, and to identify the need for additional training or modification of the existing procedures.

OPIOID STR ? REPORTING Finding Number: 2020-034 State Agency Number: MHA-02 CFDA Number and Title: 93.788 ? Opioid STR Federal Award Identification Number / Year: H79TI080261 / 2018 (CURES) H79T1081684 / 2019 (SOR) H79TI081684 / 2020 (SOR) Federal Agency: Department of Health and Human Services Compliance Requirement: Reporting Repeat Finding from Prior Audit? No NONCOMPLIANCE AND MATERIAL WEAKNESS Part VI.1. (Reporting Requirements) of the Funding Opportunity Announcement (FOA) No. TI-18-015, promulgated by the Substance Abuse and Mental Health Services Administration (SAMHSA) to seek applicants for the Opioid STR federal program, states that ?Progress Reports - recipients will be expected to submit an annual report.? The Notice of Award for the Opioid STR federal program provides additional information on this reporting requirement and states, in part: Annual Performance Progress Report (PPR) The Performance Progress Report (PPR) is required on an annual basis and must be submitted no later than 90 days after the end of the budget period (by December 31, 2019). Note: Recipients must also comply with the GPRA [(Government Performance and Results) Modernization Act of 2010] requirements that include the collection and periodic reporting of performance data as specified in the FOA or by the Grant Program Official (GPO). . . . Additional information on reporting requirements is available at https://www.samhsa.gov/grants/grants-management/reporting-requirements. It is management?s responsibility to implement control policies and procedures to reasonably ensure federal reports are accurate and complete and comply with applicable laws and regulations. Controls must be adequately documented to provide assurance the controls are performed timely and consistently. During state fiscal year (FY) 2020, the Department disbursed approximately $48.7 million in federal funding from the Opioid STR program, which includes the Ohio Opioid STR Project (CURE) and State Opioid Response Project (SOR) grants. The PPR submitted on December 31, 2019 covered the period September 30, 2018 through September 29, 2019 and provided both demographic and financial information of the major activities / accomplishments for the six designated state regions and various statewide projects. The Department gathers data required for the PPR by assembling information from the data submitted by providers through the iPortal GPRA data collection application and monthly project management calls with funded organizations. Once the report is compiled, the Project Director reviews the report for completeness and accuracy before submission to the federal grantor agency. However, the Department?s controls did not detect or prevent errors in the December 31, 2019 PPR. For three of the six regions, the Department (under)/over reported the total Opioid STR program disbursements when compared with the supporting documentation provided by the Department. The variances were $82,783, ($1,158,576), and $2,704,027 and equaled 3.3%, 39%, and 98% of the reported amounts, respectively. In addition, the Department reported amounts from FY 2020 instead of FY 2019 for two of the statewide projects. These variances were $2,000 and $26,519 more than the support and equaled 23.5% and 15.2% of the reported amounts, respectively. If control procedures are not performed properly and consistently, management cannot be reasonably assured the submitted reports were complete and accurate. Without maintaining appropriate support and performing a complete and thorough review of the report before submission, a risk exists that incorrect or inaccurate information could be reported to the federal grantor agency regarding the program?s activity. This could result in noncompliance with federal requirements and subject the Department to sanctions, penalties, or repayment of part of the federal grant award. Based on discussions with management and review of supporting documentation, the condition occurred because the Department could not locate support for all the reported financial data amounts and erroneously used the wrong year?s data for the statewide projects. We recommend the Department evaluate its current controls related to preparing the required PPR and enforce or change them, if needed, to ensure the report is complete and accurate. Management should stress the importance of completing the required reviews of documents and maintaining evidence of the reviews and related support. We also recommend the Department establish procedures to periodically monitor its compliance with the related controls and initiate necessary actions to resolve any noncompliance that results. The Department should maintain evidence of such monitoring procedures to provide management with assurance the controls are operating consistently and effectively, and to identify the need for additional training or modification of the existing procedures.

OPIOID STR ? NON-PAYROLL EXPENDITURES Finding Number: 2020-035 State Agency Number: MHA-03 CFDA Number and Title: 93.788 ? Opioid STR Federal Award Identification Number / Year: H79TI080261 / 2018 (CURES) H79T1081684 / 2019 (SOR) H79TI081684 / 2020 (SOR) Federal Agency: Department of Health and Human Services Compliance Requirements: Activities Allowed or Unallowed, Allowable Costs / Cost Principles Repeat Finding from Prior Audit? No MATERIAL WEAKNESS 45 C.F.R. Part 75 establishes uniform administrative requirements, cost principles, and audit requirements for federal awards to non-federal entities, for federal programs awarded by the Department of Health and Human Services, including the Opioid STR program. Section 75.303 states, in part: The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. . . . It is management?s responsibility to implement control policies and procedures to reasonably ensure that controls are established and working as designed/intended so that expenditure transactions are processed accurately and completely, and comply with applicable laws and regulations. Controls must be adequately documented to provide assurance the controls are performed timely and consistently. During state fiscal year 2020, the Department disbursed approximately $12.4 million in procurement transactions from the Opioid STR program, which includes the Ohio Opioid SR Project (CURE) and State Opioid Response Project (SOR) grants. The Department established controls that require two different employees review and approve these transactions during processing. These controls existed for regular vouchers and Intra-State Transfer Vouchers (ISTV), which consist of disbursements between state agencies. ISTVs are prepared and coded by the receiving agency to initiate a request for disbursement of funds from the paying agency. However, three (all ISTVs) of the 19 (15.8%) disbursements tested were not reviewed and approved by a second employee. In addition, the employees involved did not realize the accounting system did not forward the ISTVs to the second reviewer, as requested by the first reviewer by checking the ?Show to Approver?? box. Instead, the system showed the ISTV was approved and displayed a message ?No approvals are required?. Without proper review and approval of expenditure transactions, a risk exists that procedures may not be working as intended or may not be consistently applied. If control procedures are not performed properly and consistently, management cannot be reasonably assured expenditure transactions are accurate or proper. Based on discussions with management and review of supporting documentation, the condition occurred because the receiving agency incorrectly coded the ISTVs to origin code (299 - DMH Support Services Interface instead of origin code 300 - DMH Central Office), which caused the accounting system to mark the transaction as approved and not forward it to the second reviewer. In addition, the Department?s employees either did not note the different origin code or recognize the significance of it during the first level review. We recommend the Department evaluate its current controls related to program disbursements and enforce or change them, if needed, to achieve the control objectives intended. Management should stress the importance of completing the required reviews of invoices and vouchers for the appropriate codes, including the origin code. We also recommend the Department establish procedures to periodically monitor its compliance with the related controls and initiate necessary actions to resolve any noncompliance that results. The Department should maintain evidence of such monitoring procedures to provide management with assurance the controls are operating consistently and effectively, and to identify the need for additional training or modification of the existing procedures.

SABG ? PAYROLL Finding Number: 2020-036 State Agency Number: MHA-04 CFDA Number and Title: 93.959 ? Block Grants for Prevention and Treatment of Substance Abuse Federal Award Identification Number / Year: B08T1010041-19 / 2019 B08TI83036-01 / 2020 Federal Agency: Department of Health and Human Services Compliance Requirements: Activities Allowed or Unallowed, Allowable Costs/Cost Principles Repeat Finding from Prior Audit? Yes Prior Audit Finding Number: 2019-029 MATERIAL WEAKNESS 45 C.F.R. Part 96 contains the implementing regulations for the Block Grants for Prevention and Treatment of Substance Abuse (SABG) program, as well as general administrative requirements for SABG. Specifically, 45 C.F.R. Section 96.30 (a) contains fiscal and administrative requirements and states, in part: Except where otherwise required by Federal law or regulation, a State shall obligate and expend block grant funds in accordance with the laws and procedures applicable to the obligation and expenditure of its own funds. . . . Ohio Rev. Code Chapter 124 contains laws related to state employment. In addition, the Department implemented Policy HR-14, Central Office Work Schedules, Timekeeping, Overtime and Compensatory Time, and Flexible Scheduling Policy, to expand on parts of Ohio Rev. Code Chapter 124. Sections B.8 and B.9 of this policy state: Timekeeping accountability: It is the duty of every employee of the Department to accurately and truthfully report and receive compensation for hours worked. Additionally, it is the duty of an employee?s direct supervisor to verify that the hours reported reconcile with the employee?s schedule, including approved leave usage. The employee will enter time worked in his/her MHAS timekeeping record. The timekeeping record and any approved compensatory/overtime requests and/or requests for leave will be reviewed by the section timekeeper before final approval of the timekeeping record by the employee's supervisor. It is management?s responsibility to implement control policies and procedures to reasonably ensure payroll transactions are processed accurately and completely; comply with applicable laws and regulations; and, are based on complete and accurate employee timesheets. Controls must be adequately documented to provide assurance the controls are performed timely and consistently. During state fiscal year 2020, the Department disbursed approximately $3.8 million in payroll costs from the SABG program. These payroll costs were for Central Office employees who enter their time worked, as well as leave and overtime/compensatory time (OT/CT) requests, directly into Kronos, the Department?s timekeeping system. Each employee?s supervisor is to review and approve/disapprove leave and OT/CT requests and the employee?s timesheets. To help ensure timesheets are approved timely, the Department had a control in place that an employee from the Payroll Division query Kronos to identify unapproved timesheets after the end of each pay period and notify the supervisor that the timesheet requires approval. The Kronos timesheets are then interfaced with the Ohio Administrative Knowledge System?s (OAKS) Human Capital Management (HCM) module for processing. However, six of 60 (10%) timesheets tested did not contain the supervisor?s approval. Without proper documentation of management?s review and approval of timesheets and other internal controls, a risk exists that procedures may not be working as intended or may not be consistently applied. If control procedures are not performed and documented consistently, management cannot be reasonably assured the employee timesheets are complete and accurate, which increases the risk that employee compensation is not proper. Based on discussions with management and review of supporting documentation, the timesheets were not properly approved because the supervisor was not available on the day they were required to be approved or the supervisor did not get into Kronos before it interfaced with OAKS. We recommend the Department continue to strengthen and enforce its current control procedures and processes relating to the review of employee timesheets. Management should stress the importance of completing the required reviews of timesheets and the need to document such reviews. The Department should designate alternate approvers if the employee?s supervisor is not available to approve the timesheets. We also recommend the Department establish procedures to periodically monitor its compliance with the related controls and initiate necessary actions to resolve any noncompliance that results. Evidence of such monitoring procedures should be maintained to provide management with assurance the controls are operating consistently and effectively, and to identify the need for additional training or modification of the existing procedures.

OPIOID STR ? CASH MANAGEMENT Finding Number: 2020-037 State Agency Number: MHA-05 CFDA Number and Title: 93.788 ? Opioid STR Federal Award Identification Number / Year: H79TI080261 / 2018 (CURES) H79T1081684 / 2019 (SOR) H79TI081684 / 2020 (SOR) Federal Agency: Department of Health and Human Services Compliance Requirements: Cash Management Repeat Finding from Prior Audit? No SIGNIFICANT DEFICIENCY 45 C.F.R. Part 75 establishes uniform administrative requirements, cost principles, and audit requirements for federal awards to non-federal entities, for federal programs awarded by the Department of Health and Human Services, including the Opioid STR program. 45 C.F.R. Section 75.303 states, in part: The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. . . . It is management?s responsibility to implement control policies and procedures to reasonably ensure that controls are established and working as designed/intended so that revenue transactions are processed accurately and completely, and comply with applicable laws and regulations. Controls must be adequately documented to provide assurance the controls are performed timely and consistently. During state fiscal year 2020, the Department drew down approximately $46.4 million in federal revenue for the Opioid STR program, which includes the Ohio Opioid STR Project (CURE) and State Opioid Response Project (SOR) grants. After the Department submits a federal draw request through the Payment Management System (PMS), it generates a Request for Payment federal draw document from PMS. Before the federal funds are transferred to the Department the next day, the Community Funding Operations Manager, or designee, reviews and compares the Request for Payment to the Payment Detail deposit document for accuracy and completeness. This review and approval is to be evidenced by the manager?s initials and date on the Payment Detail deposit document. However, for two of 60 (3.3%) federal draws tested for the Opioid STR program, the Department could not provide the Payment Detail deposit document to evidence the manager?s review and comparison. Without proper review and approval of revenue transactions, a risk exists that procedures may not be working as intended or may not be consistently applied. If control procedures are not performed properly and consistently, management cannot be reasonably assured revenue transactions are accurate or proper. Based on discussions with management and review of supporting documentation, the condition occurred because the Department could not locate the missing documents or they were misfiled. We recommend the Department evaluate its current controls related to revenue and records management processes and enforce or change them, if needed, to achieve the intended control objectives. Management should stress the importance of completing the required reviews and comparison of documents and maintaining evidence of such. We also recommend the Department establish procedures to periodically monitor its compliance with the related controls and initiate necessary actions to resolve any noncompliance that results. The Department should maintain evidence of such monitoring procedures to provide management with assurance the controls are operating consistently and effectively, and to identify the need for additional training or modification of the existing procedures.

FISH AND WILDLIFE CLUSTER ? EQUIPMENT AND REAL PROPERTY MANAGEMENT Finding Number: 2020-038 State Agency Number: DNR-01 CFDA Number and Title: CFDA 15.605 / 15.611 - Fish and Wildlife Cluster Federal Award Identification Number / Year: F15AF00519 / 2015 F11AF00634 / 2016 F17AF01310 / 2018 F15AF00519 / 2018 F18AF00597 / 2018 F15AF01110 / 2019 F19AF00429 / 2019 F19AF00435 / 2019 Federal Agency: Department of the Interior Compliance Requirement: Equipment and Real Property Management Repeat Finding from Prior Audit? Yes Prior Audit Finding Number: 2019-032 NONCOMPLIANCE AND MATERIAL WEAKNESS 2 C.F.R. Section 1402.100 gives regulatory effect to the Department of the Interior for 2 CFR Section 200.313, which establishes equipment procedures acquired under Federal awards and states, in part: (b) A State must use, manage, and dispose of equipment acquired under a Federal award by the state in accordance with state laws and procedures... Ohio Rev. Code (ORC) Section 125.16(A) states, in part: In accordance with procedures prescribed by the director of administrative services, the officer in charge of each state agency, other than an institution of higher education, shall maintain current and accurate records of tangible personal property and real property, as defined by the department of administrative services that the state agency holds either directly or on behalf of the state. These records shall specify the value of the property, the number of acres of land, the number and kind of buildings, and other significant information about the property, as designated by the department. The Ohio Department of Administrative Services (DAS) serves as the oversight agency for the State?s inventory records such as equipment, land, buildings etc. DAS establishes inventory policies and procedures for state agencies to use for managing and reporting inventory within the State of Ohio Asset Management Handbook. The policy within the Handbook requires buildings and land acquisitions be recorded in the State?s AMS (Asset Management System) promptly following receipt of the asset. Additionally, the Department?s internal inventory policy requires inventory items be entered into AMS within five working days of payment. It also requires staff to forward acquisition information to the division inventory coordinator in a timely manner; however, it does not include who is responsible for maintaining the supporting documentation for building and land purchases. It is management?s responsibility to have internal control procedures in place to ensure compliance with these procedures as well as the ORC. Such controls must reasonably ensure inventory is entered promptly and inventory records maintained by the Department are accurate, complete and have proper supporting documentation. As of June 30, 2020, AMS reported the Department had $26.1 million in buildings and $132 million in land recorded as assets on hand purchased with Fish and Wildlife Cluster federal funds. Purchases of land or buildings go through the Department?s Office of Real Estate and Land Management (REALM). The Division of Engineering and REALM work with the Division of Wildlife to ensure the purchase is allowable per the grant agreement and the Division of Engineering enters the payment information related to the purchase into the state?s accounting system, Ohio Administrative Knowledge System (OAKS). However, these AMS updates are not done within the five business days required by the Department?s internal policy and are not considered prompt in accordance with the State?s Handbook policies. For buildings, the Office of Business Finance (OBF) Inventory Specialist updates the AMS annually based on a report from the Division of Engineering detailing buildings purchased during the year. For land, the OBF Inventory Control Specialist updates the AMS semi-annually from an OAKS Business Intelligence expenditure report (by account code) and the related voucher and invoice. Additionally, we noted for 37 of 60 (61.7%) non-equipment inventory assets (i.e. land, buildings, etc.) selected for testing, documentation was not provided to support the Department's valuation of the asset, or the documentation provided did not match the Department?s valuation in AMS. Furthermore, for five of these assets, no documentation was provided to support the Department?s ownership of the assets in AMS. Without promptly entering inventory purchases or keeping appropriate supporting documentation on file, management cannot be reasonably assured the inventory listing is complete and accurate when certified annually to DAS. This increases the risk assets in the State of Ohio?s financial statements could be misstated, improper transactions may not be detected in a timely manner, or the Department could be out of compliance with applicable state and federal laws. Noncompliance with federal regulations could result in federal funds being reduced, taken away, or other sanctions imposed by the federal grantor agency. Based on discussions with management, land and building documentation can be difficult to locate or missing as it could have been obtained decades in the past or is not available on-site. Land and building purchases are not promptly entered into AMS due to Divisions inconsistently submitting documentation for AMS entry. We recommend the Department continue its efforts to review its existing procedures and develop improved internal controls over asset reporting. Procedures should be updated to ensure they align with DAS regulations and policies, and clarify who should be maintaining the related supporting documentation. The Department should continue in its efforts to update asset information, including obtaining and maintaining proper documentation to support the Department?s inventory listing. We also recommend management implement periodic monitoring procedures to ensure the established controls are operating effectively and as intended. In addition, we recommend the Department continue to work with the Ohio Office of Budget and Management (the preparer of the State?s financial statements) and DAS to determine how to proceed with assets currently being reported on the AMS if no documentation is able to be located to support the valuation.

FISH AND WILDLIFE CLUSTER ? EXPENDITURE RECONCILIATIONS Finding Number: 2020-039 State Agency Number: DNR-02 CFDA Number and Title: CFDA 15.605 / 15.611 ? Fish and Wildlife Cluster Federal Award Identification Number / Year: F15AF00519 / 2015 F11AF00634 / 2016 F17AF01310 / 2018 F15AF00519 / 2018 F18AF00597 / 2018 F15AF01110 / 2019 F19AF00429 / 2019 F19AF00435 / 2019 Federal Agency: Department of the Interior Compliance Requirements: Activities Allowed or Unallowed, Allowable Costs/Cost Principles Repeat Finding from Prior Audit? No MATERIAL WEAKNESS 2 C.F.R. Section 1402.100 gives regulatory effect to the Department of Interior for 2 C.F.R. Section 200.303 (a), which requires recipients of federal awards to ?Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statues, regulations, and the terms and conditions of the Federal award.? It is management's responsibility to implement an adequate system of internal controls to monitor the accuracy and completeness of accounting records pertaining to federal expenditures, including periodic reconciliations of their accounts and records to OAKS. Such reconciliations must be performed timely, be thoroughly documented, and include the appropriate follow-up for all significant reconciling items. During the state fiscal year 2020, the Department's Wildlife Division processed approximately $24.7 million in expenditures ($15.1 million related to payroll and $9.6 million related to non-payroll such as payments for awarded projects to subrecipients, equipment, and supplies) for the Fish and Wildlife Cluster to conserve and improve fish and wildlife resources and their habitats for sustainable use and appreciation by the public. Per Departmental policy, by the tenth of each month, Wildlife Project Leaders must prepare and submit to the Central office a project monitoring statement for each awarded project. The project monitoring statement documents the Project Leader's review and reconciliation over subrecipient?s project activities and transactions processed during the month to ensure accuracy and completeness. For payroll expenditures, the Division section timekeepers are required to review and reconcile the payroll register after payroll is processed for their employees and compare it to the related Kronos timesheet/eTARS Time Summary Report/Activity Trackers, as applicable, to ensure accuracy and completeness. However, these reconciliation processes were not performed consistently throughout the audit period, as noted below: ? Five of 60 (8.3%) projects & months selected for non-payroll testing, a project monitoring statement was not completed. ? Two of 60 (3.3%) division payrolls selected for testing, a payroll register reconciliation was not completed. Without consistently performing reconciliations between the Department?s internal records and OAKS, there is an increased risk that amounts recorded in the State's accounting system may be miscoded and/or inaccurate. Furthermore, irregularities or improper transactions could go undetected. Based on discussion with management some projects are difficult to reconcile on a monthly basis as they have a longer span and wide number of expenses. There was also miscommunication between employees regarding who was to complete the procedure when the designated employee was out of office. For payroll, one Division stopped performing reconciliations once the new payroll system, Kronos, was implemented, as they thought it was no longer necessary. We recommend the Department strengthen existing controls and procedures to ensure expenditures are reconciled timely, appropriately documented, and include appropriate follow-up for all significant reconciling items. Procedures should clearly define responsibility for internal controls when staff are out of the office and be promptly updated when the Department implements a new system to ensure proper internal controls are still being performed. Any updates to procedures should be clearly communicated to all staff. Management should periodically monitor these procedures to verify they are operating effectively and as management intended.

IT ? LACK OF A SOC 1 AUDIT FOR SERVICE ORGANIZATIONS Finding Number: 2020-040 State Agency Number: DNR-03 CFDA Number and Title: 15.605 / 15.611 ? Fish and Wildlife Cluster Federal Award Identification Number / Year: F15AF00519 / 2015 F11AF00634 / 2016 F17AF01310 / 2018 F15AF00519 / 2018 F18AF00597 / 2018 F15AF01110 / 2019 F19AF00429 / 2019 F19AF00435 / 2019 Federal Agency: Department of the Interior Compliance Requirement: Reporting Repeat Finding from Prior Audit? Yes Prior Audit Finding Number: 2019-034 MATERIAL WEAKNESS 2 C.F.R. Section 1402.100 gives regulatory effect to 2 C.F.R. Section 200.303(a), which requires recipients to maintain internal controls over federal programs that provide reasonable assurance they are in compliance with laws, regulations, and the provisions of contracts or grant agreements. It is management?s responsibility to monitor these control procedures to verify they are designed and operating in a manner consistent with federal regulations and program objectives. Furthermore, sound internal control procedures require management to monitor and oversee operations of contractors responsible for carrying out federal requirements to provide reasonable assurance procedures performed by the contractor are functioning as intended and in compliance with federal regulations and contractual obligations. Entities use outside service organizations to process transactions as part of the entity?s information system. Service organizations provide services ranging from performing a specific task under the direction of an entity to replacing entire business units or functions of the entity. Attestation standard (AT-C 320) Reporting on an Examination of Controls at a Service Organization Relevant to User Entities? Internal Control Over Financial Reporting, prescribes standards for reporting on service organizations. An unmodified Type 2 Report on Management?s Description of a Service Organization?s System and a Service Auditor?s Report on that Description and on the Suitability of the Design and Operating Effectiveness of Controls in accordance with AT-C 320 should be provided to the Department to provide reasonable assurance that transaction processing conform to the contract. During state fiscal year (SFY) 2020, the Department used the web-based Ohio Wildlife Licensing System (OWLS) to process sales of approximately $47 million in hunting and fishing licenses and permits. A portion of these sales must be reported to the federal government annually. The Department contracted with a vendor (service organization) to host this system, which required they provide backups, technical assistance, security monitoring, system enhancements, and system updates for the OWLS application. The service organization, in turn, contracted with another vendor (subservice organization) to house their application and to maintain and oversee the hardware. The Department also relied on the service organization?s disaster recovery plan. The Department?s contract with the service organization contained a provision requiring it to obtain a SOC 1 Type 2 audit annually; however, a SOC 1 Type 2 audit of the service organization was not completed for the audit period. In the absence of a SOC1 Type 2 report, we were able to perform testing over the service organization?s general control environment. However, due to limited availability of information from the service organization we could not gain adequate assurance over change management controls and system level access controls. A SOC 1 Type 2 audit was completed for the subservice organization covering SFY 2020; however, the Department did not review this report. Without a SOC 1 Type 2 audit of the service organization, the Department may not have sufficient information to reasonably ensure controls are in place, designed properly, and operating effectively to help ensure the integrity of the controls for the data processed, maintained, and reported by the OWLS web application and the service organization. This could also result in inaccurate data reported annually to the federal grantor agency. Department management indicated the service organization vendor did not initially agree that they were required to have a SOC 1 Type 2 audit performed because of the SOC 1 audit performed of their contracted subservice organization. During SFY 2020, the vendor agreed to complete a SOC 1 Type 2 audit and contracted with an audit firm to conduct the audit; however, the estimated reporting period doesn?t start until SFY 2022. We recommend the Department take steps to ensure a SOC 1 Type 2 audit is completed annually of the service organization for the OWLS web application and its processing environment to provide a description of the system, results of the OWLS internal control testing of operating effectiveness, and an opinion of the overall processing environment. In addition, the Department should review any complementary user entity controls resulting from the SOC 1 audit to ensure those controls are in place and operating effectively. Also, we recommend Department management review the subservice organization?s SOC 1 Type 2 report and the complimentary user entity controls to help ensure familiarity with all aspects of the OWLS processing environment.

NGMOMP ? CASH MANAGEMENT Finding Number: 2019-004 State Agency Number ADJ-01 CFDA Number and Title: 12.401 National Guard Military Operations and Maintenance (O&M) Projects Federal Award Identification Number / Year: W91364-16-2-1001 / 2019 Federal Agency: Department of Defense Compliance Requirement: Cash Management Repeat Finding from Prior Audit? No NONCOMPLIANCE AND MATERIAL WEAKNESS 31 C.F.R Part?205.33(a) states, in part: A State must minimize the time between the drawdown of Federal funds from the Federal government and their disbursement for Federal program purposes. A Federal Program Agency must limit a funds transfer to a State to the minimum amounts needed by the State and must time the disbursement to be in accord with the actual, immediate cash requirements of the State in carrying out a Federal assistance program or project. The timing and amount of funds transfers must be as close as is administratively feasible to a State's actual cash outlay for direct program costs and the proportionate share of any allowable indirect costs? National Guard Regulations (NGR) 5 -1, Chapter 11 ? states, in part: 11-4. Payment Processing: a. The National Guard Bureau (NGB) Cooperative Agreement program operates on the basis that the grantee expends State government funds first and then submits request (vouchers) for reimbursement from NGB for allowable CA costs. All approved CA agreement payments (to include Advances) made to the grantee by NGB are reimbursable payments. To process reimbursement payments the grantee shall provide an OMB Standard Form (SF) 270 (Request for Advance or Reimbursement) with supporting documentation to the CA PM. The supporting documentation will itemize, by AMSCO and EEIC, the amount of funds expended and the corresponding grantee accounting classification to be reimbursed. . . . g. The USPFO/Asst USPFO Air (Fiscal) will process reimbursement request from the grantee to DFAS so as to meet the requirements of U.S Treasury, 31 Code of Federal Regulation, Part 205, Rules and Procedures for Efficient Federal-State Funds Transfers 31 CFR Part 205 and the Cash Management Information Act Treasury-State Agreements. 11-5. Advance Payment Method (a)(5): A statement that the grantee agrees to minimize the time elapsing between the transfer of funds from the U.S. Treasury and their disbursement by the State. (No more than 45 days) It is management?s responsibility to implement control policies and procedures to reasonably ensure advance requests of federal funds are for immediate cash needs, processed accurately, and disbursed timely in accordance with applicable laws and regulations. During state fiscal year 2019, the Department received approximately $52.5 million in advance federal funding for the National Guard Military Operations and Maintenance Projects program (NGMOMP). The Department utilizes the SF-270 form to request the advances of funds in accordance with 31 C.F.R. Part 205.33(a) and N.G.R. 5-1 - National Guard Grants and Cooperative Agreements. To monitor the cash flow of each cooperative agreement (CA), the State Finance Office and Federal Program Managers track the funding by creating spreadsheets to ensure the revenues, expenditures, cash balance, percent spent, and liquidation percentages are all in accordance with each CA by Program and Department. However, the Department's controls did not detect or prevent noncompliance with the time limits established in 31 C.F.R. Part 205.33(a) and N.G.R. 5-1. For one of eight (12.5%) disbursements from 8 advance requests selected for testing, the Department did not disburse one payment within 45 days of the receipt of the federal funds, as required by 31 C.F.R. Part 205.33(a) and N.G.R. 5-1. The Department disbursed the funds 33 days after the required disbursement date. Not having effective controls over the timely disbursement of federal funds could lead to the Department not limiting funds based on immediate cash needs and not expending funds timely. This could result in noncompliance with 31 C.F.R. Part 205.33(a) and N.G.R. 5-1. These conditions could subject the Department to sanctions or other penalties and a repayment of part of the cooperative agreement amounts. In addition, noncompliance could subject the Department to paying interest charges on these draws. Based on discussions with management, the error was due to oversight. We recommend the Department evaluate its existing cash management control procedures and update them as necessary to reasonably ensure all federal advance requests are disbursed timely and are only for immediate cash needs, as established in accordance with 31 C.F.R. Part 205.33(a) and N.G.R. 5-1. We also recommend the Department establish procedures to periodically monitor its compliance with the cash management requirements and initiate necessary actions to resolve any noncompliance that results.

IT ? OHIO BENEFITS SYSTEM ? MEDICAID/CHIP/MFP/SNAP/TANF Finding Number: 2019-005 State Agency Number: DAS-02 CFDA Number and Title: 10.551/10.561 SNAP Cluster 93.558 TANF Cluster 93.767 ? Children?s Health Insurance Program (CHIP) 93.775/93.777/93.778 ? Medicaid Cluster 93.791 ? Money Follows the Person Rebalancing Demonstration (MFP) Federal Award Identification Number/Year: 172OH102S8026 / 2017 (SNAP Cluster) 172OH102S8069 / 2017 (SNAP Cluster) 182OH102S8026 / 2018 (SNAP Cluster) 182OH102S8069 / 2018 (SNAP Cluster) 192OH102S8026 / 2019 (SNAP Cluster) 192OH102S8069 / 2019 (SNAP Cluster) 1701OHTANF / 2017 (TANF Cluster) 1801OHTANF / 2018 (TANF Cluster) 1901OHTANF / 2019 (TANF Cluster) 1805OH5021 / 2018 (CHIP) 1905OH5021 / 2019 (CHIP) 1805OH5MAP / 2018 (Medicaid) 1905OH5MAP / 2019 (Medicaid) 1LICMS331360 / 2014-2020 (MFP) Federal Agencies: Department of Agriculture Department of Health and Human Services Compliance Requirements: Eligibility, Special Tests and Provisions ? Income Eligibility Verification System Repeat Finding from Prior Audit: No MATERIAL WEAKNESS NOTE: Finding numbers 2019-001 , 2019-017, 2019-018, 2019-022, and 2019-023 contain additional information which is integral to and should be read in conjunction with this finding. Applications/systems must be properly designed to achieve the business and IT goals of the organization. External factors effecting eligibility must be appropriately considered and properly evaluated to ensure eligibility for benefits is properly determined, and appropriate updates to eligibility are made when applicable. It is critical the appropriate monitoring controls are designed and implemented to reasonably ensure the organization has adequate controls to achieve management?s goals and objectives. During state fiscal year (SFY) 2019, the State of Ohio disbursed a combined total of $22 billion in public assistance payments related to the following programs: Federal Program Benefits Paid # of Recipients* 93.767 - CHIP $543,910,640 214,981 93.775/93.777/93.778 ? Medicaid Cluster $19,310,986,073 2,650,450 93.791 ? Money Follows the Person $6,779,281 2,188 10.551/10.561 ? SNAP Cluster $2,008,412,067 1,379,247 93.558 ? TANF Cluster $210,156,426 91,506 Combined Total $22,080,244,487 4,338,372 *We did not separately identify recipients who could be covered by multiple programs The information below summarizes Finding 2019-001 as it relates to the control process and weaknesses identified related to eligibility for the SNAP Cluster and Medicaid Cluster. These issues also apply to the CHIP, MFP, and TANF Cluster programs and additional information was added, where necessary, to identify any errors related to these programs. The State of Ohio uses a multi-agency approach to administer these programs, as follows: overall compliance and administration of the Medicaid Cluster, CHIP, and MFP falls under the Ohio Department of Medicaid (MCD), overall compliance and administration of the SNAP Cluster and TANF Cluster falls under the Ohio Department of Job & Family Services (ODJFS), and programming and administration of the State?s eligibility determination computer system, Ohio Benefits (OB), falls under the Ohio Department of Administrative Services (DAS). The OB system was first implemented for Medicaid in SFY 2014; CHIP was added in August 2016; and, SNAP and TANF were added in August 2018. One of several factors in determining eligibility for the MFP program is based upon the recipient?s eligibility for the Medicaid Cluster program. The OB system includes the Income Eligibility Verification System (IEVS) functionality which compares reported recipient income to income information maintained by outside data sources (SSA, IRS, etc.). The State also utilizes the 88 Ohio counties in the eligibility determination process to work with applicants, receive/enter eligibility documentation into the State?s system, and follow up on alerts issued by the system. Currently, individuals applying to receive public assistance benefits complete an application through one of several input locations including the Ohio Benefits Self-Service Portal, the Federally-Funded Marketplace, Social Security, County Departments of Job & Family Services (CDJFS) offices; the Medicaid Consumer Hotline (the Hotline starts the application and sends to the CDJFS to complete); and, paper applications that are sent to the CDJFS. When applying, the CDFJS collects and maintains any documentation provided by the individual either in a paper case file or in the OnBase Electronic Documentation Management System (EDMS) maintained under contract by DAS. After collecting documentation, the county caseworker enters the individual?s information into the OB system which determines the initial eligibility benefit amount, where applicable. This process is also used to perform eligibility redeterminations on an annual basis or when prompted through a system alert. The OB system is programmed with the State Plan recipient eligibility requirements to determine whether the recipient is eligible to receive the related program benefits based on the information entered by the recipient or caseworker and also assigns a benefit aid category. Once the determination is made, the OB system uploads the eligibility information to the MCD or ODJFS payment system to process the payment. During SFY 2019, we noted several weaknesses/defects in the eligibility process, as listed below: ? Overwriting ? the OB system maintains several pieces of key information related to a recipient?s eligibility (income, household size, age, etc.). However, there is no system warning or other control in place to identify or prevent caseworkers from overwriting this data when new information is identified instead of adding the new information, as intended. In addition, a system defect prevents caseworkers from viewing the previous case information. ? Multi-program Info ? There are certain pieces of key information (i.e. name, income, age, etc.) maintained in the OB system which impact all public assistance programs, including SNAP, TANF, Medicaid, and CHIP. However, the system currently does not link this information between programs, but relies on county caseworkers to manually adjust each affected program separately when a change occurs. ? System Design Weaknesses/Defects in the OB system: ? Alerts - The related state agencies identified and reported to DAS an error in the IEVS filtering logic which created an overwhelming volume of information being sent to the counties resulting in an unmanageable workload and ineffective application of the alert process (more than 16.9 million alerts were issued according to DAS records; 5.9 million related to IEVS alerts and 11 million to non-IEVS alerts). Based on discussions with management, IEVS filtering logic was not properly communicated to the OB contractor when IEVS was initially implemented. In addition, the OB System had the following design defects/weaknesses related to alerts: ? Multiple and repetitive alerts (redundancy). ? Irrelevant alerts (zero or small dollar amounts). ? Additional steps required to complete an alert (having to leave the alert window, opening an OB window, and then having to go back through the Alert Inventory to clear the alert). ? Alerts being received on persons not receiving public assistance. ? For eight of 80 (10%) Medicaid recipients and 12 of 80 (15%) CHIP recipients selected for testing, a systemic issue within OB that either impacted the eligibility process and/or eligibility determination for the recipient existed, which are detailed in the findings for the Ohio Department of Medicaid. ? Additional system design weaknesses/defects in the OB system brought to our attention by the Ohio Department of Medicaid included the following: ? The system was not properly tracking/submitting the required 1095-B (Health Coverage) tax forms for Medicaid recipients to the Internal Revenue Service resulting in late filings by the Department. ? The system auto-populated a new browser window/case with incorrect data if a case worker did not close a prior case file. ? The system sometimes incorrectly linked newborns to individuals who are not their actual parents. In one instance, this resulted in a newborn being linked to an eleven-year old child. ? The system was not generating a PDF for a case worker to access within the system when an e-app was filed by a recipient. ? The system had issues sending information to the Medicaid Information Technology System (MITS) for cases with a discontinuance resulting in case information not being properly updated within MITS. ? The system was not end-dating pregnancy records over 10 months. An alert is generated for the worker to investigate this issue, but if the alert is not worked, the individual will remain open as a pregnant woman until the next eligibility determination. Additionally, we noted the following weakness/issues regarding the contract and monitoring related to the OB system: ? DAS and ODJFS entered into a contract agreement with the developing vendor during SFY 2013 to integrate eligibility systems across public assistance programs, resulting in the implementation of OB. In SFY 2014, MCD and ODJFS were separated into two different departments. However, signed amendments did not include MCD as a separate agency. Since the original contract was signed, there have been numerous amendments to the contract, also not signed by MCD or ODJFS, making organization of the additional deliverables difficult to monitor. ? Although operating protocols were available defining DAS? responsibilities, signed interagency agreements have not been prepared to define the roles and responsibilities of each agency and naming DAS as the administrator for OB. No data governance structure was in place to ensure reliability for management. As a result, it was not always clear if/how program objectives were being met/monitored and program compliance was being achieved. ? DAS engaged a third party evaluator to provide a variety of Quality Assurance and Independent Verification and Validation (QA/IV&V) professional services. One of the services included providing monthly and quarterly IV&V reports. These reports provided a summary of project progress during the reporting period, along with detailed findings, risks, and recommendation items. These reports were provided to DAS, who distributed them to MCD and ODJFS. However DAS questioned the reports? usefulness and informational content and there was no evidence of monitoring related to the remediation of the recommendations/issues noted. ? There was no comprehensive inventory or other documentation and tracking of internal or external reviews/evaluations/certifications performed for the OB system, or those required to ensure they were completed timely. Such reviews could include a gate review, annual security and privacy control assessments, or other internal or external reviews. Without proper controls for entering, processing, and maintaining recipient information and system alerts, there is an increased risk that benefits paid to or on behalf of recipients will be inaccurate or unallowable. This risk is substantially increased if the State?s eligibility determination system, Ohio Benefits, contains design or operational flaws that could impact a recipient?s eligibility and, as a result, could have a material impact on the amounts reimbursed by the federal government. These weaknesses/defects could allow undue subjective decisions, jeopardize accurate eligibility processing, and/or result in improper payments or federal reimbursements. Overpayments or payments to or on behalf of ineligible recipients may subject the State to penalties or sanctions which may jeopardize future funding and limit its ability to fulfill program requirements to provide benefits to those in need. Lack of monitoring the IV&V progress reports, contract amendments, and outside evaluations and assessments could result in a lack of confidence that financial and compliance goals will be achieved. Failure to obtain signed agreements from related agencies could result in agreed upon functions not being met. Based on discussions with management, human error/ oversight and systemic issues led to the issues identified. Recommendations We recommend the DAS work collectively with the related state agencies to implement/update robust processes, procedures, and system controls to address the weaknesses associated with the IEVS process within the OB system. These changes/updates should include, but not be limited to: ? Redesigning the alert process to be more effective and efficient. This could include a more centralized evaluation of alert activity and/or better use of automated tools to analyze and prioritize items requiring follow-up. This would allow related state agency level personnel to become more experienced and adept at identifying and investigating anomalies and help focus the resources of both related state agency and county personnel. ? Identifying and coordinating program changes to address the system design weaknesses/defects identified above. This should include working collaboratively with the related state agencies to prioritize program changes which could directly impact the eligibility determinations or benefit amounts to ensure they are corrected in a timely manner to prevent and detect further improper payments. ? Creating a centralized database of recipient information shared among multiple public assistance programs, or otherwise linking this information so that a change only has to be entered once in OB and all programs are updated accordingly. ? Ensuring vendor contacts/amendments, and interagency agreements are formalized, contain all parties of the agreements, and fully and clearly define the roles, responsibilities, and expectations related to each party, including completion of required risk assessments and evaluations, and any other specific tasks designed to achieve program compliance. ? Ensuring appropriate and coordinated monitoring and tracking procedures are in place regarding reviews required and performed, and the timely remediation of issues identified, including, but not limited to: ? A data governance structure designed to ensure data quality and reliability for management, the grantor agencies, and other users of this information. This should include data subject experts from each related agency to help ensure quality of data requests before external and internal users rely on the data, issues are addressed with a clear escalation path, and establishing accountabilities and alignment between the related agencies. ? Reviewing and monitoring the IV&V reports prepared by the third party evaluator and to prioritize and develop a remediation plan, along with MCD and ODJFS, to help track and ensure necessary changes to the OB application are completed accurately and timely, and the system is operating as intended. ? Coordinating and managing the contract contents with the developing vendor to help ensure all contract and amendment deliverables are being met. ? Ensuring documentation related to all internal and external evaluations and assessments of the Ohio Benefits eligibility environment be tracked, monitored and maintained to ensure all appropriate monitoring and remediation efforts are completed timely and in compliance with standards.

UNIFORM GUIDANCE POLICIES AND PROCEDURES Finding Number: 2019-006 State Agency Number: AGE-01 CFDA Number and Title: 93.044 / 93.045 / 93.053 ? Aging Cluster Federal Award Identification Number / Year: 17AAOHT3SS / 2017 17AAOHT3CM / 2017 17AAOHT3HD / 2017 17AAOHNSIP / 2017 18AAOHT3SS / 2018 18AAOHT3CM / 2018 18AAOHT3HD / 2018 18AAOHNSIP / 2018 1901OHOASS / 2019 1901OHOACM / 2019 1901OHOAHD / 2019 1901OHOANS / 2019 Federal Agency: Department of Health and Human Services Compliance Requirements: Activities Allowed and Unallowed, Allowable Costs/Cost Principles, Cash Management Repeat Finding from Prior Audit? No NONCOMPLIANCE AND MATERIAL WEAKNESS 45 C.F.R. Part 75 establishes uniform administrative requirements, cost principles, and audit requirements for federal awards provided by the Department of Health and Human Services and requires an entity receiving federal funds establish written policies in order to comply with certain requirements. Specifically, 45 C.F.R. Part 75.302(b)(6) and 45 C.F.R. Part 75.305, 45 C.F.R. Part 75.302(b)(7), and 45 C.F.R. Part 75.430(a) relate to written policies for cash management, allowability of costs, and time and effort, respectively. Furthermore, an entity?s system of internal controls consists of the policies and procedures established by management to provide reasonable assurance that it complies with applicable rules and regulations and that specific operational objectives are achieved. These policies establish the authorization level for financial and operational transactions to be executed and are meant to accomplish management's goals and professional and statutory requirements. The policies and procedures must be officially approved and distributed to all applicable employees to ensure they are aware of the policies and procedures, and are adhering to them. During the audit period, the Department disbursed approximately $48 million in federal funds related to the Aging Cluster, with 96% distributed to subgrantees. The Department had written policies and procedures in place regarding the general purchase of goods, unallowable costs for contracts and agreements, and time and attendance, but did not address specific allowability of costs and cost principles of 45 C.F.R. Part 75, Subparts D and E, cash management, and the terms and conditions of the federal award. In addition, they were not current (most recent was 2017) and inconsistent with statutory requirements, referenced repealed OMB (Office of Management and Budget) Circulars and defunct accounting systems, and did not contain evidence of formal approval by management. Without complete, accurate, updated, and formally approved policies and procedures, the Department subjects itself to risk that transactions will not be processed timely, accurately, consistently, or in accordance with federal requirements. This risk is increased if there is turnover in staff and new employees do not have formal policies and procedures as a guide to define processes and requirements. This could lead to the Department not complying with the requirements and could result in decreased future funding, repayment of grant awards, sanctions, and/or fines imposed by the federal grantor agency. Based on discussion with management and review of documents, the Department didn?t have the human resources until recently to devote to updating the policies. We recommend the Department finalize, formally approve, and implement updated written policies and procedures over the compliance areas noted above. These policies and procedures should be reflective of the current accounting policies and approaches related to all significant federal funds, including the Aging Cluster. We also recommend management provide these procedures to all employees and periodically monitor them to ensure they are operating as intended and updated as necessary. Lastly, we recommend the Department review, evaluate, and update its policies and procedures on a regular basis to ensure they remain current and are meeting management?s objectives and federal requirements.

HEAP ? CASH MANAGEMENT Finding Number: 2019-007 State Agency Number: DEV-01 CFDA Number and Title: 93.568 ? Low-Income Home Energy Assistance Program Federal Award Identification Number / Year: 2018G99201 / 2018 2019G99201 / 2019 Federal Agency: Department of Health and Human Services Compliance Requirement: Cash Management Repeat Finding from Prior Audit? Yes Prior Audit Finding Number: 2018-003 NONCOMPLIANCE AND MATERIAL WEAKNESS 31 C.F.R. Part 205.11 states, in part: (a) A State and a Federal Program Agency must minimize the time elapsing between the transfer of funds from the United States Treasury and the State's payout of funds for Federal assistance program purposes, whether the transfer occurs before or after the payout of funds. (b) A State and a Federal Program Agency must limit the amount of funds transferred to the minimum required to meet a State's actual and immediate cash needs. . . . To define these allowable timeframes, the State of Ohio and the U.S. Department of the Treasury entered into a Cash Management Improvement Act (CMIA) Agreement which requires the Agency to utilize the Modified Pre-Issuance Methodology when requesting federal funds for the Low-Income Home Energy Assistance Program (HEAP). Section 6.2.4 of the agreement regarding the Modified Pre-Issuance Methodology states, in part: . . . The State shall request funds such that they are deposited in a State account not more than eight business days prior to the day the State makes a disbursement. . . The amount of the request shall be the amount the State expects to disburse. . . In addition, 45 C.F.R. Part 75.302 and .305 give regulatory effect to the Department of Health and Human Services for 2 C.F.R. Part 200.302(b)(6) which requires states to have written procedures to implement the requirements of 2 C.F.R. Part 200.305. 2 C.F.R. Part 200.305(a) indicates for states, payments are governed by Treasury-State CMIA agreements and default procedures codified at 31 C.F.R. Part 205 ?Rules and Procedures for Efficient Federal-State Funds Transfers? and TFM 4A-2000 Overall Disbursing Rules for All Federal Agencies. Furthermore, an entity?s system of internal controls consists of the policies and procedures established by management to provide reasonable assurance that it complies with applicable rules and regulations and those specific operational objectives are achieved. These policies establish the authorization level for financial and operational transactions to be executed and are meant to accomplish management's goals and professional and statutory requirements. During state fiscal year 2019, the Agency drew down approximately $140 million in federal funding for the HEAP program. The Agency utilizes the CMIA Agreement, as well as internal policies and procedures as a guide for completing federal draws; however, these policies and procedures do not specifically address the timeliness of the disbursement/draw process as required by 2 C.F.R. Part 200. 302(b)(6). The Agency compiles a worksheet of all payment requests for administrative and program costs associated with providing HEAP assistance in order to determine the amount of federal funds to be drawn. This evaluation includes year-to-date disbursements, year-to-date revenues, and any refunds received and/or pending. However, as noted above, the Agency's internal control policies do not contain procedures which allow disbursements to be tied to a specific draw. Due to this, it is not possible to test if draws were disbursed in compliance with the applicable funding techniques specified in the Treasury-State Agreement (within eight business days). Without procedures in place which allow for ensuring timely disbursement of funds in accordance with federal requirements and the CMIA Agreement, interest penalties may be incurred by the State of Ohio. This could also subject the Agency to sanctions or other penalties by the federal grantor agency. Based on discussions with management, they have not considered developing a methodology which allows them to trace federal draw amounts to subsequent disbursements since their focus is to draw federal funds based on an amount calculated from disbursements already made. We recommend the Agency update its written policies and procedures for the cash management process to provide a methodology which allows for disbursements to be tied to related federal draws to help ensure compliance with 2 C.F.R. Part 200.302(b)(6). These policies and procedures should be formally approved and adopted by management, provided to all employees, and monitored periodically by management to ensure the procedures are operating as intended and updated as necessary.

IT ? INAPPROPRIATE APPLICATION ADMINISTRATOR ACCOUNT ACCESS Finding Number: 2019-008 State Agency Number: DDD-01 CFDA Number and Title: 93.775/93.777/93.778 ? Medicaid Cluster 93.791 ? Money Follows the Person Federal Award Identification Number / Year: 1805OH5MAP / 2018 (Medicaid) 1905OH5MAP / 2019 (Medicaid) 1LICMS331360 / 2014 ? 2020 (MFP) Federal Agency: Department of Health and Human Services Compliance Requirements: Activities Allowed or Unallowed, Allowable Costs/Cost Principles, Special Tests and Provisions ? Provider Eligibility Repeat Finding from Prior Audit? No MATERIAL WEAKNESS Organizations logically restrict access to their computer systems, programs, and data to help reduce the risk of unauthorized use of key computer resources. They establish levels of access commensurate to a specific user?s job responsibilities. Access to administrative privileges, which may be used to override other controls, is tightly restricted. Computer systems are regularly monitored for possible misuse and periodic reviews of user access are performed to ensure all access is authorized. The Department?s Information Policies include the following, which govern implementation of the controls described above: ? Completion of Information Technology Services Security Affidavit (ITS-001). ? System Access and User Authentication (ITS-002) Section IV.C: Access Control for DODD Web Applications. The Medicaid Billing System (MBS) is designed to process Medicaid claims for waiver and targeted case management (TCM) services provided by eligible providers. During state fiscal year (SFY) 2019, approximately $1.6 billion in payments were processed through MBS. MBS is supported by several ancillary systems, including the Medicaid Services System (MSS) and Provider Services Management (PSM). MSS enrolls clients onto the various waivers and records individual service plans (which ultimately authorize waiver claims) while PSM certifies providers of Medicaid services. During (SFY 2019, approximately 15,000 new or renewed providers were certified. The internal controls in the PSM and MSS systems are significant to the Department?s efforts to prevent unauthorized disbursements of Medicaid funds. The following MSS, PSM, and MBS accounts did not require access for the performance of their job functions: ? Nine of 33 (27.3%) MSS users had administrative access allowing them to submit a Payment Application Waiver Plan and enroll a provider. ? Three of 14 (21.4%) PSM users had administrative access allowing them to update or change provider application data. ? Three of 23 (13%) MBS users had administrative access allowing them to upload data, edit the billing schedule, and delete no match claims (claims previously uploaded that could not be processed during the billing cycle they were uploaded; typically a claim on a pending-prior report). A non-matched claim might be deleted if notified by the provider they did not want the subsequent claim to process. Inappropriate access increases the risk that users have inappropriate access to programs and data which could jeopardize the integrity of departmental data. This could result in the transmission of inaccurate transactions, which may misstate federal or state expenditure activity, or result in the misuse or fraudulent misappropriation of state resources or federal program monies. Based on discussions with management, these access exceptions were due to inadequate review processes and updating of access. We recommend the Department evaluate the roles for these accounts and remove all unnecessary access not required for the job function. We also recommend management follow the formal policies in place which prescribe the process for performing periodic reviews of all user accounts, especially administrator accounts. We also recommend the Department update IT policies to reflect approved changes governing how IT security is administered.

TIMELY ALLOCATIONS TO CHARTER SCHOOLS ? VARIOUS PROGRAMS Finding Number: 2019-009 State Agency Number: EDU-01 CFDA Number and Title: 84.010 ? Title I Grants to Local Educational Agencies 84.027/84.173 ? Special Education Cluster (IDEA) 84.367 ? Supporting Effective Instruction State Grant Federal Award Identification Number / Year: S010A170035 / 2017 (Title I) S010A180035 / 2018 (Title I) H027A170111-17A / 2017 (IDEA) H027A180111-18A / 2018 (IDEA) S367A170034 / 2017 (SEI) S367A180034 / 2018 (SEI) Federal Agency: Department of Education Compliance Requirement: Special Tests and Provisions ? Access to Federal Funds for New or Significantly Expanded Charter Schools Repeat Finding from Prior Audit? Yes Prior Audit Finding Number: 2018-004 NONCOMPLIANCE AND MATERIAL WEAKNESS (SPECIAL EDUCATION CLUSTER AND SUPPORTING EFFECTIVE INSTRUCTION STATE GRANT) MATERIAL WEAKNESS (TITLE I GRANTS TO LEAs) 34 C.F.R. Part 76, Subpart H, requires that SEAs (state educational agencies) take measures to ensure each charter school in the state receives the funds for which it is eligible under a covered program during its first year of operation and during subsequent years in which the charter school expands its enrollment. Specifically, 34 C.F.R. Part 76.793(a) states: For each eligible charter school LEA [local educational agency] that opens or significantly expands its enrollment on or before November 1 of an academic year, the SEA must allocate funds to the charter school LEA within five months of the date the charter school LEA opens or significantly expands its enrollment; In addition, 34 C.F.R. Part 76.796 states: (a) An SEA that allocates more or fewer funds to a charter school LEA than the amount for which the charter school LEA is eligible, based on actual enrollment or eligibility data when the charter school LEA opens or significantly expands its enrollment, must make appropriate adjustments to the amount of funds allocated to the charter school LEA as well as to other LEAs under the applicable program. (b) Any adjustments to allocations to charter school LEAs under this subpart must be based on actual enrollment or other eligibility data for the charter school LEA on or after the date the charter school LEA first opens or significantly expands its enrollment, even if allocations or adjustments to allocations to other LEAs in the State are based on enrollment or eligibility data from a prior year. It is management?s responsibility to implement control policies and procedures to reasonably ensure compliance with these requirements. During state fiscal year (SFY) 2019, the Department expended approximately $529.4 million in Title I Grants to LEAs funds, of which approximately $523 million were subsidy payments to LEAs; $481.7 million in Special Education Cluster funds, of which approximately $462 million were subsidy payments to LEAs; and, $74.8 million in Supporting Effective Instruction State Grant funds, of which approximately $71.9 million were subsidy payments to LEAs. In addition, during SFY 2019, ten new charter schools (called community schools in Ohio) opened and nine community schools significantly expanded by adding two or more grade levels during the school year. The Department had controls in place during SFY 2019 for allocating funding to new and significantly expanded community schools for all three federal programs. The controls consisted of either making an initial estimated allocation and then adjusting it when the LEA reported actual data or making only one allocation based on the actual data. Once the allocations are made, the community schools must submit an application and obtain all necessary approvals at the community school and Department level in order to have access to the new or additional funding, which can take several days or weeks. However, the controls were not designed to ensure the Department made the amounts due to each LEA available within five months of the LEA?s start or expansion date. The Department did not start allocating additional funds for all three programs until January, 15, 2019, which is near the due date because most schools begin classes the third week of August. As a result, one of four (25%) new and significantly expanded community schools selected for testing was not provided the required new funding for Special Education Cluster and Supporting Effective Instruction State Grant in a timely manner as required by 34 C.F.R. Part 76.793(a). The LEA started operations on August 22, 2018 and was due the Special Education Cluster and Supporting Effective Instruction State Grant funds by January 22, 2019. However, the Special Education Cluster funding was not allocated until February 6, 2019 and the Supporting Effective Instruction State Grant funding was not allocated until April 5, 2019. The community school did not have access to the funds until 96 days beyond the required timeframe. If controls do not exist or are not applied consistently, then program objectives may not be achieved. If community schools do not receive all funding they are eligible for in a timely manner, they may not be able to provide services at the appropriate level to the detriment of the students impacted for the Special Education Cluster, Title I Grants to LEAs, and Supporting Effective Instruction State Grant programs. In addition, this could subject the Department to sanctions or other penalties for these programs. Based on discussion with management and review of various documents, the issue was caused by the amount of time necessary for the Department to obtain the necessary data from the Education Management Information System (EMIS) and verify accurate poverty data was submitted by the community school during school year 2018-2019. We recommend the Department evaluate its current control procedures over the allocation of Special Education Cluster, Title I Grants to LEAs, and Supporting Effective Instruction State Grant funds to new and significantly expanded community schools and update them as necessary to reasonably ensure compliance with the requirements, specifically ensuring that community schools receive all funding they are eligible for in a timely manner.

SPECIAL EDUCATION CLUSTER ? SUBRECIPIENT MONITORING Finding Number: 2019-010 State Agency Number: EDU-02 CFDA Number and Title: 84.027/84.173 ? Special Education Cluster (IDEA) Federal Award Identification Number / Year: H027A170111-17A / 2017 H027A180111-18A / 2018 Federal Agency: Department of Education Compliance Requirement: Subrecipient Monitoring Repeat Finding from Prior Audit? No NONCOMPLIANCE AND MATERIAL WEAKNESS 2 C.F.R. Part 3474.1 gives regulatory effect to the Department of Education for 2 C.F.R. Part 200.331, which establishes requirements over subawards for pass-through entities and states, in part: All pass-through entities must: (b) Evaluate each subrecipient's risk of noncompliance with Federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate subrecipient monitoring described in paragraphs (d) and (e) of this section, . . . . . . (d) Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. . . . It is management?s responsibility to implement control policies and procedures to reasonably ensure compliance with program requirements. Effective controls require the Department evaluate each subrecipient?s risk of noncompliance and complete effective monitoring of subrecipient activities. During state fiscal year (SFY) 2019, the Department entered into 1,625 subaward agreements with 985 local educational agencies (LEAs) for the two programs in the Special Education Cluster, totaling approximately $442.4 million. The Office of Exceptional Children (OEC) uses a three-tiered (Self Survey, Desk Review, and On-site Review) risk assessment approach to monitor and assist LEAs in determining whether they are compliant with program requirements. Under this approach the Department is to annually monitor each LEA via one of these methods; those LEAs not selected for a desk or on-site review must complete a self-assessment review. However, OEC completed only five reviews (four on-site and one self-assessment) and started two other LEA reviews during SFY19. Therefore, the Department did not have effective internal controls designed to provide reasonable assurance that Special Education Cluster subawards were used for authorized purposes, in compliance with federal statutes, regulations, and the terms and conditions of the subawards, and that subaward performance goals were achieved. Without proper controls and monitoring over subrecipients, management cannot be reasonably assured that subawards are being used for authorized purposes, in compliance with federal statutes, regulations, and the terms and conditions of the subawards; or that subaward performance goals are being achieved. This could result in a misuse of funds and noncompliance with federal requirements, which could subject the Department to sanctions, other penalties, or having to repay part of the federal grant awards. Based on discussions with management and review of various documents, OEC management decided to focus on completing reviews of the 12 high risk LEAs remaining from the 2018 review cycle. As a result, OEC started only seven LEA reviews for SFY 2019. We recommend the Department evaluate its current control procedures and processes over Special Education Cluster subrecipient monitoring and update them as necessary to reasonably ensure compliance with 2 CFR 200.331(b) and (d). These procedures should include an accurate assessment of the risk of noncompliance for each LEA receiving Special Education Cluster funds and include appropriate reviews to monitor the activities of the LEAs to ensure the subaward is used for authorized purposes, in compliance with federal statutes, regulations, and the terms and conditions of the subaward, and that subaward performance goals are achieved. In addition, management should periodically monitor these activities to help ensure the procedures are performed timely and functioning as intended.

CHILD NUTRITION CLUSTER ? INVENTORY Finding Number: 2019-011 State Agency Number: EDU-03 CFDA Number and Title: 10.553/10.555/10.556/10.559 ? Child Nutrition Cluster Federal Award Identification Number / Year: 201818N109942 / 2018 201919N109942 / 2019 Federal Agency: Department of Agriculture Compliance Requirement: Special Tests and Provisions ? Accountability for USDA-Donated Foods Repeat Finding from Prior Audit? Yes Prior Audit Finding Number: 2018-005 NONCOMPLIANCE AND MATERIAL WEAKNESS 7 C.F.R. Part 250 contains rules and regulations for entities that receive donated foods from the United States Department of Agriculture (USDA) for use in child nutrition programs, including the National School Lunch Program (NSLP), part of the Child Nutrition Cluster (CNC). Specifically, 7 C.F.R. Part 250.19(a) requires that distributing agencies, recipient agencies, processors, and other entities must maintain accurate and complete records with respect to the receipt, distribution, and inventory of USDA-donated foods and warns that failure to maintain required records must be considered prima facie evidence of improper distribution or loss of donated foods and may result in a claim against such party for the loss or misuse of donated foods per 7 C.F.R. Part 250.16. It is management?s responsibility to implement control procedures to reasonably ensure compliance with these requirements. It is also management?s responsibility to implement an adequate system of internal controls to monitor the accuracy and completeness of accounting and inventory records pertaining to federal programs. As the pass-through entity of the CNC federal program for the State of Ohio, the Department oversees the distribution of USDA-donated food goods to various local schools throughout the year. Local schools order food from two USDA web systems - Web Based Supply Chain Management (WBSCM) and Fresh Fruit and Vegetables Order Receipt System (FFAVORS). The food is distributed either directly from USDA to the school (FFAVORS orders) or first to a storage facility or processor before being delivered to the school (WBSCM orders). For the NSLP, the Department contracted with two storage facilities to house these foods during the fiscal year and also contracted with a company to perform physical inventory counts of the donated foods in the facilities at year-end. The total value of all food distributed during state fiscal year (SFY) 2019 was $59.9 million dollars, while the value of the food distributed by the storage facilities was $12.3 million dollars; this is approximately 10.6 % and 2.2%, respectively, of the reported total CNC program expenditures. The Department receives data about the schools? food orders directly from WBSCM and FFAVORS and uploads the data into its Commodities Allocation Tracking System (CATS), an automated inventory process for administering and monitoring the foods donated by USDA. The Department?s procedures require it receive monthly activity reports from the storage facilities which are to be reconciled to CATS. The Department procedures also require that CATS is reconciled to the physical inventory counts of the donated foods in the storage facilities at year-end. However, the Department did not complete these reconciliations during the audit period due to a CATS issue that began in December 2017 and is still ongoing. Specifically, when school districts ordered foods from storage facilities and the number of units shipped by the storage facility differed from the number of units ordered, the shipment was not recorded in CATS. As a result, storage facility inventory in CATS as of June 30, 2019 was overstated by $7.3 million (651.5%) when compared to the physical inventory of foods on hand at the facilities. In addition, storage facility distributions in CATS during the audit period were understated by $7.9 million (64.5%) when compared to the storage facility?s portion of food commodity distributions recorded on the Schedule of Expenditures of Federal Awards for SFY 2019. Although the USDA data on food orders reconciled with food orders in CATS, the ending inventory and distributions by the storage facilities did not. A second aspect of the CATS system and the CNC program is that schools are reimbursed for the number of meals served and the type of students served, based upon the number of meals served in the prior year multiplied by the USDA commodity reimbursement rate, which only USDA can enter into WBSCM. However, Department staff incorrectly entered the reimbursement rate into CATS; $0.3450 instead of the USDA approved rate of $0.3425. As a result, approximately 160 million lunches were improperly valued at a higher rate, equaling approximately $400,000. The Department could not spend more in total to reimburse the schools than the amount it was allocated by USDA. However, this could affect an individual school district because the Department reallocates unused funds from one school district to another district that has a need greater than its initial allocation. Based on the conditions noted above, it appears the CATS system is not operating as intended, because the Department added a new File Transfer Protocol site that caused problems with importing the monthly activity delivery reports from the warehouses, and the Department did not maintain accurate and complete inventory records during SFY 2019 as required by 7 C.F.R. Part 250.19(a). If the Department does not maintain accurate and complete records of the donated foods, it is not complying with 7 C.F.R. Part 250.19(a). This could subject the Department to repayment for the value of any misplaced food to the USDA or replacement of the goods in-kind, or other sanctions and penalties. Inaccurate inventory records could also prevent schools from placing orders for available foods and lead to misuse or abuse of donated foods to the detriment of those who benefit from the program. In addition, an individual school may not be reimbursed for the appropriate amount it is due. Based on discussion with management and review of support documents, the Department did not have the resources to maintain accurate and complete inventory records after the CATS system failure and entry of the wrong rate was due to an oversight. We recommend the Department evaluate and strengthen its existing policies, procedures, and CATS system to ensure it updates and maintains complete and accurate inventory records. Management should periodically perform and review inventory reconciliations to ensure accuracy, completeness, and proper and timely resolution of variances or reconciling items noted. In addition, the Department should formally document and communicate these policies and procedures to all employees involved in the process and re-evaluate and update the procedures on a regular basis to address any necessary changes.

CACFP ? REPORTING Finding Number: 2019-012 State Agency Number: EDU-04 CFDA Number and Title: 10.558 ? Child and Adult Care Food Program Federal Award Identification Number / Year: 201818N109942 / 2018 201919N109942 / 2019 Federal Agency: Department of Agriculture Compliance Requirement: Reporting Repeat Finding from Prior Audit? Yes Prior Audit Finding Number: 2018-006 NONCOMPLIANCE AND MATERIAL WEAKNESS As part of administering the Child and Adult Care Food Program (CACFP), 7 C.F.R. Part 226.7(d) requires a final FNS-44, Report of the Child and Adult Care Food Program, report be submitted for each month ?no later than 90 days following the last day of the month covered by the report.? In addition to this ?90-day report?, which contains actual data only, instructions to the report state a "30-day report", which may contain actual and estimated data, is due ?on the last day of the month following the month being reported.? Report instructions also define "Estimated" as ?Projection of the number of meals that were served and are expected to be approved for reimbursement for which claims have not been received or approved by the reporting due date.? In addition, Parts A - Day Care Homes (reported monthly) and B - Participation (reported quarterly) of the report instructions state "Estimates for missing data should be included on the 30-Day report." It is management?s responsibility to implement control policies and procedures to reasonably ensure compliance with program requirements. Effective controls require management review reports for accuracy, completeness, and compliance with program rules and regulations prior to submission to the federal grantor agency. During 2019, the Department disbursed approximately $98.9 million in subsidy expenditures for CACFP. The Department had controls in place during the fiscal year for reviewing and submitting the required reports. When preparing reports for submission to the U. S. Department of Agriculture via the Food Program Reporting System (FPRS), the Management Analyst generates the support documents in the Claims Reimbursement and Reporting System (CRRS), which aggregates estimated and actual reporting data, including meals served and number of sponsors and sites. The Management Analyst enters the data into FPRS and checks it for validity. The Fiscal Manager then reviews the data to ensure its accuracy and completeness before certifying the report in FPRS. However, the Department included only actual data, but failed to also include projections/estimates for the number of participating entities and recipients in the Day Care Homes (Part A) and Participation (Part B) sections for three of three (100%) 30-day FNS-44 reports selected for testing. As a result, all three reports were significantly understated (10% or more) compared to the 90-day report. Without including estimated data for Parts A and B of the 30-day FNS-44 reports, the Department is not submitting accurate and complete reports to the federal grantor agency per the instructions provided. Providing significantly understated information to the federal grantor agency on interim reports makes them less effective for the federal grantor agency for monitoring and planning purposes. Any noncompliance could result in repayment, reduction, or elimination of federal funding or sanctions imposed by the federal grantor agency. Based on discussions with management and review of supporting documentation, it appears the Department interpreted the report instructions to mean that if any sponsor does not submit the data by the report due date, the state-wide data available in CRRS is incomplete (not missing) and therefore, not required to be included in the report. It also appears the Department?s approach for not including estimates in Parts A and B of the report has been in place for several years although the federal grantor agency has not provided guidance that it is acceptable. We recommend the Department contact the federal grantor agency to obtain guidance on what is considered ?missing data? versus ?incomplete data?, as well as how to approach/report estimates for Parts A and B of the 30-day FNS-44 reports. We also recommend the Department evaluate existing procedures and implement new procedures, if necessary, to provide reasonable assurance the 30-day FNS-44 reports submitted in FPRS are accurate and complete per the report instructions and guidance obtained from the federal grantor agency. Lastly, we recommend the Department establish procedures to periodically monitor its compliance with the report submission requirements and initiate necessary actions to resolve any noncompliance that results.

CACFP ? SPONSOR REVIEWS Finding Number: 2019-013 State Agency Number: EDU-05 CFDA Number and Title: 10.558 ? Child and Adult Care Food Program Federal Award Identification Number / Year: 201818N109942 / 2018 201919N109942 / 2019 Federal Agency: Department of Agriculture Compliance Requirement: Subrecipient Monitoring Repeat Finding from Prior Audit? Yes Prior Audit Finding Number: 2018-007 NONCOMPLIANCE AND MATERIAL WEAKNESS As part of administering the Child and Adult Care Food Program (CACFP), 7 C.F.R. Part 226.6 requires the Department provide technical and supervisory assistance to institutions and facilities to facilitate effective program operations; monitor progress toward achieving program goals; ensure compliance with all requirements of the program; and maintain documentation of supervisory assistance activities, including reviews conducted, corrective actions prescribed, and follow-up efforts. Specifically, 7 C.F.R. Part 226.6(m)(6) prescribes the frequency and number of required institution reviews and states, in part: (i) Independent centers and sponsoring organizations of 1 to 100 facilities must be reviewed at least once every three years. A review of such a sponsoring organization must include reviews of 10 percent of the sponsoring organization?s facilities; It is management?s responsibility to implement control policies and procedures to reasonably ensure compliance with program requirements. Effective controls require the Department monitor the frequency of each sponsor?s reviews to ensure they are completed in accordance with program rules and regulations. During state fiscal year (SFY) 2019, the Department completed reviews of 303 sponsors that participated in CACFP. Education Program Specialists are responsible for visiting these institutions, performing the required reviews, and completing various documents within the Claims Reimbursement Reporting System (CRRS) to evidence what they reviewed and the results. In addition, the Department maintains a CRRS tracking module that lists all participants of the program and when they were reviewed or are scheduled for review. However, the Department?s controls did not prevent noncompliance with the review requirements. As a result, for two of 25 (8%) reviews selected for testing (all sponsors with between 1 and 100 facilities), the Department performed the reviews four years after the previous review, which is not within the required three-year period. Not properly monitoring sponsor reviews could result in noncompliance with federal regulations. Noncompliance with the review requirements could subject the Department to sanctions or other penalties and a repayment of part of the grant award amount. Based on discussions with management and review of support documents, one review was not completed timely due to a staffing issue. The second review was not completed timely due to an oversight by the Education Program Specialist. We recommend the Department evaluate its existing sponsor review control procedures and update them as necessary to reasonably ensure all reviews are performed within the timeframes prescribed in 7 C.F.R Part 226.6(m)(6). We also recommend the Department establish procedures to periodically monitor its compliance with the review requirements and initiate necessary actions to resolve any noncompliance that results.

CHARTER SCHOOL MONITORING ? VARIOUS PROGRAMS Finding Number: 2019-014 State Agency Number: EDU-06 CFDA Number and Title: 84.010 ? Title I Grants to Local Educational Agencies 84.027 / 84.173 ? Special Education Cluster (IDEA) 84.367 ? Supporting Effective Instruction State Grants Federal Award Identification Number / Year: S010A170035 / 2017 (Title I) S010A180035 / 2018 (Title I) H027A170111 / 2017 (IDEA) H027A180111 / 2018 (IDEA) H173A170119 / 2017 (IDEA) H173A180119 / 2018 (IDEA) S367A170034 / 2017 (SEI) S367A180034 / 2018 (SEI) Federal Agency: Department of Education Compliance Requirement: Special Tests and Provisions - Oversight and Monitoring Responsibilities with Respect to Charter Schools with relationships with Charter Management Organizations Repeat Finding from Prior Audit? No NONCOMPLIANCE AND MATERIAL WEAKNESS 2 C.F.R. Part 3474.1 gives regulatory effect to the Department of Education for 2 C.F.R. Part 200.331, which establishes requirements over subawards for pass-through entities and states, in part: All pass-through entities must: . . . (c) Evaluate each subrecipient's risk of noncompliance with Federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate subrecipient monitoring described in paragraphs (d) and (e) of this section,. . . . . . (e) Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. . . . Additionally, Part N.3, Oversight and Monitoring Responsibilities with Respect to Charter Schools with Relationships with Charter Management Organizations [CMOs], of the ED-Cross-Cutting Section (2019 OMB Compliance Supplement) states: Additional requirements applicable to non-federal entities receiving federal funds include: (1) the Code of Federal Regulations requirements regarding conflicts of interest [2 C.F.R. 200.112 and 200.318], (2) the American Institute of Certified Public Accountants guidance regarding related-party transactions [AU Section 334], and (3) the GAO Green Book and COSO framework guidance regarding segregation of duties [Page 50] applicable to charter schools with relationships with CMOs. It is management?s responsibility to implement control policies and procedures to reasonably ensure compliance with program requirements. Effective controls require the Department complete a review of charter (community) schools with relationships with CMOs, including procedures to assess the risk posed by conflicts of interest, related party transactions, and insufficient segregation of duties. During state fiscal year (SFY) 2019, the Department had agreements with approximately 950 local educational agencies (LEAs), including 237 community schools with CMOs. The Department completed 922 reviews of the LEAs for the Title I Grants to Local Educational Agencies and Supporting Effective Instruction State Grants programs and five reviews for the Special Education Cluster during SFY 2019. The Department uses a three-tiered (Self Survey, Desk Review, and On-site Review) risk assessment approach to monitor and assist LEAs in determining whether they are compliant with program requirements. However, monitoring by the program divisions did not include procedures to assess the risk posed by conflicts of interest, related party transactions, and insufficient segregation of duties for community schools with relationships with CMOs as required by the federal grantor agency, although the Grants Management office did complete additional monitoring over 21 of the LEA?s that included procedures over conflicts of interest. Furthermore, the Department did not have effective internal controls designed to provide reasonable assurance that community schools with relationships with CMOs have effective controls to mitigate financial risks, provide for accountability over federal funds, and mitigate performance risks. Without proper controls and monitoring over community schools with CMOs, management is not complying with the federal grantor agency?s requirements for these programs and cannot be reasonably assured that the community schools have effective controls to mitigate financial risks, provide for accountability over federal funds, and mitigate performance risks. This could result in a misuse of funds and noncompliance with federal requirements, which could subject the Department to sanctions, other penalties, or having to repay part of the federal grant awards. Based on discussions with management and review of various documents, this issue was caused by the amount of time needed to develop and implement new risk assessment procedures, which the Department is currently developing. We recommend the Department evaluate its current control procedures and processes over subrecipient monitoring and update them as necessary to include specific procedures for community schools with CMOs. These procedures should include an assessment of the risk posed by conflicts of interest, related party transactions, and insufficient segregation of duties. The Department should also monitor these community schools to ensure controls are in place to mitigate financial risks, provide for accountability over federal funds, and mitigate performance risks, as well as track the correction of any identified non-compliance that results. In addition, management should periodically monitor these activities to help ensure the procedures are performed timely and functioning as intended.

TITLE I AND SUPPORTING EFFECTIVE INSTRUCTION ? MAINTENANCE OF EFFORT Finding Number: 2019-015 State Agency Number: EDU-07 CFDA Number and Title: 84.010 ? Title I Grants to Local Educational Agencies 84.367 ? Supporting Effective Instruction State Grant Federal Award Identification Number / Year: S010A170035 / 2017 (Title I) S010A180035 / 2018 (Title I) S367A170034 / 2017 (SEI) S367A180034 / 2018 (SEI) Federal Agency: Department of Education Compliance Requirement: Matching, Level of Effort, and Earmarking Repeat Finding from Prior Audit? No SIGNIFICANT DEFICIENCY 34 C.F.R. Part 299.5 established maintenance of effort (MOE) compliance standard requirements for the Title I Grants to Local Educational Agencies (LEA) and the Supporting Effective Instruction State Grants federal programs. 34 C.F.R. Part 299.5 states, in part: (a) General. An LEA receiving funds under an applicable program listed in paragraph (b) of this section may receive its full allocation of funds only if the SEA finds that either the combined fiscal effort per student or the aggregate expenditures of State and local funds with respect to the provision of free public education in the LEA for the preceding fiscal year was not less than 90 percent of the combined fiscal effort per student or the aggregate expenditures for the second preceding fiscal year. (b) Applicable programs. This subpart is applicable to the following programs: (1) Part A of title I (Improving Basic Programs Operated by Local Educational Agencies). . . . (3) Part A of title II (Supporting Effective Instruction). . . . If an LEA fails the MOE requirement for a program in the current year?s calculation, the Department is to reduce the LEA?s program allocation by a proportionate share if the LEA also failed the requirement in one or more of the previous five years, unless the LEA qualifies for a waiver. It is management?s responsibility to implement control policies and procedures to reasonably ensure an LEA has met the MOE compliance requirement and is eligible to receive the full allocation of program funds. Effective controls require the Department document its determination of how the LEA complied with the MOE requirement based on the LEA?s expenditures, as allowed by 34 C.F.R. Part 299.5(a). During state fiscal year (SFY) 2019, the Department?s Office of Federal Programs (OFP) monitored LEA compliance with MOE requirements for the Title I Grants to Local Educational Agencies and Supporting Effective Instruction State Grants programs through data uploaded from EMIS (Education Management Information System) into the CCIP (Continuous Comprehensive Improvement Plan) system?s MOE Application module. EMIS is the statewide data collection system by which LEAs are required to report data, including all LEA expenditures and Average Daily Membership, to the Department. The Department?s Information Technology Office (ITO) notifies OFP when EMIS is closed and the data is available for entry into the MOE Application module. Using this data, OFP determines whether LEAs met the MOE requirement. The Education Program Specialist contacts and investigates only those LEAs that do not meet the MOE requirement for additional information and support to help with the MOE determination. However, the Department did not have a control to verify the comparisons included all necessary expenditures for the 27 LEAs that participate in school-wide pooling and use local Fund 598. As a result, for these 27 of 1,012 (2.7%) LEAs for which calculations were completed, the Department did not include all the expenditures for both years of the MOE comparison; the 2017 local Fund 598 expenditures were not included. After the Department was notified of the error, it made the MOE comparisons again with the correct data to confirm the affected LEAs had met the MOE requirement, as originally determined. Not using complete and accurate data in the MOE comparisons may result in the Department determining that LEAs met the MOE requirement when they did not. This could result in LEAs receiving the full allocation of federal funds instead of a reduced amount. Noncompliance on the part of the LEA or the Department could result in federal funds being reduced, taken away, or other sanctions imposed by the federal grantor agency. Based on discussions with management and review of supporting documentation, these conditions were the result of an IT error. The IT Specialist mistakenly calculated the Fund 598 logic which reduced the 2017 Fund 598 expenditure amounts to $0 for the 27 LEAs using Fund 598. We recommend the Department evaluate its current control procedures and processes over determining whether LEAs met the MOE requirement for the Title I Grants to Local Educational Agencies and Supporting Effective Instruction State Grants programs and update them as necessary to reasonably ensure MOE determinations are made based on complete and accurate data. We recommend the Department ensure future MOE determinations include all of the corresponding expenditures for both years of the comparison, specifically for LEAs that have local Fund 598 expenditures. This entails the Department test any coding enhancements to the MOE system prior to placing the changes into production. We also recommend the Department establish procedures to periodically monitor its compliance with the related controls and MOE requirements, and initiate necessary actions to resolve any noncompliance that results.

CCDF CLUSTER / TANF / SSBG ? INELIGIBLE RECIPIENT AND MISSING DOCUMENTATION Finding Number: 2019-016 State Agency Number: JFS-02 CFDA Number and Title: 93.575/93.596 ? CCDF Cluster 93.558 ? TANF Cluster 93.667 ? Social Services Block Grant Federal Award Identification Number / Year: 1701OHCCDF / 2017 (CCDF Cluster) 1801OHCCDF / 2018 (CCDF Cluster) 1901OHCCDD / 2019 (CCDF Cluster) 1901OHCCDM / 2019 (CCDF Cluster) 1701OHTANF / 2017 (TANF Cluster) 1801OHTANF / 2018 (TANF Cluster) 1901OHTANF / 2019 (TANF Cluster) 1801OHSOSR / 2018 (SSBG) 1901OHSOSR / 2019 (SSBG) Federal Agency: Department of Health and Human Services Compliance Requirement: Eligibility Repeat Finding from Prior Audit? No QUESTIONED COSTS, NONCOMPLIANCE, & MATERIAL WEAKNESS (TANF CLUSTER) $1,080 MATERIAL WEAKNESS (CCDF CLUSTER AND SOCIAL SERVICES BLOCK GRANT) 45 C.F.R. Part 98.20, A Child?s Eligibility for Child Care Services states, in part: (a) To be eligible for services under ??98.50, a child shall, at the time of eligibility determination or redetermination: (1)(i) Be under 13 years of age; or, (ii) At the option of the Lead Agency, be under age 19 and physically or mentally incapable of caring for himself or herself, or under court supervision; ? (3)(i) Reside with a parent or parents who are working or attending a job training or educational program; or (ii) Receive, or need to receive, protective services, which may include specific populations of vulnerable children as identified by the Lead Agency, and reside with a parent or parents other than the parent(s) described in paragraph (a)(3)(i) of this section. (A) At grantee option, the requirements in paragraph (a)(2) of this section may be waived for families eligible for child care pursuant to this paragraph, if determined to be necessary on a case-by-case basis. ? In addition, 45 C.F.R. Part 98.45(k) states that ?Lead Agencies shall establish, and periodically revise, by rule, a sliding fee scale(s) for families that receive CCDF child care services...? 45 C.F.R. Part 260, General Temporary Assistance for Needy Families (TANF) Provisions states, in section 31(a): (1) The term ?assistance? includes cash, payments, vouchers, and other forms of benefits designed to meet a family's ongoing basic needs (i.e., for food, clothing, shelter, utilities, household goods, personal care items, and general incidental expenses). (2) It includes such benefits even when they are: (i) Provided in the form of payments by a TANF agency, or other agency on its behalf, to individual recipients; and (ii) Conditioned on participation in work experience or community service (or any other work activity under ??261.30 of this chapter). (3) Except where excluded under paragraph (b) of this section, it also includes supportive services such as transportation and child care provided to families who are not employed. . . 42 U.S.C. Part 1397a relates to payments to States for the Social Services Block Grant (SSBG) and states in section (a)(2), in part: . . . (A) services which are directed at the goals set forth in section 1397 of this title include, but are not limited to, child care services, protective services for children and adults, services for children and adults in foster care, services related to the management and maintenance of the home, day care services for adults, transportation services, family planning services, training and related services, employment services, information, referral, and counseling services,? It is management?s responsibility to design and implement internal controls to reasonably ensure compliance with federal and state laws and regulations. During state fiscal year (SFY) 2019, the Department disbursed approximately $658.8 million in federal assistance to child care providers for eligible recipients from the CCDF Cluster, TANF Cluster, and SSBG programs based on information provided by the 88 County Department of Job and Family Services (CDJFS). The CDJFS case workers are to obtain and maintain a completed and signed application, determine the income and other key information from each applicant, and enter this information into the State?s Child Care Information Data System (CCIDS) for eligibility and benefit/co-pay amount determinations. The CCIDS eligibility module analyzes the recipient?s information entered into the application screens and utilizes it to determine the applicable federal program eligibility, as identified in the system by pay source codes. However, the controls did not prevent or detect the following errors noted during testing of 60 CCDF Cluster case files for compliance with federal and state eligibility rules and regulations at 10 selected CDJFS: ? For five (8.3%) cases, supporting documentation could not be located/provided for child support services/income reported in CCIDS for the CCDF, TANF, or SSBG programs. These cases (three at Montgomery, one at Lorain, and one at Lucas) had missing verifications or missing applications and/or no signed applications on file; however, the benefit/co-pay was not affected. ? For one (1.7%) case (Butler), the CDJFS utilized incorrect income verifications causing the benefit/co-pay to be affected for the TANF program. As a result, we will question all benefits paid to the child care provider on the recipient?s behalf, totaling $1,080 (projected to an amount greater than $25,000). Without obtaining, maintaining, or reviewing the required documentation on file, the Department may not be able to fully support or ensure benefit payments are made for the proper amounts to or on behalf of eligible recipients. This could result in questioned payments or fines, penalties, or other sanctions imposed by the federal grantor agency. Based on discussions with Department and CDJFS management, the missing documents were not maintained upon application intake was an oversight by the case worker. The overpayment was due to the caseworker not accurately completing the appropriate screens within CCIDS based on the supporting documentation provided by the recipient. We recommend Department management evaluate and strengthen the existing controls at both the State and CDJFS levels to identify where improvements can be made to minimize the risks of inaccurate co-payment and benefit determinations. We also recommend the Department periodically monitor the established controls to determine if they are working as intended by management. In addition, Department management should perform periodic reviews of the case files to reasonably ensure case file information is properly maintained and accurately entered into the system.

SNAP CLUSTER AND TANF CLUSTER ? ELIGIBILITY SYSTEM Finding Number: 2019-017 State Agency Number JFS-03 CFDA Number and Title: 10.551/10.561 SNAP Cluster 93.558 TANF Cluster Federal Award Identification Number / Year: 172OH102S8026 / 2017 (SNAP Cluster) 172OH102S8069 / 2017 (SNAP Cluster) 182OH102S8026 / 2018 (SNAP Cluster) 182OH102S8069 / 2018 (SNAP Cluster) 192OH102S8026 / 2019 (SNAP Cluster) 192OH102S8069 / 2019 (SNAP Cluster) 1701OHTANF / 2017 (TANF Cluster) 1801OHTANF / 2018 (TANF Cluster) 1901OHTANF / 2019 (TANF Cluster) Federal Agencies: Department of Agriculture Department of Health and Human Services Compliance Requirement: Eligibility Repeat Finding from Prior Audit? No NONCOMPLIANCE AND MATERIAL WEAKNESS NOTE: Finding numbers 2019-001 , 2019-005, 2019-018, and 2019-022 contain additional information which is integral to and should be read in conjunction with this finding. 7 C.F.R. Part 272.10(b)(1)(i), pertaining to the SNAP Cluster, states in part, that a State?s system should: Determine eligibility and calculate benefits or validate the eligibility worker?s calculations by processing and storing all casefile information necessary for the eligibility determination and benefit computation (including but not limited to all household members? names, addresses, dates of birth, social security numbers, individual household members? earned and unearned income by source, deductions, resources and household size)? 45 C.F.R. Part 206.10(a), pertaining to public assistance programs, including TANF, states in part: ? (8) Each decision regarding eligibility or ineligibility will be supported by facts in the applicant?s or recipient?s case record? ? (12) The State agency shall establish and maintain methods by which it shall be kept currently informed about local agencies' adherence to the State plan provisions and to the State agency's procedural requirements for determining eligibility, and it shall take corrective action when necessary. As the lead agency responsible for administering the SNAP and TANF federal grant awards for the State of Ohio, the Department is responsible for providing reasonable assurance only eligible individuals receive assistance and documentation maintained is accurate, complete, and properly recorded in the Ohio Benefits system to ensure appropriate eligibility determinations. It is the Department?s responsibility to implement sufficient controls, systems, processes, and procedures to reasonably ensure compliance with the rules and regulations associated with these programs and only eligible recipients receive benefits. The Department is responsible for overall program compliance and must have appropriate oversight and monitoring procedures in place to ensure those they rely on are operating in accordance with all expectations, guidelines, and requirements related to their tasks. During state fiscal year (SFY) 2019, the Department disbursed a combined total of $2.2 billion in public assistance payments, to recipients processed through the Ohio Benefits system related to the following programs: Federal Program Benefits Paid # of Recipients * 10.551/10.561 ? SNAP Cluster $2,008,412,067 1,379,247 93.558 ? TANF Cluster $210,156,426 91,506 Combined Total $2,218,568,493 1,470,753 * We did not separately identify recipients who could be covered under both programs The information below summarizes Finding 2019-001 as it relates to the control process and weaknesses identified related to eligibility for the SNAP Cluster. These issues also apply to the TANF Cluster and additional information was added, where necessary, to identify any errors related to the TANF Cluster. These programs are administered using a multi-agency approach, as follows: overall compliance and administration of the SNAP and TANF Clusters fall under the Department, and programming and administration of the State?s eligibility determination computer system, Ohio Benefits, falls under the Ohio Department of Administrative Services. In August 2018, the SNAP and TANF Clusters were added to the Ohio Benefits system. The Department also utilizes the 88 Ohio counties in the eligibility determination process to work with applicants, receive/enter eligibility documentation into the Ohio Benefits system, and follow up on alerts issued by the system. SYSTEM/CONTROL ISSUES Currently, individuals applying to receive public assistance benefits complete an application through various methods. The County Departments of Job & Family Services (CDJFS) offices collect and maintain any documentation provided by the individual either in a paper case file or in the OnBase Electronic Documentation Management System (EDMS), which is maintained under contract by the Ohio Department of Administrative Services. After collecting documentation, the county caseworker enters the individual?s information into the Ohio Benefits system which determines the initial eligibility benefit amount and assigns the benefit aid category, where applicable. Once the determination is made, the Ohio Benefits system uploads the eligibility information to the Department?s payment system to process the payment. During SFY 2019, we noted the several weaknesses/defects in the eligibility process, as listed below: ? Alerts ?During SFY 2019, an overwhelming volume alerts were sent to the counties for investigation and follow-up (more than 5.3 million alerts were issued according to DAS records; 1.6 million related to Income Eligibility Verification Systems (IEVS) alerts and 3.7 million to non-IEVS alerts). This resulted in an unmanageable workload and ineffective application of the alert process. As a result of the extremely high number of alerts and defects in the Ohio Benefits system, the Department suspended their Fraud Control Triad Reviews until the defects can be corrected. In addition, the Ohio Benefits System had the following design defects/weaknesses related to alerts: ? Multiple and repetitive alerts (redundancy). ? Irrelevant alerts (zero or small dollar amounts). ? Additional steps required to complete an alert (having to leave the alert window, opening an Ohio Benefits window, and then having to go back through the Alert Inventory to clear the alert). ? Alerts being received on persons not receiving public assistance. ? Overwriting ? the Ohio Benefits system maintains several pieces of key information related to a recipient?s eligibility (income, household size, age, etc.). However, there is no system warning or other control in place to identify or prevent caseworkers from overwriting this data when new information is identified instead of adding the new information, as intended. In addition, a system defect prevents caseworkers from viewing the previous case information. ? Caseworker Reliance/Training ? Training for county caseworkers, whose knowledge and judgement are relied heavily upon, is typically optional and/or attended by a representative of the county who is expected to relay the information to others. ? Multi-program Info ? There are certain pieces of key information (i.e. name, income, age, etc.) maintained in the Ohio Benefits system which impact all public assistance programs, including SNAP, TANF, Medicaid, and Children?s Health Insurance Program (CHIP). However, the system currently does not link this information between programs, but relies on county caseworkers to manually adjust each affected program separately when a change occurs. ? Additionally, the following system design weaknesses/defects in the Ohio Benefits system were brought to our attention by the Department of Medicaid which could have an impact on the SNAP and TANF programs: ? The system auto-populated a new browser window/case with incorrect data if a case worker did not close a prior case file. ? The system sometimes incorrectly linked newborns to individuals who were not their actual parents. In one instance, this resulted in a newborn being linked to an eleven-year old child. ? The system was not generating a PDF for a case worker to access within the system when an e-app was filed by a recipient. ? The system was not end-dating pregnancy records over 10 months, but did generate an alert for the county worker to investigate. However, if the alert was not resolved, the individual remained open as a pregnant woman until the next eligibility determination. ? We noted several weaknesses/issues regarding the contract and monitoring related to the OB system in Finding Number 2019-005 for the Department of Administrative Services. These issues, which impact the Department?s responsibilities regarding monitoring, updates, and program compliance, are summarized below: ? The signed agreements/amendments did not separately require MCD signatures, and ODJFS was not included on amendments. ? Signed interagency agreements defining each agency?s responsibilities and the data governance structure have not been completed. ? No evidence of monitoring procedures related to the Independent Verification and Validation (IV&V) reports prepared by a third-party evaluator. ? No formalized documentation/tracking of reviews/evaluations/certifications performed or required for the OB system by outside or internal reviewers. NONCOMPLIANCE ISSUES In addition, our testing identified the following noncompliance with the documentation required to support eligibility for these programs: ? For three of 60 (5%) TANF Cluster case files tested at 10 CDJFS, the CDJFS (Franklin County) did not maintain proper eligibility documentation in either the case file or EDMS, specifically the application; however, the benefit amount was not affected. ? For two of 60 (3.3%) SNAP Cluster case files tested at the 10 CDJFS, the CDJFS (Summit and Butler) did not maintain proper eligibility documentation in either the case file or EDMS, specifically the application, however the benefit amount was not affected. In addition, one case identified through non-sampling procedures identified an income amount not supported by proper documentation at the CDJFS (Hamilton) in either the case file or EDMS. As a result, benefits were overpaid to this recipient for an amount below the questioned cost threshold. Without proper controls for entering, processing, and maintaining recipient information and system alerts, there is an increased risk that benefits paid to or on behalf of recipients will be inaccurate or unallowable. This risk is substantially increased if the State?s eligibility determination system, Ohio Benefits, contains design or operational flaws that could impact a recipient?s eligibility and, as a result, could have a material impact on the amounts reimbursed by the federal government. These weaknesses/defects could allow undue subjective decisions, jeopardize accurate eligibility processing, and/or result in improper payments or federal reimbursements. Overpayments or payments to or on behalf of ineligible recipients may subject the Department to penalties or sanctions which may jeopardize future funding and limit its ability to fulfill program requirements to provide benefits to those in need. Based on discussions with management, human error and systemic issues led to the issues identified. RECOMMENDATIONS We recommend management of the Department work collectively with the related state agencies to implement/update robust processes, procedures, and system programming to address the weaknesses in the overall eligibility process, including those associated with the Ohio Benefits system. These changes/updates should include, but not be limited to: ? Redesigning the alert process to be more effective and efficient. This could include a more centralized evaluation of alert activity and/or better use of automated tools to vet and prioritize items requiring follow-up. This would allow Department level personnel to become more experienced and adept at identifying and investigating anomalies and help focus the resources of both Department and county personnel. ? Identifying and coordinating program changes to address the system design weaknesses/defects identified above, including the issues with overwriting data and ensuring all data stored in the system is available/viewable by users. Working collaboratively with the related state agencies to prioritize program changes which could directly impact the eligibility determinations or benefit amounts to ensure they are corrected in a timely manner to prevent and detect improper payments. ? Creating a centralized database of recipient information shared among multiple public assistance programs, or otherwise linking this information so that a change only has to be entered once in Ohio Benefits and all programs are updated accordingly. ? Requiring mandatory training for all CDJFS employees who are entering the assistance group information into Ohio Benefits to help ensure proper and complete information is being collected, entered, and verified prior to an individual?s eligibility determination being made. An initial training should be provide to ensure all users are knowledgeable of the process, procedures, and impacts of the work they do. As changes occur to the rules/regulations, system, or process, detailed training should be required of all users on those changes. ? Regularly evaluate selected benefit payments for all programs to verify the recipient?s eligibility, verify the recipient information entered into Ohio Benefits by the CDJFS is accurate and the information is being maintained to support the Department?s eligibility decision. Any problems noted should be promptly corrected to reduce the risk of benefit payments being made to or on behalf of ineligible individuals and additional training provided to the Department and/or county employees affected. ? Ensuring that vendor contacts/amendments, and interagency agreements are formalized, contain all parties of the agreements, and fully and clearly define the roles, responsibilities, and expectations related to each party. ? Ensuring that appropriate and coordinated monitoring and tracking procedures are in place regarding reviews and the timely remediation of issues identified, including, but not limited to: ? A data governance structure designed to ensure data quality and reliability for management, the grantor agencies, and other users of this information. This should include data subject matter experts from each related agency to help ensure quality of data requests before external and internal users rely on the data, issues are addressed with a clear escalation path, and establishing accountabilities and alignment between the related agencies. ? Appropriate monitoring procedures related to the IV&V reports prepared by the third-party evaluator. ? Coordinating and managing the contract contents with the developing vendor to help ensure all contract and amendment deliverables are being met. ? A formalized documentation/tracking process of reviews/evaluations/certifications performed or required for the OB system. Auditor of State?s Conclusion The State of Ohio?s Corrective Action Plan for this finding required an Auditor of State?s Conclusion. [INSERT CONCLUSION ONCE APPROVED BY CFAE]

IEVS ALERTS ? SNAP AND TANF Finding Number: 2019-018 State Agency Number JFS-04 CFDA Number and Title: 10.551/10.561 SNAP Cluster 93.558 TANF Cluster Federal Award Identification Number / Year: 172OH102S8026 / 2017 (SNAP Cluster) 172OH102S8069 / 2017 (SNAP Cluster) 182OH102S8026 / 2018 (SNAP Cluster) 182OH102S8069 / 2018 (SNAP Cluster) 192OH102S8026 / 2019 (SNAP Cluster) 192OH102S8069 / 2019 (SNAP Cluster) 1701OHTANF / 2017 (TANF Cluster) 1801OHTANF / 2018 (TANF Cluster) 1901OHTANF / 2019 (TANF Cluster) Federal Agencies: Department of Agriculture Department of Health and Human Services Compliance Requirements: Eligibility, Special Tests and Provisions ? Income Eligibility Verification System Repeat Finding from Prior Audit? Yes Prior Audit Finding Number: 2018-011 NONCOMPLIANCE AND MATERIAL WEAKNESS NOTE: Finding numbers 2019-001, 2019-005, and 2019-017 contain additional information which is integral to and should be read in conjunction with this finding. 7 C.F.R. Part 272.8(c), states the following regarding the Supplemental Nutrition Assistance Program (SNAP) Cluster: (1) State agency action on information items about recipient households shall include: (i) Review of the information and comparison of it to case record information; (ii) For all new or previously unverified information received, contact with the households and/or collateral contacts to resolve discrepancies as specified in ???273.2(f)(4)(iv) and 273.2 (f)(9)(iii) and (f)(9)(iv); and (iii) If discrepancies warrant reducing benefits or terminating eligibility, notices of adverse action. (2) State agencies must initiate and pursue the actions on recipient households specified in paragraph (c)(1) of this section so that the actions are completed within 45 days of receipt of the information items. Actions may be completed later than 45 days from the receipt of information if: (A) The only reason that the actions cannot be completed is the nonreceipt of verification requested from collateral contacts; and (B) The actions are completed as specified in ? 273.12 of this chapter when verification from a collateral contact is received or in conjunction with the next case action when such verification is not received, whichever is earlier. (3) When the actions specified in paragraph (c)(1) of this section substantiate an over issuance, State agencies must establish and take actions on claims as specified in ??273.18 of this chapter. (4) State agencies must use appropriate procedures to monitor the timeliness requirements in paragraph (c)(2) of this section. 45 C.F.R. Part 205.56(a)(1)(iv) states the following regarding the Temporary Assistance for Needy Families (TANF) Cluster: For individuals who are recipients when the information is received or for whom a decision could not be made prior to authorization of benefits, the State agency shall within forty-five (45) days of its receipt, initiate a notice of case action or an entry in the case record that no case action is necessary, except that: Completion of action may be delayed beyond forty-five (45) days on no more than twenty (20) percent of the information items targeted for follow-up, if: (A) The reason that the action cannot be completed within forty-five (45) days is the nonreceipt of requested third-party verification; and (B) Action is completed promptly, when third party verification is received or at the next time eligibility is redetermined, whichever is earlier. If action is completed when eligibility is redetermined and third party verification has not been received, the State agency shall make its decision based on information provided by the recipient and any other information in its possession. It is management?s responsibility to implement controls, processes, and procedures to ensure compliance with these regulations. When automated systems are utilized to perform certain functions related to this compliance, management must ensure the system is properly designed and operating effectively. In August 2018, the Department fully converted from the old CRIS-E system to the Ohio Benefits system for processing eligibility for the SNAP Cluster and TANF Cluster programs with total expenditures to recipients of approximately $2 billion and $210 million, respectively, in state fiscal year (SFY) 2019. Ohio Benefits, administered by the Ohio Department of Administrative Services (DAS) for various public assistance programs, includes an Income Eligibility Verification System (IEVS) which compares income, as reported by the recipients, to information maintained by outside sources. Information that does not appear to agree is communicated in the form of an Ohio Benefits system alert, which is forwarded to the appropriate county for investigation and resolution. During SFY 2019, for the SNAP and TANF programs, more than 5.3 million alerts were issued (1.6 million related to IEVS alerts and 3.7 million to non-IEVS alerts). The Department?s programs were not included in the initial launch of the Ohio Benefits system; therefore, the Department began by testing the Ohio Benefits system at five pilot counties in SFY 2018. The Department indicated that, during this testing period, they identified and reported to DAS an error in the IEVS filtering logic which created an overwhelming volume of information being sent to the counties resulting in an unmanageable workload and ineffective application of the alert process. They instructed the caseworkers to continue their efforts to work and clear these alerts while the Department worked with DAS and the Ohio Benefits contractor to identify and remedy the reason for the large increase in alerts. However, the Department made a business decision to move forward with the full roll-out of Ohio Benefits to all counties in August 2018, even though a remedy was not in place for the filtering defect. They also determined an updated IEVS processing guide and additional monitoring procedures would not be completed until the defects were corrected in Ohio Benefits. Therefore, as a result of the new eligibility system, staffing turnover/shortages, the caseworkers not being provided appropriate training, the large increase in alerts, the Department did not have controls or procedures in place to review and monitor the IEVS alerts generated and processed by the Ohio Benefits system to ensure they were being completed by the counties in accordance with the requirements and timeframes established in 7 C.F.R. Part 272.8, and 45 C.F.R. Part 205.56. Furthermore, an Ohio Benefits report showed 507,886 of the 940,918 (54%) IEVS alerts sent to the counties during the audit period were not cleared within 45 days as required. The alerts were cleared between one and 514 days beyond the 45-day requirement, for an average of 254 days late. Failure to provide CDJFS with guidance/procedures for working IEVS alerts, perform monitoring activities, and complete IEVS alerts within the established timeframes increases the risk benefits given to ineligible recipients or for inappropriate amounts will not be identified timely. This condition could adversely affect the Department?s ability to comply with requirements of these federal programs. Failure to comply with the requirements related to IEVS could also result in federal sanctions or penalties. Based on discussions with management, IEVS filtering logic was not properly communicated to the Ohio Benefits contractor when IEVS was initially implemented. We recommend the Department work collectively with the related state agencies to implement/update robust processes, procedures, and system controls to address the weaknesses associated with the IEVS process within the Ohio Benefits system. These changes/updates should include, but not be limited to: ? Working with DAS and the Ohio Benefits contractor to take steps to ensure the IEVS filtering logic is properly programmed in the Ohio Benefits system; since the Department and counties rely upon it to ensure only relevant SNAP and TANF IEVS alerts are generated so they can be worked within the established due dates defined in the Code of Federal Regulations. ? Developing an IEVS alert processing procedures guide for the alerts issued by the Ohio Benefits system to ensure alerts are properly documented within the system, worked within the proper timeframes, and proper verification documentation is obtained and maintained by the counties for resolved alerts. ? Performing periodic and timely reviews at the Department level to monitor the status and completion of IEVS alerts. Such procedures should also include required monitoring by each County IEVS Coordinator or other supervisory personnel (through the eligibility system), which should be explicitly identified in the sub-grant agreements with the counties and include appropriate ramifications for noncompliance with the stated requirements. ? Implementing in-depth IEVS training for county caseworkers to ensure they have the knowledge to properly document and resolve IEVS alerts generated by the Ohio Benefits system. ? Including a more centralized evaluation of alert activity and/or better use of automated tools to vet and prioritize items requiring follow-up at the county level. This would allow Department level personnel to become more experienced and adept at identifying and investigating anomalies and help focus the resources of both Department and county personnel.

FOSTER CARE AND CHILD SUPPORT ENFORCEMENT ? FEDERAL REPORTING Finding Number: 2019-019 State Agency Number: JFS-05 CFDA Number and Title: 93.563 ? Child Support Enforcement 93.658 ? Foster Care ? Title IV-E Assistance Federal Award Identification Number / Year: 1804OHCSES / 2018 (Child Support) 1904OHCSES / 2019 (Child Support) 1801OHFOST / 2018 (Foster Care) Federal Agency: Department of Health & Human Services Compliance Requirement: Reporting Repeat Finding from Prior Audit? Yes Prior Audit Finding Number: 2018-013 NONCOMPLIANCE AND MATERIAL WEAKNESS 45 C.F.R. Part 75.302 contains the Department of Health and Human Services uniform administrative requirements for grants to state and local governments relating to financial administration and standards for financial management systems and states, in part: (a) Each state must expend and account for the Federal award in accordance with state laws and procedures for expending and accounting for the state?s own funds. In addition, the state?s and the other non-Federal entity?s financial management systems, including records documenting compliance with Federal statutes, regulations, and the terms and conditions of the Federal award, must be sufficient to permit the preparation of reports required by general and program-specific (b) terms and conditions; and the tracing of funds to a level of expenditures adequate to establish that such funds have been used according to the Federal statutes, regulations, and the terms and conditions of the Federal award. (b) The financial management system of each non-Federal entity must provide for the following (see also Part 75.361, .362, .363, .364, and .365): (2) Accurate, current, and complete disclosure of the financial results of each Federal award or program in accordance with the reporting requirements set forth in Part 75.341 and .342? (3) Records that identify adequately the source and application of funds for federally-funded activities. These records must contain information pertaining to Federal awards, authorizations, obligations, unobligated balances, assets, expenditures, income and interest and be supported by source documentation. It is management?s responsibility to implement control policies and procedures to reasonably ensure the federal reports they submit are accurate, complete, and in compliance with program requirements. It is imperative that management be able to provide the underlying data and related program documentation required to prepare and support these reports. The Department?s Bureau of Grants Management and Federal Reporting Services (the Bureau) is responsible for the preparation of various federal financial expenditure reports, including the quarterly Foster Care CB-496 and Child Support Enforcement OCSE-396. The Bureau runs reports from various computer systems, transfers this information to the applicable federal reports, and submits them for a two level review process prior to submitting them to the federal grantor agency. However, the Bureau?s review of federal reports was not adequate and/or operating effectively, which resulted in some reports being subsequently corrected. In addition, the following errors were identified in the reports tested during state fiscal year 2019: ? For the two (100%) Child Support Enforcement OCSE-396 reports selected for testing: o The September 2018 report included the following errors: ? Line 4 ADP Development with ADP Required Current Quarter Total and Federal Share was overstated by $2,746,276 / $1,812,542. The Bureau incorrectly reported the $3,761,424 in ADP Operations with ADP in the ADP Development Required line instead of the $1,015,148 in the ADP Development with ADP Required costs. ? Line 5 ADP Operational with ADP Required Current Quarter Total and Federal Share was understated by $234,362 / $154,679. The Bureau incorrectly reported the $3,527,062 in the ADP Operational with ADP Required line from the June 2018 OCSE-396 report instead of the $3,761,424 in the current quarter?s ADP Operational with ADP Required. ? Line 2b Program Income, Other was understated by $21,924 / $14,470. One of the items included in Line 2b includes the Star Ohio Interest Income. However, the Bureau only reported the $10,944 in interest income in September 2018 instead of the $32,868 in interest income for the three months ending in September 2018. The Bureau caught this error and included the $21,924 in the March 2019 report; however, this adjustment was included within the Current Quarter Claims instead of the Prior Quarter Adjustments. o The December 2018 quarterly report included the following errors: ? Line 1b Administrative Costs: Regular Current Quarter Total and Federal Share was overstated by $84,026 / $55,457. ? Line 2b Program Income, Other Current Quarter Total and Federal Share was understated by $23,461 / $15,484. One of the items included in Line 2b includes the Star Ohio Interest Income. However, the Bureau only reported the $12,407 in interest income for December 2018 instead of the $35,867 in interest income for the three months ending in December 2018. The Bureau caught this error and included the $23,460 in the March 2019 report; however, this adjustment was included within the Current Quarter Claims instead of the Prior Quarter Adjustments. ? For one of the two (50%) Foster Care CB-496 quarterly reports selected for testing (September 2018): o Line 15 Training Costs ? Staff and Provider (FFP 75%) Current Quarter Total and Federal Share columns were overstated by $4,552,423. The Bureau incorrectly reported $5,337,982 instead of $785,559. o Line 6 In-Placement Administrative Costs ? Eligibility Determination Current Quarter Total & Federal Share were understated by $12,196 / $6,098 and the Prior Quarter Claims and Federal Share were overstated by $12,196/ $6,098. The Bureau incorrectly included totals for the Current Quarter Total and Federal Share columns in the Prior Quarter Claims and Federal Share amounts. A lack of adequate internal controls over federal reporting increases the risk that reports submitted to the federal grantor agency are inaccurate. If the underlying data for the submitted reports cannot be readily verified, the Department and the federal government may not be reasonably assured the information is accurate and complete. Reporting inaccurate or incomplete information could subject the Department to federal sanctions, limiting the amount of funding for program activities. Based on discussions with management, these errors were due to technical issues with various systems, transferring incorrect information, and oversight. We recommend the Department evaluate current procedures and implement additional policies and procedures as necessary to provide reasonable assurance the data being reported for all federal programs is reasonable and accurate and agrees to supporting documentation. Specifically, the Department should implement procedures to ensure the various subtotals are complete and accurate and the amounts included in the report are properly classified. The Department should ensure all reports (and any necessary corrections to reports) are reviewed and approved by the appropriate level of management.

CASH MANAGEMENT ? VARIOUS PROGRAMS Finding Number: 2019-020 State Agency Number: JFS-06 CFDA Number and Title: 17.207/17.801/17.804 ? Employment Services Cluster 93.558 ? TANF Cluster 93.563 ? Child Support Enforcement Federal Award Identification Number / Year: ES318671855A39 / 2018 (ES Cluster) 1801OHTANF / 2018 (TANF Cluster) 1804OHCSES / 2018 (Child Support) Federal Agencies: Department of Labor Department of Health and Human Services Compliance Requirement: Cash Management Repeat Finding from Prior Audit? Yes Prior Audit Finding Number: 2018-014 NONCOMPLIANCE AND MATERIAL WEAKNESS ? EMPLOYMENT SERVICES CLUSTER AND CHILD SUPPORT ENFORCEMENT NONCOMPLIANCE AND SIGNIFICANT DEFICIENCY ? TANF CLUSTER U.S. Treasury regulations, 31 C.F.R. Part 205, which implemented the Cash Management Improvement Act of 1990 (CMIA), require state recipients enter into agreements that prescribe specific methods of drawing down Federal funds (funding techniques) for selected large programs. The Department's Temporary Assistance for Needy Families (TANF) cluster and Child Support Enforcement programs are covered by such an agreement. The state fiscal year (SFY) 2019 CMIA Agreement between the State of Ohio and the United States Department of the Treasury specifically requires the State use the Modified Pre-Issuance technique of drawing federal funds for certain types of draws related to these programs. Paragraph 6.2.4 of the CMIA agreement requires the following for the Modified Pre-Issuance funding technique: The State of Ohio?s accounting system requires funding to be available prior to initiating a disbursement. In addition, disbursements take two business days to produce a payment. Given this fact pattern, State of Ohio agencies are typically unable to meet the three business day requirement and an eight business day requirement is necessary for agency compliance with this agreement. The State shall request funds such that they are deposited in a State account not more than eight business days prior to the day the State makes a disbursement. The request shall be made in accordance with the appropriate Federal agency cut-off time specified in Exhibit I. The amount of the request shall be the amount the State expects to disburse. This funding technique is not interest neutral. The Employment Services Cluster (ES) was not included in the SFY 2019 CMIA Agreement; therefore, 31 C.F.R. Part 205.33(a) sets guidelines which state the following: A State must minimize the time between the drawdown of Federal funds from the Federal government and their disbursement for Federal program purposes. A Federal Program Agency must limit a funds transfer to a State to the minimum amounts needed by the State and must time the disbursement to be in accord with the actual, immediate cash requirements of the State in carrying out a Federal assistance program or project. The timing and amount of funds transfers must be as close as is administratively feasible to a State's actual cash outlay for direct program costs and the proportionate share of any allowable indirect costs? The Department draws federal funds for the ES Cluster similarly to those which follow the Modified Pre- Issuance funding technique and considers eight business days a reasonable amount of time to disburse the drawn federal funds for program expenses. It is management?s responsibility to implement control policies and procedures to reasonably ensure draws of federal funds are for immediate cash needs, processed accurately, and disbursed timely in accordance with applicable laws and regulations. During SFY 2019, the Department drew down approximately $830 million for the major federal programs listed above. The Department has partnered with the Office of Budget and Management (OBM)?s Office of Shared Services (OSS) to process transactions. OSS enters the information for these transactions into the Ohio Administrative Knowledge System (OAKS), after which the Department and OBM review and approve them. The Department then draws down the funds to pay these expenditures. Generally, a Fiscal Specialist in the Federal Cash Draw Unit of the Bureau of Cash and Cost Reporting Services calculates the amount of funds to be drawn based on the Department's cash needs (payroll, administrative costs, county advances, etc.) and the current cash on hand. In addition, the Cash Management Section Supervisor reviews and investigates any discrepancies on the Summary Tracking Report, which lists the grant activities (award amounts, revenue draws, expenditures, and remaining balances) for the federal programs monthly. This document provides a mechanism for the Department to monitor its draws with expenditures on a cumulative basis although it does not match up specific draws and expenditures. However, the Department's controls did not prevent noncompliance with the cash management requirements. ? Of 25 disbursements tested from 25 draws, the Department did not disburse two ES Cluster payments (8%) within eight business days of the receipt of the federal funds, as required by 31 C.F.R. Part 205.33(a). The Department disbursed the funds two and seven days after the required disbursement date. ? Of 25 disbursements tested from 25 draws, the Department did not disburse two Child Support Enforcement payments (8%) within eight days of the receipt of the federal funds, as required by the CMIA agreement. The Department disbursed the funds one and two days after the required disbursement date. ? Of 25 disbursements tested from 25 draws, the Department did not disburse one TANF Cluster payment (4%) within eight days of the receipt of the federal funds, as required by the CMIA agreement. The Department disbursed the funds seven days after the required disbursement date. Not having effective controls over the timely disbursement of federal funds could lead to the Department not limiting draws to immediate cash needs and not expending funds timely. This could result in noncompliance with the CMIA Agreement and 31 C.F.R. Part 205.33(a). These conditions could subject the Department to sanctions or other penalties and a repayment of part of the grant award amounts. In addition, noncompliance could subject the Department to paying interest charges on these draws. Based on discussions with management and review of supporting documents, the errors were due to processing and approval delays. We recommend the Department evaluate its existing cash management control procedures and update them as necessary to reasonably ensure all federal draw requests are disbursed timely and are drawn only for immediate cash needs, based on the funding technique established for each federal program in the CMIA Agreement or in accordance with 31 C.F.R. Part 205.33(a). If delays in the disbursements are caused by external factors, we recommend the Department communicate with other entities to develop reasonable solutions and follow established protocols, including reinforcing the time period in which their payments should be entered, approved, and paid. We also recommend the Department establish procedures to periodically monitor its compliance with the cash management requirements and initiate necessary actions to resolve any noncompliance that results.

SUBRECIPIENT MONITORING ? VARIOUS PROGRAMS Finding Number: 2019-021 State Agency Number: JFS-07 CFDA Number and Title: 10.551/10.561 ? SNAP Cluster 17.258/17.259/17.278 WIOA Cluster 93.558 ? TANF Cluster 93.563 ? Child Support Enforcement 93.575/93.596 ? CCDF Cluster 93.667 ? Social Services Block Grant Federal Award Identification Number / Year: 182OH102S2514 / 2018 (SNAP Cluster) 192OH102S2514 / 2019 (SNAP Cluster) AA283361655A39 / 2017 (WIOA Cluster) AA307421755A39 / 2018 (WIOA Cluster) 1801OHTANF / 2018 (TANF Cluster) 1901OHTANF / 2019 (TANF Cluster) 1804OHCSES / 2018 (Child Support) 1904OHCSES / 2019 (Child Support) 1701OHCCDF / 2017 (CCDF Cluster) 1801OHCCDF / 2018 (CCDF Cluster) 1901OHCCDD / 2019 (CCDF Cluster) 1801OHSOSR / 2018 (SSBG) 1901OHSOSR / 2019 (SSBG) Federal Agencies: Department of Agriculture Department of Labor Department of Health and Human Services Compliance Requirement: Subrecipient Monitoring Repeat Finding from Prior Audit? No NONCOMPLIANCE AND MATERIAL WEAKNESS 45 C.F.R. Part 75.521 gives regulatory effect to the Department of Health and Human Services uniform administrative requirements for grants to states and local governments relating to financial administration and standards for financial management systems. In addition, similar administrative requirements were implemented for the Department of Labor in 2 C.F.R. Part 2900.4 and the Department of Agriculture implemented 2 C.F.R. Part 200.1. Specifically, 2 C.F.R. Part 200.331(d) and 45 CFR 75.352 state, in part: . . . Pass-through entity monitoring of the subrecipient must include: . . . (2) Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the Federal award provided to the subrecipient from the passthrough entity detected through audits, on-site reviews, and other means. . . Additionally, 2 C.F.R. Part 200.521 and 45 CFR 75.521 state, in part: . . . (a) . . . the pass-through entity must be responsible for issuing a management decision for audit findings that relate to Federal awards it makes to subrecipients. (d) The Federal awarding agency or pass-through entity responsible for issuing a management decision must do so within six months of acceptance of the audit report by the FAC [Federal Audit Clearinghouse]. The auditee must initiate and proceed with corrective action as rapidly as possible and corrective action should begin no later than upon receipt of the audit report. . . It is management's responsibility to ensure a management decision is made on audit findings related to the federal programs it administers within the time requirements outlined by the C.F.R. Management must also ensure subrecipients are taking appropriate and timely action to resolve any deficiencies noted within their audit report. The Department?s Office of Fiscal and Monitoring Services, Audit Resolution Section (ARS) is responsible for ensuring that subrecipients who expend $750,000 or more in Federal awards during the subrecipient's fiscal year have met the audit requirements of 2 C.F.R. Part 200. ARS maintains three different spreadsheets: County Department of Job and Family Services (CDJFS), Non-County, and Workforce Innovation and Opportunity Act (WIOA) in order to track the receipt, review, and conclusion of audits. The Department?s procedures include: searches of the Federal Audit Clearinghouse (FAC) website to identify and obtain subrecipient audit reports; review of the audit/management letter reports; completion of an audit review checklist; and, issuance of final closure letters within six months for all subrecipient audit reports. During the audit period, the Department reviewed 161 audit reports. However, for one of 20 (5%) audit reports selected for testing, the Department did not issue a management decision on the audit findings within six months of the report being accepted by the FAC in accordance with 2 C.F.R. Part 521; the management decision was 19 days late. In addition, for one of 20 (5%) audit reports selected for testing, the Department did not issue a closure letter within six months of the report being accepted by the FAC per internal procedures; the closure letter was 93 days late. Failure to adequately monitor subrecipients and the status of compliance issues noted during their audit increases the risk that subrecipients may not properly utilize federal funds or adhere to program requirements, potentially jeopardizing federal funding. In addition, without appropriate management oversight of the review of subrecipient audit reports, there is an increased risk that audit findings may not be addressed appropriately. Noncompliance by the Department could cause federal funding to be reduced, taken away, or sanctions imposed by the federal grantor agency. Based on discussion with management, the delay in completing the management decision for one of the audit reports was because the Department chooses to hold-off on report reviews until the final report is officially released by the Auditor of State although the requirement is based on the FAC acceptance date. The delay in completing the management decision for the remaining audit report was due to unresponsiveness by the subrecipient to provide requested documents and information. We recommend the Department continue to utilize the Federal Audit Clearinghouse as a tool to identify and obtain subrecipient audit reports and issue a management decision in accordance with the timeline set forth in 2 C.F.R. Part 200.521(c) and (d). We also recommend the Department evaluate existing policies and procedures related to subrecipient monitoring, and revise where necessary, to ensure they are adequate for ensuring timely management decisions. This could include reviewing the audit report upon acceptance by the FAC and comparing it to the Auditor of State released version for any changes. Additionally, management should review and evaluate existing policies and procedures, and revise or implement new ones where necessary, to ensure timely and appropriate corrective action has been taken by subrecipients to address the findings. Procedures performed by the Department should be adequately documented to provide management reasonable assurance they have been performed. Management should periodically monitor these procedures to ensure they are operating as intended. Auditor of State?s Conclusion The State of Ohio?s Corrective Action Plan for this finding required an Auditor of State?s Conclusion. The Department?s internal procedures indicate all subrecipient single audit report reviews should occur within six months of acceptance from the FAC, regardless if findings are identified in any of the Department?s federal programs. In addition, 2 C.F.R. 200.521 indicates all reports should be reviewed upon acceptance by the FAC, not when the Auditor of State releases the report. Therefore, the finding remains as stated above.

MEDICAID / CHIP / MFP ? ELIGIBILITY Finding Number: 2019-022 State Agency Number MCD-03 CFDA Number and Title: 93.767 ? Children?s Health Insurance Program 93.775/93.777/93.778 ? Medicaid Cluster 93.791 ? Money Follows the Person Rebalancing Demonstration Federal Award Identification Number / Year: 1805OH5021 / 2018 (CHIP) 1905OH5021 / 2019 (CHIP) 1805OH5MAP / 2018 (Medicaid) 1905OH5MAP / 2019 (Medicaid) 1LICMS331360 / 2014-2020 (MFP) Federal Agency: Department of Health and Human Services Compliance Requirements: Activities Allowed or Unallowed, Allowable Costs/Cost Principles, Eligibility Repeat Finding from Prior Audit? Yes Prior Audit Finding Number: 2018-017 QUESTIONED COSTS, NONCOMPLIANCE, AND MATERIAL WEAKNESS (CHIP) $162,571 QUESTIONED COSTS, NONCOMPLIANCE, AND MATERIAL WEAKNESS (MEDICAID CLUSTER) $27,910 MATERIAL WEAKNESS (MFP) NOTE: Finding numbers 2019-001 , 2019-005, 2019-017, and 2019-023 contain additional information which is integral to and should be read in conjunction with this finding. 42 C.F.R. Part 435.10 Subpart A, State Plan requirements, pertaining to the Medicaid Cluster states: A State plan must--- . . . (a) Provide that the requirements of this part are met; and (b) Specify the groups to whom Medicaid is provided, as specified in subparts B, C, and D of this part, and the conditions of eligibility for individuals in those groups. 42 C.F.R. Part 435.914, Case documentation, pertaining to the Medicaid Cluster states, in part: (a) The agency must include in each applicant's case record facts to support the agency's decision on his application. 42 C.F.R. Part 435.916, Periodic renewal of Medicaid eligibility, states, in part: (a) Renewal of individuals whose Medicaid eligibility is based on modified adjusted gross income methods (MAGI). (1) Except as provided in paragraph (d) of this section, the eligibility of Medicaid beneficiaries whose financial eligibility is determined using MAGI-based income must be renewed once every 12 months, and no more frequently than once every 12 months.. . . (b) Redetermination of individuals whose Medicaid eligibility is determined on a basis other than modified adjusted gross income. The agency must redetermine the eligibility of Medicaid beneficiaries excepted from modified adjusted gross income . . . for circumstances that may change, at least every 12 months. . . 42 U.S.C. ?1397bb (b), pertaining to the Children?s Health Insurance Program (CHIP) states, in part: (1) Eligibility Standards (A) In general the plan shall include a description of the standards used to determine the eligibility of targeted low-income children for child health assistance under the plan. 42 C.F.R. Part 457.343, Periodic renewal of CHIP eligibility, states: The renewal procedures described in 435.916 of this chapter apply equally to the State in administering a separate CHIP. . . The Medicaid State Plan and CHIP State Plan outline the specific eligibility conditions and standards within Sections 2.2 ? Coverage and Conditions of Eligibility and 2.6 A ? Financial Eligibility, Eligibility Conditions and Requirements for Medicaid and Section 4 ? Eligibility Standards and Methodology for CHIP. It is management?s responsibility to implement policies and procedures to provide reasonable assurance they have complied with these requirements. As the lead agency responsible for administering the CHIP and Medicaid federal grant awards for the State of Ohio, the Department is responsible for providing reasonable assurance that only eligible individuals receive assistance and documentation maintained is accurate, complete, and properly recorded in the Ohio Benefits (OB) system to ensure appropriate eligibility determinations. It is also the Department?s responsibility to implement sufficient controls, systems, processes, and procedures to reasonably ensure compliance with the rules and regulations associated with these programs so that only eligible recipients receive benefits. The Department is responsible for overall program compliance and must have appropriate oversight and monitoring procedures in place to ensure those they rely on are operating in accordance with all expectations, guidelines, and requirements related to their tasks. During state fiscal year (SFY) 2019, the Department disbursed a combined total of $19.9 billion in public assistance payments, to recipients processed through the Ohio Benefits system related to the following programs: Federal Program Benefits Paid # of Recipients* 93.767 - CHIP $543,910,640 214,981 93.7775/93.777/93.778 ? Medicaid Cluster $19,310,986,073 2,650,450 93.791 ? Money Follows the Person $6,779,281 2,188 Combined Total $19,861,675,994 2,867,619 *We did not separately identify recipients who could be covered by more than one program. The information below summarizes Finding 2019-001 as it relates to the control process and weaknesses identified related to eligibility for the Medicaid Cluster. These issues also apply to the CHIP and MFP programs and additional information was added, where necessary, to identify any errors related to MFP and CHIP. These programs are administered using a multi-agency approach, as follows: overall compliance and administration of CHIP and the Medicaid Cluster fall under the Department, and programming and administration of the State?s eligibility determination computer system, Ohio Benefits, falls under the Ohio Department of Administrative Services. The Department, through a Memorandum of Understanding with the Ohio Department of Job & Family Services, also utilizes the 88 Ohio counties in the eligibility determination process to work with applicants, receive/enter eligibility documentation into the Ohio Benefits system, and follow up on alerts issued by the system. SYSTEM/CONTROL ISSUES Currently, individuals applying to receive public assistance benefits complete an application through various methods. The County Departments of Job & Family Services (CDJFS) offices collect and maintain any documentation provided by the individual either in a paper case file or in the OnBase Electronic Documentation Management System (EDMS) maintained under contract by the Ohio Department of Administrative Services (DAS). After collecting documentation, the county caseworker enters the individual?s information into the Ohio Benefits system which determines the initial eligibility benefit amount and assigns the benefit aid category. This process is also used to perform eligibility redeterminations on an annual basis or when prompted through a system alert. Once the determination is made, the Ohio Benefits system uploads the eligibility information to the Department?s payment system to process the payment. During SFY 2019, we noted the several weaknesses/defects in the eligibility process, as listed below: ? Alerts ? During SFY 2019, an overwhelming volume of alerts were sent to the counties for investigation and follow-up (more than 11.7 million alerts were issued according to DAS records; 4.4 million related to Income Eligibility Verification Systems (IEVS) alerts and 7.3 million to non-IEVS alerts). This resulted in an unmanageable workload and ineffective application of the alert process. ? Overwriting ? the Ohio Benefits system maintains several pieces of key information related to a recipient?s eligibility (income, household size, age, etc.). However, there is no system warning or other control in place to identify or prevent caseworkers from overwriting this data when new information is identified instead of adding the new information, as intended. In addition, a system defect prevents caseworkers from viewing the previous case information. ? Caseworker Reliance/Training ? Training for county caseworkers, whose knowledge and judgement are relied heavily upon, is typically optional and/or attended by a representative of the county who is expected to relay the information to others. ? Multi-program Info ? There are certain pieces of key information (i.e. name, income, age, etc.) maintained in the Ohio Benefits system which impact all public assistance programs, including SNAP, TANF, Medicaid, and CHIP. However, the system currently does not link this information between programs, but relies on county caseworkers to manually adjust each affected program separately when a change occurs. ? System Design Weaknesses/Defects in the Ohio Benefits system: ? Alerts: ? Multiple and repetitive alerts (redundancy). ? Irrelevant alerts (zero or small dollar amounts). ? Additional steps required to complete an alert (having to leave the alert window, opening an Ohio Benefits window, and then having to go back through the Alert Inventory to clear the alert). ? Alerts being received on persons not receiving public assistance. ? For eight of 80 (10%) Medicaid recipients and 12 of 80 (15%) CHIP recipients selected for testing, a systemic issue within Ohio Benefits that either impacted the eligibility process and/or eligibility determination for the recipient existed. ? Of the eight Medicaid cases: ? Three required additional caseworker procedures to be performed to properly complete parts of the eligibility determination process. ? One was not populated with the proper benefit aid category/program block to test eligibility against based on the information entered into the system. This created a situation that required a caseworker override. However, the caseworker did not identify this and the recipient?s income was evaluated using the wrong aid category threshold. ? Four didn?t allow the caseworker to sufficiently view all relevant audit/case history when income overrides occurred. ? Of the 12 CHIP cases: ? One wasn?t assigned to the proper aid category because the 5% income disregard was not properly deducted from the income. ? Six didn?t indicate a completion reason and completion date for a redetermination on the Medicaid History screen. ? One didn?t show dependents for tax records entered prior to December 2016. ? Four didn?t allow the caseworker to sufficiently view all relevant audit/case history when income overrides occurred. ? Additionally, the following system design weaknesses/defects in the Ohio Benefits system were brought to our attention by the Department: ? The system was not properly tracking/submitting the required 1095-B (Health Coverage) tax forms for Medicaid recipients to the Internal Revenue Service resulting in late filings by the Department. ? The system auto-populated a new browser window/case with incorrect data if a case worker did not close a prior case file. ? The system sometimes incorrectly linked newborns to individuals who were not their actual parents. In one instance, this resulted in a newborn being linked to an eleven-year old child. ? The system was not generating a PDF for a case worker to access within the system when an e-app was filed by a recipient. ? The system had issues sending information to the Medicaid Information Technology System (MITS) for cases with a discontinuance resulting in case information not being properly updated within MITS. ? The system was not end-dating pregnancy records over 10 months, but did generate an alert for the county worker to investigate. However, if the alert was not resolved, the individual remained open as a pregnant woman until the next eligibility determination. ? We noted several weaknesses/issues regarding the contract and monitoring related to the OB system in Finding Number 2019-005 for the Department of Administrative Services. These issues, which impact the Department?s responsibilities regarding monitoring, updates, and program compliance, are summarized below: ? The signed agreements/amendments did not separately require MCD signatures, and ODJFS was not included on amendments. ? Signed interagency agreements defining each agency?s responsibilities and the data governance structure have not been completed. ? No evidence of monitoring procedures related to the Independent Verification and Validation (IV&V) reports prepared by a third-party evaluator. ? No formalized documentation/tracking of reviews/evaluations/certifications performed or required for the OB system by outside or internal reviewers. One of several factors in determining eligibility for the MFP program is the recipient?s eligibility for the Medicaid Cluster program. Although, noncompliance was not identified for the MFP program, the weaknesses/defects identified above in the Medicaid eligibility process could also impact the MFP program, resulting in a material weakness for the program. NONCOMPLIANCE ISSUES The following noncompliance was noted related to eligibility for the Medicaid and CHIP programs: ? Nine of 80 (11.3%) Medicaid recipients and 13 of 80 (16.3%) CHIP recipients selected for testing were not eligible to receive benefits on the date services were performed. Since Ohio Benefits is the State?s official eligibility determination system, these items will result in questioned costs for all claims paid for services provided for these individuals during the time they were ineligible, totaling $27,910 for Medicaid and $125,102 for CHIP. The items noted included issues such as: o The recipient was incarcerated. o The eligibility period for Transitional Medicaid or Continuing Eligibility was incorrect. o The household size was incorrectly determined. o The recipient was covered by other health insurance. o The recipient exceeded the eligibility period for Continuing Eligibility. ? 12 of 80 (15%) Medicaid recipients and 24 of 80 (30%) CHIP recipients selected for testing were not placed in the correct benefit aid category. Nine of the 12 Medicaid individuals and 13 of the 24 CHIP individuals are included in the preceding bullet as being deemed ineligible. For the other three Medicaid recipients, although their age and/or income deemed them to be in the incorrect benefit aid category, they were qualified to be placed in another benefit aid category; therefore the eligibility of the recipient was not questioned. The revised benefit aid category did not affect the Federal Medical Assistance Percentage (FMAP) used to draw down funds from the federal government for the recipient. For the other 11 CHIP recipients, their age and/or income deemed them to be in the incorrect benefit aid category and ineligible for the CHIP program; however, they were qualified to be placed in a Medicaid benefit aid category. Since Ohio Benefits is the State?s official eligibility determination system, these items will result in questioned costs for all claims paid under the CHIP program for services provided for these individuals during the time they were ineligible, totaling $37,469. ? 26 of 80 (32.5%) Medicaid recipient cases and 28 of 80 (35%) CHIP recipient cases selected for testing either did not contain adequate documentation to support the Department?s decision on the recipient?s eligibility or incorrect recipient information was entered into Ohio Benefits. However, based on additional information we obtained from other sources, the recipient was still eligible. The items noted generally related to the following documentation categories: o Income verification and documentation o Household size o Tax filing status o Resource verification and documentation o Caseworker processing error o Social Security Number verification and documentation ? Eight of 80 (10%) Medicaid recipient cases and five of 80 (6.3%) CHIP recipient cases selected for testing had an untimely redetermination. The Medicaid redeterminations ranged from four to 263 days beyond the allowed 45 day processing period, with an average of 139 days late. The CHIP redeterminations ranged from 58 to 383 days beyond the allowed 45 day processing period, with an average of 149 days late. Without proper controls for entering, processing and maintaining recipient information and system alerts, there is an increased risk that benefits paid on behalf of recipients will be inaccurate or unallowable. This risk is substantially increased if the State?s eligibility determination system, Ohio Benefits, contains design or operational flaws that could impact a recipient?s eligibility and, as a result, could have a material impact on the amounts reimbursed by the federal government. These weaknesses/defects could allow undue subjective decisions, jeopardize accurate eligibility processing, and/or result in improper payments or federal reimbursements. Furthermore, without an effective process in place to ensure eligibility is being redetermined timely when required, the risk is also increased that a recipient?s benefit amount or aid category has changed or they are ineligible to receive benefits. Overpayments or payments to or on behalf of ineligible recipients may subject the Department to penalties or sanctions which may jeopardize future funding and limit its ability to fulfill program requirements to provide benefits to those in need. Based on discussions with management, human error and systemic issues lead to the issues identified. RECOMMENDATIONS We recommend the Department evaluate and seek reimbursement for all claims that were incorrectly paid. We also recommend management work collectively with the related state agencies to implement/update robust processes, procedures, and system programming to address the weaknesses in the overall eligibility process, including those associated with the Ohio Benefits system. These changes/updates should include, but not be limited to: ? Redesigning the alert process to be more effective and efficient. This could include a more centralized evaluation of alert activity and/or better use of automated tools to vet and prioritize items requiring follow-up. This would allow Department level personnel to become more experienced and adept at identifying and investigating anomalies and help focus the resources of both Department and county personnel. ? Identifying and coordinating program changes to address the system design weaknesses/defects identified above, including the issues with overwriting data and ensuring all data stored in the system is available/viewable by users. This should include working collaboratively with the related state agencies to prioritize program changes which could directly impact the eligibility determinations or benefit amounts to ensure they are corrected in a timely manner to prevent and detect further improper payments. ? Creating a centralized database of recipient information shared among multiple public assistance programs, or otherwise linking this information so that a change only has to be entered once in Ohio Benefits and all programs are updated accordingly. ? Requiring mandatory training for all CDJFS employees who are entering the assistance group information into Ohio Benefits to help ensure proper and complete information is being collected, entered, and verified prior to an individual?s eligibility determination being made. An initial training should be provided to ensure all users are knowledgeable of the process, procedures, and impact of the work they do. As changes occur to the rules/regulations, system, or process, detailed training should be required of all users on those changes. ? Regularly evaluate selected benefit payments for all programs to verify the recipient?s eligibility, verify the recipient information entered into Ohio Benefits by the CDJFS is accurate, and the information is being maintained to support the Department?s eligibility decision, and ensure redeterminations are completed timely. Any problems noted should be promptly corrected to reduce the risk of benefit payments being made on behalf of ineligible individuals and additional training provided to the Department and/or county employees affected. ? Ensuring that vendor contacts/amendments, and interagency agreements are formalized, contain all parties of the agreements, and fully and clearly define the roles, responsibilities, and expectations related to each party. ? Ensuring that appropriate and coordinated monitoring and tracking procedures are in place regarding reviews and the timely remediation of issues identified, including, but not limited to: ? A data governance structure designed to ensure data quality and reliability for management, the grantor agencies, and other users of this information. This should include data subject matter experts from each related agency to help ensure quality of data requests before external and internal users rely on the data, issues are addressed with a clear escalation path, and establishing accountabilities and alignment between the related agencies. ? Appropriate monitoring procedures related to the IV&V reports prepared by the third-party evaluator. ? Coordinating and managing the contract contents with the developing vendor to help ensure all contract and amendment deliverables are being met. ? A formalized documentation/tracking process of reviews/evaluations/certifications performed or required for the OB system. Auditor of State?s Conclusion The State of Ohio?s Corrective Action Plan for this finding required an Auditor of State?s Conclusion. [INSERT CONCLUSION ONCE APPROVED BY CFAE]

MEDICAID/CHIP/MFP ? IEVS MONITORING Finding Number: 2019-023 State Agency Number: MCD-04 CFDA Number and Title: 93.767 ? Children?s Health Insurance Program 93.775/93.777/93.778 ? Medicaid Cluster 93.791 ? Money Follows the Person Rebalancing Demonstration Federal Award Identification Number/Year: 1805OH5021 / 2018 (CHIP) 1905OH5021 / 2019 (CHIP) 1805OH5MAP / 2018 (Medicaid) 1905OH5MAP / 2019 (Medicaid) 1LICMS331360 / 2014-2020 (MFP) Federal Agency: Department of Health and Human Services Compliance Requirement: Eligibility Repeat Finding from Prior Audit? Yes Prior Audit Finding Number: 2018-021 NONCOMPLIANCE AND MATERIAL WEAKNESS NOTE: Finding numbers 2019-001, 2019-005, and 2019-022 contain additional information which is integral to and should be read in conjunction with this finding. 42 C.F.R. Part 435.945 states, in part, the following regarding the Medicaid Cluster program: (a) Except where the law requires other procedures . . . the agency may accept attestation of information needed to determine the eligibility of an individual for Medicaid . . . without requiring further information (including documentation) from the individual. (b) The agency must request and use information relevant to verifying an individual's eligibility for Medicaid in accordance with ? 435.948 through 435.956. . . 42 C.F.R. Part 457.380, states, in part, the following regarding the Children?s Health Insurance Program (CHIP): (a) General requirements. Except where law requires other procedures. . . the State may accept attestation of information needed to determine the eligibility of an individual for CHIP. . . without requiring further information (including documentation) from the individual. (b) Status as a citizen, national or a non-citizen. (1) Except for newborns identified in ? 435.406(a)(1)(iii)(E) of this chapter, who are exempt from any requirement to verify citizenship, the agency must? . . . (ii) Provide a reasonable opportunity period to verify such status in accordance with ? 435.956(a)(5) and (b) of this chapter and provide benefits during such reasonable opportunity period to individuals determined to be otherwise eligible for CHIP. Public Law 109-171 Deficit Reduction Act 2005, Subpart B, section 6071 ? Money Follows the Person Rebalancing Demonstration (MFP), states, in part: (b) Definitions.? For purposes of this section: . . . (2) Eligible Individual.?The term ``eligible individual?? means, with respect to an MFP demonstration project of a State, an individual in the State ? (A) who, immediately before beginning participation in the MFP demonstration project? (i) resides (and has resided, for a period of not less than 6 months or for such longer minimum period, not to exceed 2 years, as may be specified by the State) in an inpatient facility; (ii) is receiving Medicaid benefits for inpatient services furnished by such inpatient facility? Furthermore, 42 U.S.C. ? 1320b?7(a) Requirements of State eligibility systems states, in part: In order to meet the requirements of this section, a State must have in effect an income and eligibility verification system which meets the requirements of subsection (d) and under which? (1) the State shall require, as a condition of eligibility for benefits under any program listed in subsection (b), that each applicant for or recipient of benefits under that program furnish to the State his social security account number (or numbers, if he has more than one such number), and the State shall utilize such account numbers in the administration of that program so as to enable the association of the records pertaining to the applicant or recipient with his account number; (2) wage information from agencies administering State unemployment compensation laws available pursuant to section 3304(a)(16) of the Internal Revenue Code of 1986, wage information reported pursuant to paragraph (3) of this subsection, and wage, income, and other information from the Social Security Administration and the Internal Revenue Service available pursuant to section 6103(l)(7) of such Code, shall be requested and utilized to the extent that such information may be useful in verifying eligibility for, and the amount of, benefits available under any program listed in subsection (b), as determined by the Secretary of Health and Human Services . . . . . . (4) the State agencies administering the programs. . . adhere to standardized formats and procedures . . . under which ? (A) the agencies will exchange with each other information in their possession which may be of use in establishing or verifying eligibility or benefit amounts under any other such program; . . . (C) the use of such information shall be targeted to those uses which are most likely to be productive in identifying and preventing ineligibility and incorrect payments. . . In order to comply with 42 C.F.R. Part 435.945 and 42 U.S.C. ? 1320b-7, the State of Ohio codified specific rules related to its Income Eligibility Verification System (IEVS) in the Ohio Administrative Code (OAC). Ohio Admin. Code ?5160:1-1-04 states, in part: (A) This rule describes the requirements in section 1137 of the Social Security Act and in section 42 C.F.R. 435.945. . . requiring state agencies administering certain federally funded, state administered public assistance programs, to establish procedures for obtaining, using and verifying information relevant to determinations of eligibility. The Ohio Department of Medicaid shall obtain and share income and benefit information with the following sources: (1) The social security administration (SSA). (2) The internal revenue service (IRS). (3) The state wage information collection agency (SWICA). (4) The agencies administering the State unemployment compensation (UC) laws. . . . (C) Administrative agency responsibilities. The administrative agency shall: . . . (3) Within forty-five days of receipt of the information, review and compare against the case record all information received to determine whether it affects the individual's eligibility. Obtain verification, if appropriate, to determine eligibility and initiate appropriate action in accordance with 42 C.F.R. 435.952(c). . .For applicants, if the information is received during the application period, it must be used to the extent possible to make eligibility determinations, in accordance with 42 C.F.R. 435.952(b) . . . (4) Verify the information, in accordance with 42 C.F.R. 435.948... and 42 C.F.R. 435.949 ... It is management?s responsibility to implement controls, processes, and procedures to ensure compliance with these regulations. When automated systems are utilized to perform certain functions related to this compliance, management must ensure the system is properly designed and operating effectively. During state fiscal year 2019, the Department disbursed approximately $19.3 billion, $543.9 million, and $6.8 million on behalf of eligible recipients for the Medicaid Cluster, CHIP, and MFP programs, respectively. The Ohio Benefits (OB) system determines eligibility for the Medicaid Cluster and CHIP programs. One of several factors in determining eligibility for the MFP program is based upon the recipient?s eligibility for the Medicaid Cluster program. The OB system also includes the IEVS functionality which compares reported recipient income to income information maintained by outside data sources (i.e. SSA, IRS, etc.). Income information that does not agree to the OB amount is communicated as an IEVS alert and forwarded to the appropriate county for investigation. The Department?s Medicaid Eligibility Quality Control (MEQC) unit began monitoring the status of IEVS alerts in March 2019 within their standard recipient case reviews. However, the reviews did not document the timeliness of clearing the alerts, only if they were complete or incomplete. Additionally, no reports were sent to the counties to communicate the results of the reviews. No additional monitoring was performed by the Department over IEVS alerts during the audit period. In addition, the Department relies heavily on the Ohio Department of Job and Family Services to coordinate with and provide training to the counties; however, control weaknesses regarding the IEVS filtering logic and county training were also identified in that process (see finding 2019-018). Therefore, it appears the Department did not have sufficient or effective controls or procedures in place to review and monitor the IEVS alerts generated and processed by the Ohio Benefits system during state fiscal year 2019 to ensure they were being completed by the counties in accordance with the requirements and timeframes established in 42 C.F.R. Part 435.945, 42 U.S.C. ? 1320b?7, and OAC ? 5160:1-1-04. Furthermore, an OB report showed 1,452,054 of the 4,368,706 (33.2%) IEVS alerts sent to the counties during the audit period were not cleared within 45 days as required. The alerts were cleared between one and 475 days beyond the 45-day requirement, with an average of 147 days late. A lack of effective monitoring and ensuring IEVS alerts are completed accurately and timely increases the risk that benefits could be calculated and paid for inappropriate amounts or paid on behalf of ineligible recipients. This could adversely affect the Department?s ability to comply with requirements of these federal programs which could result in federal sanctions or penalties. Based on discussions with management, the Department had not fully implemented its corrective action plan for the prior year audit finding within the audit period. We recommend the Department should work collectively with the related state agencies to implement/update robust processes, procedures and system controls to address the weaknesses associated with the IEVs process within the Ohio Benefits system. These changes/updates should include, but not be limited to: ? Working with DAS and the Ohio Benefits contractor to take steps to ensure the IEVS filtering logic is properly programmed in the Ohio Benefits system; since the Department and counties rely upon it to ensure only relevant Medicaid and CHIP IEVS alerts are generated so they can be worked within the established due dates defined in the Code of Federal Regulations. ? Developing an IEVS alert processing procedures guide for the alerts issued by the Ohio Benefits system to ensure alerts are properly documented within the system, worked within the proper timeframes, and proper verification documentation is obtained and maintained by the counties for resolved alerts. ? Designing and implementing appropriate and effective control procedures for monitoring IEVS alerts generated and processed in the Ohio Benefits system to help ensure the counties are completing them properly and timely. These monitoring procedures should be performed frequently, include appropriate follow up with the counties if alerts are not being completed properly and timely, and be documented in some manner. Management should periodically review this documentation to ensure the control procedures are being performed timely and as intended. ? Implementing in-depth IEVS training for county caseworkers to ensure they have the knowledge to properly document and resolve IEVS alerts generated by the Ohio Benefits system. ? Including a more centralized evaluation of alert activity and/or better use of automated tools to vet and prioritize items requiring follow-up at the county level. This would allow Department level personnel to become more experienced and adept at identifying and investigating anomalies and help focus the resources of both Department and county personnel.

MEDICAID/CHIP ? DRUG REBATE MONITORING Finding Number: 2019-024 State Agency Number: MCD-05 CFDA Number and Title: 93.767 ? Children?s Health Insurance Program 93.775/93.777/93.778 ? Medicaid Cluster Federal Award Identification Number/Year: 1805OH5021 / 2018 (CHIP) 1905OH5021 / 2019 (CHIP) 1805OH5MAP / 2018 (Medicaid) 1905OH5MAP / 2019 (Medicaid) Federal Agency: Department of Health and Human Services Compliance Requirement: Allowable Costs/Cost Principles Repeat Finding from Prior Audit? Yes Prior Audit Finding Number: 2018-020 NONCOMPLIANCE AND MATERIAL WEAKNESS Section 1927 of the Social Security Act (42 USC 1396r-8) allows States to receive rebates for drug purchases the same as other payers receive. Drug manufacturers are required to provide a listing to the Center for Medicaid Services (CMS) of all covered outpatient drugs and, on a quarterly basis, are required to provide their average manufacturer?s price and their best prices for each covered outpatient drug. Based on this data, CMS calculates a unit rebate amount for each drug, which it then provides to States. No later than 60 days after the end of the quarter, the State Medicaid agency must provide drug utilization data to manufacturers. Manufacturers have 30 days after receiving the drug utilization data to pay rebates on the units or provide the State with written notice of disputed items. Department of Medicaid policy indicates that interest shall accrue beginning with the 38th day from the invoice postmark date, so manufacturers are encouraged to allow time for postage and processing before interest starts to accrue. Many entities use outside service organizations to process transactions as part of the entity?s information system. Service organizations provide services ranging from performing a specific task under the direction of an entity to replacing entire business units or functions of the entity. When the operating activity is not directly administered by the entity, such as when utilizing a service organization, it is critical the appropriate monitoring controls are designed and implemented to reasonably ensure the service organization has adequate controls to achieve management?s goals and objectives and complies with applicable laws and regulations. System and Organization Controls (SOC), are performed over these service organizations to provide information about their internal controls to management and to auditors who rely on the results for the audit of the user entity?s financial statements and IT systems. 2 CFR 200.303(a) requires recipients to maintain internal controls over federal programs that provide reasonable assurance they are in compliance with laws, regulations, and the provisions of contracts or grant agreements. It is management?s responsibility to monitor these control procedures to verify they are designed and operating in a manner consistent with federal regulations and program objectives. Furthermore, sound internal control procedures require management to monitor and oversee operations of contractors responsible for carrying out federal requirements to provide assurance procedures performed by the contractor are functioning as intended. It is also management?s responsibility to create and implement control policies and procedures to monitor contractor performance to ensure completeness of the drug rebate revenue received from drug manufacturers and that they are in compliance with federal regulations and contractual obligations. During state fiscal year (SFY) 2019, the Department received drug rebates totaling approximately $2 billion which were recorded in the General and Job, Family, and Other Human Services opinion units on the State of Ohio?s financial statements. The Department contracts with a third party administrator (TPA) to perform the processing and collection of these rebates. However: ? Although a SOC 1 audit had been commissioned over the TPA covering the period of July 1, 2018 through June 30, 2019, the report was not completed at the time of our testing and, therefore, had not been reviewed by the Department. As such, the Department could not utilize the report to determine if any deficiencies were noted over the TPA as well as demonstrate it had sufficient controls in place during the audit period to address the complementary user entity controls identified in the SOC 1 report. The prior SOC 1 report the Department received and reviewed covered the period April 1, 2017 through December 15, 2017. ? The Department did not reconcile the drug rebate revenue received to the TPA reports indicating the amount of revenue that should have been posted. ? Although the contract required the TPA to provide many electronic reports to the Department, it did not appear the Department was utilizing the reports to monitor the TPA or drug rebate activity. ? The Department executed an amendment to the contract with the TPA to include a requirement to have an independent public accounting firm perform agreed-upon procedures (AUP) testing to verify completeness of the State of Ohio?s drug rebate revenue, in that rebate revenue and interest was properly collected from all applicable manufacturers and that revenue was received timely, as had been previously required in TPA contracts. However, the report for the AUP testing was not completed and submitted to the Department until August 2019, which is not within the audit period. In addition, the AUP covered SFY18 giving no assurance over compliance by the TPA during the audit period. As such, the Department did not have procedures in place during the audit period to ensure the requirements of Section 1927 of the Social Security Act over drug rebates were being met. Without adequate monitoring controls, management cannot be reasonably assured the TPA is complying with applicable laws and regulations and contract requirements, as well as meeting management?s goals and objectives. Not properly ensuring completeness of drug rebate revenue and interest due to the Department is properly received could lead to lost drug rebate revenue to the detriment of the recipients of the Medicaid and CHIP programs. Furthermore, if drug rebate revenue is not properly reported, the risk is increased that the State of Ohio?s financial statements may be materially misstated and those using the statements could be relying on inaccurate information. Based on discussions with management, it appears that personnel transitions led to the control weaknesses noted. Management indicated they would work with the vendors performing the SOC 1 and AUP engagements to adjust the audit scope to ensure the vendors are covering a significant part of the audit period and complete them in time for the Department to review and react to the reports during the audit period. We recommend the Department strengthen current internal control procedures over drug rebate contract monitoring which should include, but not be limited to: ? Implementing appropriate control procedures to address each of the complementary user control considerations identified in the SOC 1 report. ? Reviewing the AUP and SOC 1 reports to ensure any issues identified are properly addressed. ? Reconciling the drug rebate revenue received to TPA reports to ensure accuracy. ? Utilizing the electronic reports available from the TPA to further enhance the monitoring over the TPA and drug rebate activity. Management should continually monitor the AUP procedures to ensure the compliance requirements of the drug rebate program are being met and if not, implement additional procedures or revise the requirements of the AUP engagement as necessary. Lastly, management should periodically monitor and update internal procedures to ensure management?s objectives are being met.

IT ? LACK OF INTERNAL TESTING OF IT SECURITY SYSTEMS Finding Number: 2019-025 State Agency Number: MCD-06 CFDA Number and Title: 93.767 ? Children?s Health Insurance Program 93.775/93.777/93.778 ? Medicaid Cluster 93.791 ? Money Follows the Person Rebalancing Demonstration Federal Award Identification Number / Year: 1805OH5021 / 2018 (CHIP) 1905OH5021 / 2019 (CHIP) 1805OH5MAP / 2018 (Medicaid) 1905OH5MAP / 2019 (Medicaid) 1LICMS331360 / 2014 ? 2020 (MFP) Federal Agency: Department of Health and Human Services Compliance Requirement: Special Tests and Provisions ? ADP Risk Analysis and System Security Review Repeat Finding from Prior Audit? Yes Prior Audit Finding Number: 2018-022 NONCOMPLIANCE AND MATERIAL WEAKNESS To help meet the conditions under which the Department of Health and Human Services will approve federal financial participation with various programs, 45 C.F.R. Part 95.621 states, in part: (f) ADP System Security Requirements and Review Process - (1) ADP System Security Requirement. State agencies are responsible for the security of all ADP projects under development, and operational systems involved in the administration of HHS programs. State agencies shall determine the appropriate ADP security requirements based on recognized industry standards or standards governing security of Federal ADP systems and information processing. (2) ADP Security Program. State ADP Security requirements shall include the following components: . . . (iii) Periodic risk analyses. State agencies must establish and maintain a program for conducting periodic risk analyses to ensure that appropriate, cost effective safeguards are incorporated into new and existing systems. State agencies must perform risk analyses whenever significant system changes occur. (3) ADP System Security Reviews. State agencies shall review the ADP system security of installations involved in the administration of HHS programs on a biennial basis. At a minimum, the reviews shall include an evaluation of physical and data security operating procedures, and personnel practices. . . . (5) The security requirements of this section apply to all ADP systems used by State and local governments to administer programs covered under 45 CFR part 95, subpart F. It is management?s responsibility to design and implement control procedures to ensure compliance with these federal rules and regulations related to all automated systems impacting their programs. During state fiscal year (SFY) 2019, the Department placed significant reliance on a number of complex information systems, including the Medicaid Information Technology System (MITS), which is an automated application to determine if the services provided to eligible recipients were by an eligible provider and allowable prior to payment; and Ohio Benefits (OB), which is an automated system designed to determine recipient eligibility. The Department disbursed approximately $20.8 billion in Medicaid Cluster funds, $575.8 million in Children?s Health Insurance Program (CHIP) funds, and $7.2 million in Money Follows the Person (MFP) funds. Although a System and Organization Controls (SOC 1) audit of the physical and environmental IT controls of the MITS processing environment was conducted during SFY19, the Department did not conduct security reviews within the current or previous fiscal year to satisfy the minimum requirements codified within 45 C.F.R. Part 95.621. In addition, the Department did not conduct, or request the Department of Administrative Services (DAS, the administrator of OB), the Ohio Office of Budget and Management?s Office of Internal Audit (OIA), or a vendor conduct the reviews required by 45 C.F.R. Part 95.621 for Ohio Benefits. Also, the Department did not maintain a schedule or process to ensure the required reviews were conducted during the required timeframes. Based on discussions with management, the Department did not have an external audit or evaluation of MITS because the Department did not consider the system to be a high priority when it evaluated the priority of systems and processes with OIA. The Department works with OIA to create a heat map of the highest priority systems/processes for potential review by OIA on behalf of the Department. Department management indicated they were not aware of the applicability of this requirement for OB. If appropriate risk assessments and reviews are not conducted regularly and timely for complex information systems by experienced personnel, Department management may not be reasonably assured these systems are processing transactions accurately, completely, and in accordance with federal compliance requirements. This increases the risk of noncompliance with federal regulations and of material errors or misstatements within the data processed, resulting in improper posting of transactions and/or inappropriate determinations regarding eligibility and/or payments. We recommend the Department complete an independent evaluation over systems the Department administers on behalf of the Department of Health and Human Services in accordance with 45 C.F.R. Part 95.621 program guidelines within the next fiscal year. This testing must include appropriate risk assessments, general control testing, and testing of automated application controls for these systems, including transaction testing of critical operations and functions to help provide assurance all components of the systems are operating as designed, payments and eligibility determinations are accurate, and all financial and other reports are produced with integrity. We also recommend the Department develop and implement a schedule that would allow all critical systems to be reviewed on a regular basis. This schedule should incorporate the requirements of 45 C.F.R. Part 95.621 to evaluate physical and data security, operating procedures, and personnel practices on a biennial basis for the applicable programs. If the expectation is for DAS to perform procedures designed to satisfy these compliance requirements, in addition to or as part of any annual security and privacy assessments they may perform of the Ohio Benefits environment, we recommend the Department include these assessments in their schedule to allow adequate oversight and monitoring for timeliness and incorporate these requirements into an approved interagency agreement which should document all agreed-upon agency operational, monitoring, and oversight responsibilities. The Department should ensure appropriate and timely corrective action is taken to address all risk areas and/or control weaknesses identified as part of this testing. Reports of the biennial ADP system security reviews and annual DAS reviews/assessments should be maintained together with pertinent supporting documentation. Management should periodically monitor these reviews and assessments to ensure they are completed in accordance with the timeframes and parameters prescribed in the C.F.R.

MEDICAID/CHIP ? MANAGED CARE/MYCARE OHIO - PROVIDER PANEL REPORTS Finding Number: 2019-026 State Agency Number: MCD-07 CFDA Number and Title: 93.767 ? Children?s Health Insurance Program 93.775/93.777/93.778 ? Medicaid Cluster Federal Award Identification Number / Year: 1805OH5021 / 2018 (CHIP) 1905OH5021 / 2019 (CHIP) 1805OH5MAP / 2018 (Medicaid) 1905OH5MAP / 2019 (Medicaid) Federal Agency: Department of Health and Human Services Compliance Requirements: Activities Allowed or Unallowed, Allowable Costs/Cost Principles Repeat Finding from Prior Audit? Yes Prior Audit Finding Number: 2018-023 NONCOMPLIANCE AND MATERIAL WEAKNESS 42 C.F.R. Part 438.206 states, in part, the following regarding availability of services for Managed Care Organizations (MCOs), Prepaid Inpatient Health Plans (PIHPs), and Prepaid Ambulatory Health Plans (PAHPs): (a) Basic rule. Each State must ensure that all services covered under the State plan are available and accessible to enrollees of MCOs, PIHPs, and PAHPs in a timely manner? (b) Delivery network. The State must ensure, through its contracts, that each MCO, PIHP and PAHP, consistent with the scope of its contracted services, meets the following requirements: (1) Maintains and monitors a network of appropriate providers that is supported by written agreements and is sufficient to provide adequate access to all services covered under the contract for all enrollees... Additionally, Ohio Admin. Code (OAC) 5160-26-10 states, in part: (A) If the MCP fails to fulfill its duties and obligations under 42 C.F.R. Part 438 ... or the MCP provider agreement, ODM [Ohio Department of Medicaid] will provide timely written notification to the MCP identifying the violations or deficiencies, and may impose corrective actions or any of the following sanctions in addition to or instead of any actions or sanctions specified in the provider agreement: ? (2) Sanctions that may be imposed on MCPs by ODM include but are not limited to the following: ? (g) Imposition of financial sanctions. ? Furthermore, OAC 5160-58-01.1 states MyCare Ohio plans must comply with all of the requirements applicable to managed care plans in the following rules:?..(7) Rule 5160-26-10 of the Administrative Code. It is management?s responsibility to maintain internal control procedures to provide reasonable assurance the Plans are in compliance with the requirements outlined in the agreements. It is also management?s responsibility to ensure the Plans maintain adequate provider access for Medicaid and Children?s Health Insurance Program (CHIP) recipients, as well as ensure any noncompliance by the Plans is promptly addressed and sanctions are imposed by the Department when necessary. During state fiscal year (SFY) 2019, the Department disbursed approximately $16.4 billion in Medicaid Cluster and CHIP capitation payments to the Managed Care Plans and MyCare Ohio Plans (the Plans) which administer the managed care program throughout the state. The Department enters into a new contract with the Plans at the beginning of each state fiscal year, and amends the agreement each January, which outlines the responsibilities of the Department and the Plans. The agreement requires the Plans to provide or arrange for the delivery of all medically necessary, Medicaid-covered health services, as well as ensure compliance with federally defined provider panel access standards as outlined in the agreement and as required by 42 C.F.R. Part 438.206. The agreement also specifies the minimum number of providers or the maximum distance recipients can be required to travel for each provider type in each county or region of the state that each Plan must maintain. Additionally, the agreement states the Department may assess a $1,000 nonrefundable financial sanction, at least quarterly, for any deficiencies in the Plan?s provider network for each category, for each county. The Managed Care Provider Network (MCPN) developed by Automated Health Systems (AHS), the Managed Care Enrollment Contractor, is a database used to track the Plans? provider networks. After the Plan agreements are signed, the MCPN database is updated with the provider requirements by type per the agreement. Prior to subcontracting with a Plan, each provider must enroll with the Department and is then entered into the MCPN database. Quarterly, the Department generates two Provider Panel Reports from the MCPN database, one for the Managed Care Plans and one for MyCare Ohio Plans, which show the number of providers for each provider type by county and/or region, and utilizes them to determine if the Plans are compliant with the requirements outlined in the agreements. If deficient, a non-compliance notice is sent to the Plan which identifies any fine assessed. Beginning with the January 2019 Managed Care Plan amended agreement, the Department implemented a time and distance standard requiring the Plans to contract with a provider within a maximum distance for the average recipient for 19 provider types. The Department utilized an Arc GIS system to determine if the time and distance requirements were met for the transitioned provider types for the remaining two quarters of SFY 2019. The remaining Managed Care provider types and MyCare Ohio plans continued to be evaluated with the minimum provider requirements. However, controls were not operating effectively, as evidenced by the following: ? Two of four (50%) Provider Panel Reports selected for testing indicated the minimum panel requirement was not met, but a noncompliance citation was not issued. Within the reports, there were 638 instances in which the Plan did not meet the minimum panel requirements and a noncompliance citation was not issued. This could have resulted in a possible $1,000 nonrefundable sanction for each instance, totaling $638,000. ? Four of four (100%) Provider Panel Reports selected for testing included information that did not match the requirements listed in the agreements. Within the reports, there were 1,171 instances in which the minimum requirement on the Provider Panel Report did not agree to the requirements listed in the plan provider agreement. Of the 1,171 instances noted, 93 resulted in the minimum panel requirement not being met and a noncompliance citation was not issued (noted within the 638 instances indicated above). In addition, the January 2019 amended agreement included the Medication Assisted Treatment (MAT) requirement; however, the Department had not yet implemented a method for monitoring or evaluating this requirement so no monitoring was performed. Furthermore, beginning in January 2019, the Department began monitoring the Pharmacy Network and Community Behavior Health Center (CBHC) requirements using the time and distance standards; however, the January 2019 amended agreement included both the time and distance standard requirement and the minimum provider requirements by county/region but did not specify effective dates for either monitoring model. Without maintaining proper controls to ensure the reporting system is updated when panel standards are modified or added in the Plan agreements or to ensure the provider tables included within the Plan agreements are complete and accurate, there is an increased risk of noncompliance by the Plans that could go undetected or not be detected timely. If a Plan is not meeting the requirements of its agreement, then the population it serves could be in danger of not receiving adequate medical services in their area as required by federal regulations and program rules. Additionally, without proper notice being sent to noncompliant Plans, they may not be able to implement corrective action in a timely manner. Furthermore, by not assessing fines in accordance with the agreement, the Department risks the Plans not making compliance, and timely corrective actions, a priority. Based on discussions with management, the issues were due to an oversight that certain provider types were not included within the required provider table of the Plan agreements prior to approving them, as well as the system not being properly updated for the requirements included in the agreements. We recommend the Department review its internal control process and ensure procedures are implemented to regularly evaluate the reporting system to ensure it is updated to agree to Plan standards, including any new requirements, mandated in the Plan agreements. Additionally, the Department should reinforce its current process of reviewing the Plan agreements to ensure the provider tables provided within them are complete and accurate. Any problems noted should be promptly corrected to reduce the risk of a Plan not being in compliance with the agreement. The monitoring procedures performed should be documented to provide assurance they are performed consistently and as management intended. Additionally, these procedures should be updated on a regular basis to address any necessary changes in the contract requirements.

MFP ? PAYROLL RECONCILIATIONS Finding Number: 2019-027 State Agency Number: MCD-08 CFDA Number and Title: 93.791 ? Money Follows the Person Rebalancing Demonstration Federal Award Identification Number / Year: 1LICMS331360 / 2014 - 2020 Federal Agency: Department of Health and Human Services Compliance Requirements: Activities Allowed or Unallowed, Allowable Costs/Cost Principles Repeat Finding from Prior Audit? No SIGNIFICANT DEFICIENCY 45 C.F.R. Part 75.303 requires recipient of federal awards to ?Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award.? It is management?s responsibility to implement an adequate system of internal controls to monitor the accuracy and completeness of accounting records pertaining to federal expenditures, including periodic reconciliations of their accounts and records to the State?s accounting system, Ohio Administrative Knowledge System (OAKS). Such reconciliations must be performed timely, be thoroughly documented, and include the appropriate follow-up for all significant reconciling items. It is also management?s responsibility to periodically monitor these control procedures to verify they are operating effectively and as management intended. During state fiscal year (SFY) 2019, the Department processed approximately $1.4 million in payroll expenditures for the Money Follows the Person Rebalancing Demonstration (MFP) program for approximately 50 employees. The Department utilizes an internal timekeeping system, which interfaces with OAKS to record and process payroll transactions. Prior to interfacing the internal timekeeping system with OAKS, Human Resources (HR) personnel review all employee timesheets and compare them to appropriate supporting documentation for accuracy and completeness. Once the interface process is complete, HR personnel review various OAKS exception reports and correct inaccurate data within OAKS. Once all errors/exceptions are corrected, payroll is processed through OAKS. Once payroll is processed, the Department performs analytical procedures to determine if the cost categories and account coding are accurate; however, no additional review is performed to reconcile the information within the internal timekeeping system to OAKS to ensure all timesheets were paid out accurately. Without performing regular reconciliations between the Department's internal records and OAKS after payroll has been processed, there is an increased risk that amounts recorded in the State's accounting system may be miscoded and/or inaccurate. Additionally, without effective and timely reconciliations, the Department cannot ensure accurate recording of payroll expenditures. Furthermore, irregularities or improper transactions could go undetected. Based on discussion with management, the Department completed the reconciliation in the prior fiscal year based on an audit recommendation; however, the employee performing the reconciliation went out on extended leave and the reconciliation was not completed again even after the employee returned. We recommend the Department implement a process to ensure key control procedures are performed when there is turnover in key positions or when employees are on extended leave, including cross-training other employees. The Department should have these procedures formally documented and communicated to all staff. Additionally, the Department should re-establish performing a reconciliation of internal MFP payroll records to OAKS. Adequate documentation should be maintained to evidence the performance of the reconciliation, any follow-up performed, and management?s review of the reconciliation. Furthermore, management should be periodically monitoring these control procedures to ensure they are in place, operating effectively, and as management intended.

SABG ? SF-425 REPORT SUBMISSION Finding Number: 2019-028 State Agency Number: MHA-01 CFDA Number and Title: 93.959 ? Block Grants for Prevention and Treatment of Substance Abuse Federal Award Identification Number / Year: T1010041-17 / 2017 Federal Agency: Department of Health and Human Services Compliance Requirement: Reporting Repeat Finding from Prior Audit? No NONCOMPLIANCE AND MATERIAL WEAKNESS 45 C.F.R. Part 96 contains the Department of Health and Human Services? general administrative requirements for grants to state and local governments. 45 C.F.R. Parts 96.120 through 96.137 contain requirements specific to the Block Grants for Prevention and Treatment of Substance Abuse (SABG) program. Section III, item 6 of the Notice of Award for the 2017 grant award states: Grantees shall submit a Federal Financial Report (SF 425) by December 29, 2018 which is 90 days after the end of the obligation and expenditure period of this grant. The SF-425 shall report total funds obligated and total funds expended by the grantee and it must be submitted by email to grant.closeout@samhsa.hhs.gov. It is management?s responsibility to implement control policies and procedures to reasonably ensure compliance with program requirements. Effective controls require management review the federal reports for accuracy, completeness, and compliance with program rules and regulations prior to submission to the federal grantor agency and maintain documentation of the review, approval, and timely submission of the report. During state fiscal year (SFY) 2019, the Department disbursed approximately $64 million dollars in SABG expenditures, with $60.4 million disbursed to subgrantees. The Department had controls in place over the SF-425 report preparation and submission process. After the grant award ends, the Community Funding Operations section reconciles the award?s cash balance between the federal Payment Management System (PMS) and the State?s accounting system, Ohio Administrative Knowledge System (OAKS). The Community Funding Operations manager reviews the reconciliation before staff prepares the SF-425 report and hand delivers it to the Deputy Director of the Office of Financial Management for review and approval, evidenced by signing the report. The signed report is hand delivered back to the Community Funding Operations section to be sent by e-mail to the Grant Manager at the federal awarding agency. However, the Department could not provide documentation (either the signed report or related submission e-mail) the completed SF-425 report for the 2017 award was signed by Deputy Director nor that it was submitted to the federal agency. Without the effective and consistent performance and documentation of internal controls and maintenance of support documentation, management cannot be reasonably assured the controls are operating as intended. Furthermore, the Department cannot be reasonably assured reports are accurate, complete, and submitted in a timely manner. Any noncompliance could result in repayment, reduction, or elimination of federal funding or sanctions imposed by the federal grantor agency. Based on discussions with management and review of supporting documentation, it appears these conditions were the result of staff oversight and not maintaining appropriate documentation. We recommend the Department evaluate and strengthen its existing procedures, if necessary, to provide reasonable assurance the reports are accurate, complete, and submitted timely to the federal government. Evidence of report reviews should be documented and maintained, according to an approved record retention schedule, to provide management with reasonable assurance the procedures are performed timely and accurately. Specifically, we recommend the Department maintain a copy of the signed SF-425 report and the e-mail submitted to the federal agency. We also recommend the Department establish procedures to periodically monitor its compliance with the related controls and initiate necessary actions to resolve any noncompliance that results. Evidence of such monitoring procedures should be maintained to provide management with assurance the controls are operating consistently and effectively, and to identify the need for additional training or modification of the existing procedures.

SABG ? PAYROLL Finding Number: 2019-029 State Agency Number: MHA-02 CFDA Number and Title: 93.959 ? Block Grants for Prevention and Treatment of Substance Abuse Federal Award Identification Number / Year: T1010041-18 / 2018 Federal Agency: Department of Health and Human Services Compliance Requirements: Activities Allowed or Unallowed, Allowable Costs/Cost Principles Repeat Finding from Prior Audit? Yes Prior Audit Finding Number: 2018-024 MATERIAL WEAKNESS 45 C.F.R. Part 96 contains the implementing regulations for the Block Grants for Prevention and Treatment of Substance Abuse (SABG) program, as well as general administrative requirements for SABG. Specifically, 45 C.F.R. Part 96.30 (a) contains fiscal and administrative requirements and states, in part: Except where otherwise required by Federal law or regulation, a State shall obligate and expend block grant funds in accordance with the laws and procedures applicable to the obligation and expenditure of its own funds. . . . Ohio Rev. Code Chapter 124 contains laws related to state employment. In addition, the Department implemented Policy HR-14, Central Office Work Schedules, Timekeeping, Overtime and Compensatory Time, and Flexible Scheduling Policy, to expand on parts of Ohio Rev. Code Chapter 124. Sections B.8 and B.9 of this policy state: Timekeeping accountability: It is the duty of every employee of the Department to accurately and truthfully report and receive compensation for hours worked. Additionally, it is the duty of an employee?s direct supervisor to verify that the hours reported reconcile with the employee?s schedule, including approved leave usage. The employee will enter time worked in his/her MHAS timekeeping record. The timekeeping record and any approved compensatory/overtime requests and/or requests for leave will be reviewed by the section timekeeper before final approval of the timekeeping record by the employee's supervisor. It is management?s responsibility to implement control policies and procedures to reasonably ensure payroll transactions are processed accurately and completely; comply with applicable laws and regulations; and, are based on complete and accurate employee timesheets. Controls must be adequately documented to provide assurance the controls are performed timely and consistently. During state fiscal year 2019, the Department disbursed approximately $3.2 million in payroll costs from the SABG program. These payroll costs were for Central Office employees who enter their time worked, as well as leave and overtime/compensatory time (OT/CT) requests, directly into Kronos, the Department?s timekeeping system. Each employee?s supervisor is to review and approve/disapprove leave and OT/CT requests and the employee?s timesheets. To help ensure timesheets are approved timely, the Department had a control in place that an employee from the Payroll Division query Kronos to identify unapproved timesheets after the end of each pay period and notify the supervisor that the timesheet requires approval. The Kronos timesheets are then interfaced with the Ohio Administrative Knowledge System?s (OAKS) Human Capital Management (HCM) module for processing. However, six of 60 (10%) timesheets tested did not contain the supervisor?s approval. Without proper documentation of management?s review and approval of timesheets and other internal controls, a risk exists that procedures may not be working as intended or may not be consistently applied. If control procedures are not performed and documented consistently, management cannot be reasonably assured the employee timesheets are complete and accurate, which increases the risk that employee compensation is not proper. Based on discussions with management and review of supporting documentation, the time sheets were not properly approved because the supervisor was not available on the day they were required to be approved or the supervisor did not get into Kronos before it interfaced with OAKS. We recommend the Department continue to strengthen and enforce its current control procedures and processes relating to the review of employee timesheets. Management should stress the importance of completing the required reviews of timesheets and the need to document such reviews. The Department should designate alternate approvers if the employee?s supervisor is not available to approve the timesheets. We also recommend the Department establish procedures to periodically monitor its compliance with the related controls and initiate necessary actions to resolve any noncompliance that results. Evidence of such monitoring procedures should be maintained to provide management with assurance the controls are operating consistently and effectively, and to identify the need for additional training or modification of the existing procedures.

SABG ? CODING ERRORS Finding Number: 2019-030 State Agency Number: MHA-03 CFDA Number and Title: 93.959 ? Block Grants for Prevention and Treatment of Substance Abuse Federal Award Identification Number / Year: T1010041-16 / 2016 T1010041-17 / 2017 T1010041-18 / 2018 Federal Agency: Department of Health and Human Services Compliance Requirements: Activities Allowed or Unallowed, Allowable Costs/Cost Principles Repeat Finding from Prior Audit? No SIGNIFICANT DEFICIENCY 45 C.F.R. Part 75 establishes uniform administrative requirements, cost principles, and audit requirements for federal awards provided by the Department of Health and Human Services to non-federal entities. 45 C.F.R. Part 75.302(a) relates to financial management and states, in part: Each state must expend and account for the Federal award in accordance with state laws and procedures for expending and accounting for the state?s own funds. In addition, the state?s and the other non-Federal entity?s financial management systems, including records documenting compliance with Federal statutes, regulations, and the terms and conditions of the Federal award, must be sufficient to permit the preparation of reports required by general and program-specific terms and conditions; and the tracing of funds to a level of expenditures adequate to establish that such funds have been used according to the Federal statutes, regulations, and the terms and conditions of the Federal award. . . . As part of administering the Block Grants for Prevention and Treatment of Substance Abuse (SABG) program, it is management's responsibility to consistently and effectively track and compile financial data related to federal program activities. This is typically accomplished through the use of a chart of accounts with enough detail to reasonably ensure financial information can be gathered and organized to allow management to effectively analyze and/or report on program operations. During state fiscal year (SFY) 2019, the Department disbursed approximately $64 million dollars in SABG expenditures, with $60.4 million disbursed to subgrantees, using the state accounting system, OAKS (Ohio Administrative Knowledge System). The Department had various internal controls in place to review and approve subgrantees? requests for funding before making the disbursements, as well as reconciliations to the data processed by OAKS. However, these controls did not prevent or identify the following errors timely: ? One of 25 (4%) vouchers selected for testing, totaling $71,458, was coded incorrectly in OAKS and was not identified timely enough by the Department to post an adjustment. The voucher was coded in February 2019 to the program year 2016 grant award instead of the program year 2018 award from which it was drawn. The Department did not identify the miscoding until August 2019, after the financial activity for SFY 2019 had been closed and could not be adjusted. ? Seven adjustments, totaling $165,972, were necessary to the OAKS data to accurately identify expenditures on the Schedule of Expenditures of Federal Awards due to miscoding errors. Four expenditures were recorded to other grant awards that should have been coded to the program year 2018 award, and two refunds were incorrectly coded to other grant awards that should have been coded to either the program year 2016 or 2017 awards. The Department identified these miscodings and made appropriate adjustments to amounts reported on required federal reports and the Schedule of Expenditures of Federal Awards, but not always to the official accounting records of OAKS. ? In December 2018, while preparing the SF-425 report for the closeout of the 2017 grant award (ended September 30, 2018), the Department reconciled revenue for the lifetime of the grant between OAKS and its records and identified a miscoding of $983,173. This amount equaled 1.5% of the total 2017 award and was drawn down from the FY 2018 award but coded to the FY 2017 award. In February 2019, the Department identified this same amount as a coding error against the 2017 grant expenditures, while reconciling the expenditures of the 2018 award. The Department did correctly report the revenues and expenditures on the SF-425 report for the 2017 award but did not make any adjustments to OAKS. As a result, the revenues and expenditures for both awards are incorrect in the official accounting records of OAKS. Inaccurate coding of program expenditures increases the risk of misstatements in amounts included on internal or external reports and could result in management making decisions about program activities based on inaccurate information. As a result, the Department could be subjected to fines and/or sanctions or a reduction in future federal funding. Based on discussions with management and review of supporting documentation, not detecting the miscoding during the initial reviews were due to oversight by the reviewers. Also, the errors were identified during the reconciliation process as reconciling items but not identified as needing adjustment until after the fiscal year had been closed and adjustments could not be made. We recommend management evaluate and strengthen, if needed, its current policies and procedures over the reviews and reconciliations related to all federal disbursements, especially the SABG program. Any discrepancies or unusual activity should be documented, investigated, and any necessary corrective actions implemented in a timely manner. In addition, we recommend management emphasize to staff the importance of remaining alert while performing control procedure, and provide training to staff if needed. Furthermore, management should periodically monitor these procedures and activities to ensure they are functioning as intended and being completed timely.

FISH AND WILDLIFE CLUSTER ? SUSPENSION AND DEBARMENT Finding Number: 2019-031 State Agency Number: DNR-01 CFDA Number and Title: 15.605 / 15.611 ? Fish and Wildlife Cluster Federal Award Identification Number / Year: F15AF00519 / 2015 F14AF01335 / 2017 F17AF00469 / 2017 F17AF01310 / 2018 F18AF00502 / 2018 F18AF00597 / 2018 Federal Agency: Department of the Interior Compliance Requirement: Procurement and Suspension and Debarment Repeat Finding from Prior Audit? Yes Prior Audit Finding Number: 2018-025 NONCOMPLIANCE AND MATERIAL WEAKNESS 2 C.F.R. Part 180 provides government-wide suspension and debarment requirements for covered transactions, which include both procurement and nonprocurement transactions. Procurement transactions are contracts for goods or services expected to equal or exceed $25,000, while nonprocurement transactions include grants and cooperative agreements regardless of the amount. Specifically, 2 C.F.R. Part 180.300 states: When you enter into a covered transaction with another person at the next lower tier, you must verify that the person with whom you intend to do business is not excluded or disqualified. You do this by: (a) Checking SAM Exclusions; or (b) Collecting a certification from that person; or (c) Adding a clause or condition to the covered transaction with that person. It is management?s responsibility to ensure adequate procedures are in place to provide reasonable assurance they do not enter into any covered transaction involving federal funds with an entity who is suspended, debarred or otherwise excluded from entering into the transaction. During state fiscal year 2019, the Department entered into eight covered procurement transactions totaling $327,713 and 297 covered nonprocurement agreements totaling approximately $7.2 million for the Fish and Wildlife Cluster. Prior to April 2019, the Department?s process to ensure these entities were not suspended or debarred before entering a contract involving federal funds was to search the Ohio Auditor of State?s Unresolved Finding for Recovery database and include a clause in the nonprocurement contracts intended to address suspension and debarment. However, the Finding for Recovery database relates only to entities prohibited from being awarded a contract with the State of Ohio. It does not satisfy the requirements of 2 C.F.R. Part 180, which prohibit a transaction with an entity excluded from participating in a transaction with the federal government. In addition, the clause included within the nonprocurement contracts did not fully satisfy the requirements of 2 C.F.R. Part 180. We noted the Department implemented a revised clause for new nonprocurement contracts in May 2019 properly addressing suspension and debarment requirements; however 274 of the 294 (93.5%) contracts in state fiscal year 2019 did not contain this revised clause. Additionally, the Department had not implemented any updated language for any procurement contracts. Without the necessary procedures in place to verify if vendors are suspended or debarred prior to entering into transactions with them, the Department risks providing federal funds to excluded parties. This could result in disallowed costs, repayment of federal funds, penalties, and/or termination of the award. Based on discussions with management, previously they believed the search on the Auditor?s website satisfied the federal compliance requirement and the information contained within the nonprocurement contracts was sufficient to satisfy the requirements. We recommend the Department continue to use the updated template for the nonprocurement contracts and implement similar language into procurement contracts. We also recommend the Department evaluate all vendors who did not utilize the revised contract during state fiscal year 2019 to verify they were not suspended, debarred, or otherwise excluded. In addition, management should periodically re-evaluate their contract templates and policies and procedures to reasonably ensure the information is current, accurate, and properly addresses the federal requirements.

FISH AND WILDLIFE CLUSTER ? EQUIPMENT AND REAL PROPERTY MANAGEMENT Finding Number: 2019-032 State Agency Number: DNR-02 CFDA Number and Title: 15.605 / 15.611 ? Fish and Wildlife Cluster Federal Award Identification Number / Year: F15AF00519 / 2015 F14AF01335 / 2017 F17AF00469 / 2017 F17AF01310 / 2018 F18AF00502 / 2018 F18AF00597 / 2018 Federal Agency: Department of the Interior Compliance Requirement: Equipment and Real Property Management Repeat Finding from Prior Audit? Yes Prior Audit Finding Number: 2018-026 NONCOMPLIANCE AND MATERIAL WEAKNESS 2 C.F.R. Part 1402.100 gives regulatory effect to the Department of the Interior for 2 C.F.R. Part 200.313, which establishes equipment procedures acquired under Federal awards and states, in part: (b) A State must use, manage, and dispose of equipment acquired under a Federal award by the state in accordance with state laws and procedures... Ohio Rev. Code (ORC) Part 125.16 (A) states, in part: In accordance with procedures prescribed by the director of administrative services, the officer in charge of each state agency, other than an institution of higher education, shall maintain current and accurate records of tangible personal property and real property, as defined by the department of administrative services that the state agency holds either directly or on behalf of the state. These records shall specify the value of the property, the number of acres of land, the number and kind of buildings, and other significant information about the property, as designated by the department. The Ohio Department of Administrative Services (DAS) serves as the oversight agency for the State?s inventory records such as equipment, land, buildings etc. DAS establishes inventory policies and procedures for state agencies to use for managing and reporting inventory within the State of Ohio Asset Management Handbook. The policy within the Handbook requires buildings and land acquisitions be recorded in the State?s AMS (Asset Management System) promptly following receipt of the asset. Additionally, the Department?s internal inventory policy requires inventory items be entered into AMS within five working days of payment. It also requires staff to forward acquisition information to the division inventory coordinator in a timely manner; however, it does not include who is responsible for maintaining the supporting documentation for building and land purchases. It is management?s responsibility to have internal control procedures in place to ensure compliance with these procedures as well as the ORC. Such controls must reasonably ensure inventory is entered promptly and inventory records maintained by the Department are accurate, complete and have proper supporting documentation. As of June 30, 2019, AMS reported the Department had $27.3 million in buildings, $115.2 million in land, and $12 million in equipment recorded as assets on hand purchased with Fish and Wildlife Cluster federal funds. Purchases of land or buildings go through the Department?s Office of Real Estate and Land Management (REALM). The Division of Engineering and REALM work with the Division of Wildlife to ensure the purchase is allowable per the grant agreement and the Division of Engineering enters the payment information related to the purchase into the state?s accounting system, Ohio Administrative Knowledge System (OAKS). Purchases of equipment are performed at the various statewide districts in cooperation with the Department's Inventory Coordinator. The Office of Budget and Finance (OBF) is responsible for entering the asset information into AMS. However, these AMS updates are not done within the five business days required by the Department?s internal policy and are not considered prompt in accordance with the State?s Handbook policies. For buildings, the OBF Inventory Specialist updates the AMS annually based on a report from the Division of Engineering detailing buildings purchased during the year. For land, the OBF Inventory Control Specialist updates the AMS semi-annually from an OAKS Business Intelligence expenditure report (by account code) and the related voucher and invoice. Additionally, we noted the following during testing: ? For 42 of 60 (70%) non-equipment inventory assets (i.e. land, buildings, etc.) selected for testing, documentation was not provided to support the Department's valuation of the asset, or the documentation provided did not match the Department?s valuation in AMS. Additionally, for six of these assets, no documentation was provided to support the Department?s ownership of the assets in AMS. ? For one of 12 (8.3%) equipment inventory assets selected for testing, supporting documentation did not support the Department's valuation in AMS. Without promptly entering inventory purchases or keeping appropriate supporting documentation on file, management cannot be reasonably assured the inventory listing is complete and accurate when certified annually to DAS. This increases the risk assets in the State of Ohio?s financial statements could be misstated, improper transactions may not be detected in a timely manner, or the Department could be out of compliance with applicable state and federal laws. Noncompliance with federal regulations could result in federal funds being reduced, taken away, or other sanctions imposed by the federal grantor agency. Based on discussions with management, documentation was unable to be located due to turnover within the Department, multiple divisions being involved in purchases without a clear indication of who was responsible for maintaining the documentation, or assets being purchased many years ago and not being able to be located. Asset information was not entered timely into AMS because divisions responsible for the purchases were not submitting documentation on a timely basis to the division responsible for asset entry. We recommend the Department continue its efforts to review its existing procedures and develop improved internal controls over asset reporting. Procedures should be updated to ensure they align with DAS regulations and policies, and clarify who should be maintaining the related supporting documentation. The Department should continue in its efforts to update asset information, including obtaining and maintaining proper documentation to support the Department?s inventory listing. We also recommend management implement periodic monitoring procedures to ensure the established controls are operating effectively and as intended. In addition, we recommend the Department work with the Ohio Office of Budget and Management (the preparer of the State?s financial statements) and DAS to determine how to proceed with assets currently being reported on the AMS if no documentation can be located to support the valuation.

FISH AND WILDLIFE CLUSTER ? SUBRECIPIENT MONITORING Finding Number: 2019-033 State Agency Number: DNR-03 CFDA Number and Title: 15.605 / 15.611 ? Fish and Wildlife Cluster Federal Award Identification Number / Year: F15AF00519 / 2015 F14AF01335 / 2017 F17AF00469 / 2017 F17AF01310 / 2018 F18AF00502 / 2018 F18AF00597 / 2018 Federal Agency: Department of the Interior Compliance Requirement: Subrecipient Monitoring Repeat Finding from Prior Audit? Yes Prior Audit Finding Number: 2018-027 NONCOMPLIANCE AND MATERIAL WEAKNESS 2 C.F.R. Part 1402.100 gives regulatory effect to the Department of the interior for 2 C.F.R Part 200.331, which establishes requirements over subawards for pass-through entities and states, in part: All pass-through entities must: (a) Ensure that every subaward is clearly identified to the subrecipient as a subaward and includes the following information at the time of the subaward and if any of these data elements change, include the changes in subsequent subaward modification. When some of this information is not available, the pass-through entity must provide the best information available to describe the Federal award and subaward. Required information includes: (1) Federal Award Identification. . . . (ii) Subrecipient?s Unique Identity Number; (iii) Federal Award Identification Number (FAIN); . . . (xi) CFDA Number and Name; the pass-through entity must identify the dollar amount made available under each Federal award and the CFDA number at time of disbursement; It is management's responsibility to ensure subaward agreements appropriately identify all required subaward identification information and include the appropriate terms and conditions. During state fiscal year 2019, the Department entered into 297 grant agreement contracts with subrecipients for the Fish and Wildlife Cluster totaling approximately $7.2 million. These agreements outlined the requirements the subrecipients were expected to adhere to and disclosed some required subaward information. In May 2019, the Department implemented a new grant agreement and amended some prior existing agreements to ensure the requirements of 2 C.F.R. Part 200.331(a) were being properly communicated; however, there were still a significant number of agreements made in state fiscal year 2019 where all subaward information required per the C.F.R. were not included. Of the 40 grant agreements selected for testing, 37 (92.5%) did not include certain aspects of the award information required per 2 C.F.R. Part 200.331(a), as follows: ? 26 subawards did not include the CFDA name and number of the awarded funds. ? 34 subawards did not include the subrecipient?s Unique Identity Number. ? Three subawards did not include the FAIN. Without consistently identifying all required subaward information, including the appropriate terms and conditions of the subaward, subrecipients may not be aware of relevant identifying information or requirements with which they must comply. This could result in subrecipients using the subawards for unallowable activities or incorrectly identifying the award on their Schedule of Expenditures of Federal Awards or other reports. Additionally, noncompliance by the Department with federal regulations could result in federal funds being reduced, taken away, or other sanctions imposed by the federal grantor agency. Based on discussions with management, prior to its implementation late in the audit period, there was no common contract template in place for subrecipients to communicate all the information specified by 2 C.F.R. Part 200.331(a). All previous agreements were customized to each subrecipient based on program objectives specified by the Department. We recommend the Department continue to implement and utilize its revised contract templates to reasonably ensure required subaward information per 2 C.F.R. Part 200.331(a) is communicated to all subrecipients. The Department should also continue in its efforts to amend previous subaward agreements to properly identify the required information. The Department should monitor future subaward agreements to ensure all required information is identified in a consistent manner and the appropriate terms and conditions are included.

IT ? LACK OF A SOC 1 AUDIT FOR SERVICE ORGANIZATIONS Finding Number: 2019-034 State Agency Number: DNR-04 CFDA Number and Title: 15.605 / 15.611 ? Fish and Wildlife Cluster Federal Award Identification Number / Year: F15AF00519 / 2015 F14AF01335 / 2017 F17AF00469 / 2017 F17AF01310 / 2018 F18AF00502 / 2018 F18AF00597 / 2018 Federal Agency: Department of the Interior Compliance Requirement: Reporting Repeat Finding from Prior Audit? Yes Prior Audit Finding Number: 2018-028 MATERIAL WEAKNESS 2 C.F.R. Part 1402.100 gives regulatory effect to 2 C.F.R. Part 200.303(a), which requires recipients to maintain internal controls over federal programs that provide reasonable assurance they are in compliance with laws, regulations, and the provisions of contracts or grant agreements. It is management?s responsibility to monitor these control procedures to verify they are designed and operating in a manner consistent with federal regulations and program objectives. Furthermore, sound internal control procedures require management to monitor and oversee operations of contractors responsible for carrying out federal requirements to provide reasonable assurance procedures performed by the contractor are functioning as intended and in compliance with federal regulations and contractual obligations. Many entities use outside service organizations to process transactions as part of the entity?s information system. Service organizations provide services ranging from performing a specific task under the direction of an entity to replacing entire business units or functions of the entity. When the operating activity is not directly administered by the entity, such as when utilizing a service organization, it is critical the appropriate monitoring controls are designed and implemented to reasonably ensure the service organization has adequate controls to achieve management?s goals and objectives and complies with applicable laws and regulations. SOC 1 audits are performed over these service organizations to provide information about their internal controls to management and to auditors who rely on the SOC 1 report results for the audit of the user entity?s financial statements and IT systems. During state fiscal year (SFY) 2019, the Department used the web-based Ohio Wildlife Licensing System (OWLS) to process sales of approximately $36.3 million in hunting and fishing licenses and permits. A portion of these sales must be reported to the federal government annually. The Department contracted with a vendor (service organization) to host this system, which required they provide backups, technical assistance, security monitoring, system enhancements, and system updates for the OWLS application. The service organization, in turn, contracted with another vendor (subservice organization) to house their application and to maintain and oversee the hardware. The Department also relied on the service organization?s disaster recovery plan. The Department?s contract with the service organization contained a provision requiring it to obtain a SOC 1 Type 2 audit annually; however, a SOC 1, Type 2 audit of the service organization was not completed for the audit period. A SOC 1 Type 2 audit was completed for the subservice organization covering part of SFY 2019; however, the Department did not review this report. Without a SOC 1 Type 2 audit of the service organization, the Department may not have sufficient information to reasonably ensure controls are in place, designed properly, and operating effectively to help ensure the integrity of the controls for the data processed, maintained, and reported by the OWLS web application and the service organization. This could also result in inaccurate data reported annually to the federal grantor agency. Department management indicated the service organization vendor did not initially agree that they were required to have a SOC 1 Type 2 audit performed because of the SOC 1 audit performed of their contracted subservice organization. The vendor recently agreed to complete a SOC 1 Type 2 audit and contracted with an audit firm to conduct the audit; however, vendor representatives were unable to provide detail of the planned reporting period or audit start date. We recommend the Department take steps to ensure a SOC 1 Type 2 audit is completed annually of the service organization for the OWLS web application and its processing environment to provide a description of the system, results of the OWLS internal control testing of operating effectiveness, and an opinion of the overall processing environment. In addition, the Department should review any complementary user entity controls resulting from the SOC 1 audit to ensure those controls are in place and operating effectively. Also, we recommend ODNR management review the subservice organization?s SOC 1 Type 2 report and the complimentary user entity controls to help ensure familiarity with all aspects of the OWLS processing environment.

VR ? MAINTENANCE OF EFFORT Finding Number: 2019-035 State Agency Number: OOD-01 CFDA Number and Title: 84.126 - Vocational Rehabilitation Grants to States Federal Award Identification Number / Year: H126A180052-18D / 2018 Federal Agency: Department of Education Compliance Requirement: Matching, Level of Effort, and Earmarking Repeat Finding from Prior Audit? No NONCOMPLIANCE AND SIGNIFICANT DEFICIENCY 29 U.S.C. ? 731(a)(2) established maintenance of effort (MOE) compliance standard requirements for the Vocational Rehabilitation Grants to States (VR) program and states, in part: . . . (B) The amount otherwise payable to a State for a fiscal year under this section shall be reduced by the amount by which expenditures from non-Federal sources under the State plan under this subchapter for any previous fiscal year are less than the total of such expenditures for the second fiscal year preceding that previous fiscal year. . . . It is management?s responsibility to design and implement internal controls to reasonably ensure compliance with federal laws and regulations. During state fiscal year (SFY) 19, the Agency disbursed approximately $114 million for the VR program. Quarterly, the Budget Analyst obtains a series of Ohio Administrative Knowledge System (OAKS) and internal reports of all indirect, direct, and state expenditures and prepares the SF-425 Federal Financial Report for the VR program. Once compiled, the Budget Supervisor, Chief Financial Officer (CFO), and Director meet to discuss the SF-425 report and compliance with the federal requirements and report instructions, including MOE. Once completed, the CFO and Director approve and submit the SF-425 report to the US Department of Education. However, these controls did not detect or prevent noncompliance with the MOE requirement for the federal fiscal year (FFY) 2018 grant award which ended during the audit period. For FFY 2016, the second preceding fiscal year, the Agency spent $29,741,458 from non-federal sources. For FFY 2018, the Agency spent $27,162,157 from non-federal sources, which was $2,579,301 (9.5%) less than the required MOE. By not complying with the maintenance of effort requirements, federal funding may be reduced or other sanctions imposed by the federal grantor agency. This may limit the Agency?s ability to fulfill program requirements to provide assistance to VR recipients. Based on discussions with management, the Agency was unable to obtain the state resources to meet the non-federal share of the FFY18 award MOE requirement. Consequently, a MOE penalty was assessed on the FFY19 award. We recommend the Agency evaluate its current control procedures over the VR program to ensure the MOE requirement is met. These procedures should include periodic monitoring of non-federal expenditure sources to ensure compliance, especially in the event a shortfall in meeting the requirement appears imminent. Management should periodically monitor established controls to help ensure the procedures are functioning as intended.

HIGHWAY PLANNING AND CONSTRUCTION CLUSTER ? SUBRECIPIENT MONITORING Finding Number: 2019-036 State Agency Number: DOT-01 CFDA Number and Title: 20.205/20.219/23.003 Highway Planning and Construction Cluster Federal Award Identification Number / Year: Numerous ? applies to thousands of FAINs representing each construction project/phase during the year. Federal Agency: Department of Transportation Compliance Requirement: Subrecipient Monitoring Repeat Finding from Prior Audit? Yes Prior Audit Finding Number: 2018-034 NONCOMPLIANCE AND MATERIAL WEAKNESS 2 C.F.R. Part 1201.1 gives regulatory effect to the Department of Transportation for 2 C.F.R. Part 200.331 which states, in part: All pass-through entities must: . . . (f) Verify that every subrecipient is audited as required by Subpart F - Audit Requirements of this part when it is expected that the subrecipient's Federal Awards expended during the respective fiscal year equaled or exceeded the threshold set forth in section 200.501 Audit requirements. Federal regulations require pass-through entities to maintain internal controls over federal programs that provide reasonable assurance they are in compliance with laws and regulations. In addition, sound internal control procedures require management to monitor these control procedures to verify they are designed and operating in a manner consistent with federal regulations and program objectives. To be effective, the performance of internal controls must be evidenced in some manner to document the control is in place and functioning as intended. During state fiscal year (SFY) 2019, the Department disbursed approximately $257.2 million from the Highway Planning & Construction Cluster (HP&CC) in subawards to local public agencies (LPAs). Prior to beginning work on a project, an agreement is signed between the Department and the LPA which details the total amount of federal funds to be obligated and the LPA?s administrative requirements, including tracking receipts and payments and reporting these appropriately on the Schedule of Expenditures of Federal Awards (SEFA). LPA expenditures are to be reported on the SEFA as they are incurred, including payments made directly to vendors, and not when the LPA receives subsequent reimbursement from the Department. The Department?s Office of External Audits has made available an optional confirmation process in which an LPA may request a review of expenditures/projects they plan to include on the entity?s SEFA for completeness and accuracy prior to an audit being performed. The Department periodically reviews the Federal Audit Clearinghouse to identify subrecipient audits for which the HP&CC program was tested as a major program and/or identify findings related to the HP&CC program. The Department then utilizes this information in its risk-based, tiered approach to determine the desk review process. However, the Department does not have a process in place to verify that every subrecipient is audited when it is expected in accordance with 2 C.F.R. Part 200.331(f). Failure to adequately monitor subrecipients to ensure they receive a Single Audit when applicable, increases the risk that subrecipients may not properly utilize federal funds or adhere to program requirements, potentially jeopardizing federal funding. Noncompliance by the Department could cause federal funding to be reduced, taken away, or sanctions imposed by the federal grantor agency. Based on discussions with the Department, its internal systems are not adequately equipped to easily identify what amounts should be reported on each entity?s SEFA. In addition, responsibilities of the Department and LPAs can be split for certain phases of the contract which adds to the complexities. Furthermore, the Department has limited resources and staff whose main focus is performing desk reviews. We recommend the Department evaluate the subrecipient monitoring policies and procedures and implement a process for identifying the federal HP & CC funds passed through to each subrecipient in order to ensure they receive a Single Audit when necessary to meet the requirements of 2 C.F.R. Part 200.331. In addition, we recommend the Department continue to explore methods to better identify subrecipient payments and where the responsibilities belong for reporting purposes. Furthermore, procedures performed by the Department should be adequately documented to provide management reasonable assurance they have been performed. Management should periodically monitor these procedures to ensure they are operating effectively and as intended.

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION